Would a Flock-type surveillance network fly under Canadian privacy laws?

INTRODUCTION

The system operated by Flock Safety in the United States has been in the news A LOT recently.  I’m going to break down why this would not fly in Canada, thanks to our federal and provincial privacy laws.

This hasn’t been tested by any Canadian courts yet, but my views are based on some pretty strong authorities.

I am not a US lawyer, so I’ll assume that what Flock Safety does in the US is consistent with American laws. What I plan to do in this episode is to apply a Canadian legal and privacy lens to examine whether such a system is consistent with Canadian laws.

In the YouTube version of this episode, I’ll have bookmarks so you can jump to different parts of this discussion in case there are aspects of this discussion you’re most interested in.

So could a company like Flock operate the same kind of surveillance network in Canada?

My conclusion is that the business model would run into some very serious problems with Canadian privacy law. And that's not because automated licence plate recognition is illegal in Canada. It isn't.

It's because our privacy laws place fundamental limits on the collection, retention, use, and disclosure of personal information. And those limits don't disappear just because the information was collected in a public place.

Let's get into it.

HOW ALPR SYSTEMS AND FLOCK SAFETY WORK

First, a little background.

Automated licence plate recognition, or ALPR, isn't particularly new.

It's been used by Canadian police departments for years.

The technology uses cameras and software to recognize licence plate numbers. In traditional police applications, those numbers are compared against a list of vehicles that police are interested in.

For example, a stolen vehicle, a vehicle associated with a missing person, or a vehicle registered to someone whose licence has been suspended.

If the system finds a match, that's called a hit.

If there's no match, that's called a non-hit.

The distinction between hits and non-hits is going to be very important in a few minutes.

Flock takes this technology and builds a much bigger business around it.

It sells subscriptions to its camera systems, cloud software, data storage, and investigative tools.

The customers aren't exclusively police departments.

A shopping mall might put cameras at the entrances to its parking lots. A business park might install them on its property. A residential community might put them at neighbourhood entrances.

And police departments can install them at intersections and along public roads.

The cameras photograph vehicles and produce searchable records including their licence plates, the time, the location, and other information about the vehicle.

All of this is managed through Flock's cloud platform.

Flock says that each customer owns its information and controls whether that information is shared with other organizations. It also says there isn't one single national database containing everything collected by its customers.

So a company that owns shopping centres can install cameras at its dozens of shopping centres and can use the data to investigate organized shoplifting rings. That company can choose whether the data from their cameras, located on their private property is shared only within the company or is shared more widely with local or national law enforcement.

That's an important distinction, but it doesn't change the privacy law implications overall, at least in Canada.

Customers making their information available to police agencies through a common searchable network is a disclosure of personal information for privacy law purposes.

In the United States, that can mean a police department searching information collected by cameras belonging to another police department thousands of kilometres away. Or information originally collected by a private organization.

One value of Flock's network is that it allows police to search historical information about where vehicles have been. Instead of asking whether a particular vehicle is wanted right now, police can potentially ask where that vehicle was yesterday, last week, or on some particular date. I don’t doubt that this has investigative utility.

But it does bring us to one of the big problems, at least in Canada.

PUBLIC INFORMATION IS STILL PERSONAL INFORMATION

There's a very common misconception about privacy law.

Some people assume that if something happens in public, it's fair game.

If I can see your licence plate when you drive past me, why shouldn't I photograph it?

And if I can photograph it, why shouldn't I put it in a database?

And if I can put it in a database, why shouldn't I share that database with the police?

Well, Canadian privacy law doesn't work that way.

The starting point is the definition of personal information.

Under the federal Personal Information Protection and Electronic Documents Act, or PIPEDA, personal information is information about an identifiable individual.

We have similar definitions under provincial private-sector and public-sector privacy laws.

Now, the definition doesn't say that the information has to be secret. It doesn't say the information has to be confidential. It doesn't say that it has to have been collected inside someone's home.

