Every daycare in Canada has a sign-in sheet. Names, times, the occasional coffee stain. It is not where most of us picture a police investigation starting.

And yet here we are.

Bill C-22, the Lawful Access Act, 2026, is now before a Senate committee, and last week’s hearings showed just how far it could reach. The bill would make it easier for police to get “subscriber information” about who is behind an account, on a lower legal threshold than many expect. Canada’s Privacy Commissioner told senators on 2 November that the bill is better than earlier versions but still needs work. I agree with him, and I think the Senate should take the hint.

What is Bill C-22, the Lawful Access Act?

Part 1 amends the Criminal Code and several other statutes to speed up police access to basic information. It creates a “confirmation of service demand”, which lets a police officer, without going to a judge, ask a telecom provider a yes-or-no question: do you provide service to this person, account or identifier? It also creates a new court production order for subscriber information, which the bill text as passed by the House defines to include names, pseudonyms, addresses, phone numbers, email addresses, account numbers and details about the devices someone uses.

Part 2 creates a new statute, the Supporting Authorized Access to Information Act, which obliges “electronic service providers” to help authorized people access information. BetaKit reported that House amendments cut a metadata retention period from one year to six months, but critics said that wasn’t enough, and Signal and NordVPN said they would leave Canada.

According to LEGISinfo, the bill passed third reading in the House on 18 June 2026 and was referred to the Senate’s national security committee on 22 October. It is not law yet.

Can police get your subscriber information without a warrant?

This is the question friends ask me most, right after whether their phone is listening to them. (It’s complicated. Put the phone down.)

Under the bill, the confirmation demand needs no judge at all. The officer only needs reasonable grounds to suspect an offence and that the answer will help. The provider can go to a judge within five business days to challenge it, and ignoring a valid demand without lawful excuse can bring a fine of up to $5,000.

The production order does involve a judge, but the test is still reasonable grounds to suspect. Law professor Michael Geist describes this as the lowest standard in Canadian criminal law. More striking is who can receive the order: anyone who provides services to the public. Geist reports that the Privacy Commissioner flagged health care providers, lawyers, financial institutions and dating apps as possible recipients, and that a Justice official told senators, “It could be a daycare in some cases.”

Hence my sign-in sheet.

Why does this matter so much? Because the Supreme Court of Canada has already told us that the little details behind our online lives are not trivial. In R. v. Bykovets (2024), a 5-4 majority held that a police request for an IP address is a search under section 8 of the Charter. Justice Karakatsanis called the IP address “the key to unlocking a user’s Internet activity and, ultimately, their identity.” Subscriber information is the other half of that key.

What did the Privacy Commissioner tell the Senate?

Privacy Commissioner Philippe Dufresne appeared before the committee on 2 November. According to BetaKit’s report on his testimony (his full statement is on the OPC website), he said the bill is a significant improvement on earlier versions but still needs further amendments, including:

• narrowing what information can be collected, and from whom;
• clearly defining “publicly available information”;
• carving out health-related and privileged information;
• letting service providers trigger an independent assessment of how an access order would affect them; and
• building necessity and proportionality into the law.

On that last point, he told senators there is “no overarching requirement” that the Act’s obligations be both necessary and proportionate. That is a polite way of saying the brakes are optional.

My take: lawful access should mean narrow access

To be fair to the bill, crime has moved online, and police shouldn’t need a paper chase to learn which telecom serves a suspect’s phone. A quick yes-or-no confirmation, with a way to challenge it, is reasonable. The government’s side argues police need these tools to support victims and protect Canadians, and on the basic goal, they have a point.

My concern is the edges, because in law that’s where everything happens.

First, the “publicly available” rule. The bill says police don’t need an order or a demand to obtain and act on “information that is available to the public.” Fine for a newspaper. But plenty of very personal data is technically “available” because a data broker sells it or a breach leaked it. Undefined, that phrase could do a lot of quiet work.

Second, the reach. Having spent years running technology programs, I know that once a capability exists, it gets used more widely than anyone planned. An order that can go to any business serving the public has very wide doors. Geist suggests limiting it to telecom providers, which seems to me the obvious fix.

Third, the principle. Necessity and proportionality are not exotic ideas. They are familiar principles in Canadian and European privacy law. Writing them into the statute costs a legitimate request nothing and gives judges something firm to hold when a request goes too far.

Sober second thought is not obstruction. It’s quality control. We had a similar oversight debate over Canada’s critical cyber systems law, and the lesson holds: strong powers need strong guardrails.

So what should you do?

If you’re an ordinary Canadian: nothing changes yet, because the bill isn’t law. But count how many services hold your name, email and device details. Every unused account is one more place your information sits, so delete the ones you don’t need. And if you care about this issue, the committee’s hearings are public and worth following.

If you run a business that serves the public: don’t assume this is only a telecom problem. Know where your customer data lives, who would receive an order, and how fast you could respond or challenge it. The bill’s challenge windows are short.

If you’re a lawyer or privacy professional: watch the committee’s report for changes to the subscriber information definition, the “publicly available” rule and the production order’s scope. Any Senate amendments would also go back to the House.

FAQ

Is Bill C-22 law yet?

No. Bill C-22 passed the House of Commons on 18 June 2026 and is now being studied by the Senate’s national security committee. It still needs to pass third reading in the Senate and receive Royal Assent. If senators amend it, the House must consider those changes before the bill can become law.

What is subscriber information under Bill C-22?

The bill defines subscriber information broadly. It includes details that identify a subscriber or client, such as name, pseudonym, address, phone number and email address, plus account numbers and other identifiers, and information about the services used, including the devices or equipment involved. The definition does not list the content of your messages.

Why is the Privacy Commissioner concerned about Bill C-22?

The Commissioner says the bill improves on earlier versions but still needs amendments. As reported, he wants tighter limits on what can be collected and from whom, a clear definition of “publicly available information”, carve-outs for health and privileged data, and a general requirement that obligations under the law be necessary and proportionate.

---

This article is for general information and entertainment only. It isn’t legal advice and doesn’t represent the views of any organization I am affiliated to. If you need advice on your specific situation, talk to a qualified lawyer in your jurisdiction.