Information about an identifiable individual can be personal information whether it was collected in public or in private.

Take a photograph of me walking down the street.

That's personal information about me, even though I was standing on a public sidewalk.

If you record my name, that's personal information, even though my name might be publicly available.

And if you record my licence plate together with a time and location, and that information can reasonably be linked to me, that's personal information too.

I’ve done a number of episodes on photography and videography in public places.I’ll link to them below. If you’re an individual, in your personal capacity, you are free to take photos or record videos in public places to your heart’s content. But businesses and the state are subject to specific privacy laws.

There is some nuance in the case law concerning licence plates by themselves.

In a case called Leon’s Furniture Limited v. Alberta, the Alberta Court of Appeal concluded that a licence plate number collected by a furniture store wasn't personal information in the particular circumstances of that case.

But that doesn't mean licence plate information is categorically outside privacy law.

What matters is the context.

Is the information about an identifiable individual? Can it be linked to that person? What information is being collected along with the plate number?

A surveillance system deliberately designed to create searchable records of vehicle movements presents a very different situation from an isolated plate number written down by a store employee.

And that's precisely the distinction that the British Columbia Information and Privacy Commissioner made in an important investigation that we'll come to shortly.

There's another important distinction here.

Under section 8 of the Canadian Charter of Rights and Freedoms, whether someone has a reasonable expectation of privacy is fundamental to determining whether government conduct constitutes a search.

Information being exposed to public view is relevant to that analysis but it doesn't automatically settle the question.

The Supreme Court of Canada has repeatedly recognized that privacy is contextual and that technology can reveal information about people that goes far beyond what an ordinary observer might learn.

A single observation of your car on the street is one thing.

A detailed, searchable history of your movements is something else.

And under Canadian privacy legislation, the analysis doesn't even begin with the question of whether you had a reasonable expectation of privacy under section 8.

It begins with the statutory definition of personal information and the legal requirements for collecting, using, and disclosing it.

Publicly visible does not mean publicly available for every purpose. And publicly available does not mean unregulated.

PRIVATE BUSINESSES CANNOT CROWDSOURCE SURVEILLANCE

Let's begin with the private-sector side of Flock's business model.

Imagine a shopping mall in Canada installs Flock cameras at every entrance to their parking lots.

The cameras automatically collect licence plate numbers and information about vehicles entering and leaving the parking lot. Maybe the mall wants to deter theft. Maybe it's concerned about vehicle break-ins.

I’ll concede these are legitimate security concerns.

But now imagine that the mall contributes all of those records to a system that makes them searchable by police departments across Canada.

That's where Canadian private-sector privacy law becomes a major obstacle.

Under PIPEDA, and similar privacy legislation in provinces such as British Columbia, Alberta, and Quebec, organizations are generally required to obtain consent for the collection, use, and disclosure of personal information, unless a statutory exception applies.

Consent is not simply a one-time permission to do whatever the organization wants.

The individual has to understand the purposes for which their information is being collected, used, and disclosed.

And there are limits on what an organization can do, even with consent.

So let's return to our shopping mall.

When someone drives into the parking lot, have they consented to having their licence plate and movements recorded?

That depends on the circumstances, and there would have to be adequate signage letting everyone know what’s going on.

There may be situations where appropriate, limited video surveillance is justified for a legitimate security purpose.

But have they consented to having that information contributed to a national law enforcement surveillance network?

I would suggest that the answer is almost certainly no.

And simply putting up a sign saying that the property is under video surveillance doesn't necessarily solve that problem. All collection of personal information has to be limited and proportionate to the specific purposes for the collection, use and disclosure of personal information.

A reasonable person might understand that a security camera is recording activity in a parking lot.

That doesn't mean they understand that the information will be available for retrospective searches by police departments in other cities or provinces. Nor does the fact that an individual voluntarily drove into a parking lot mean that they consented to an unlimited range of secondary uses.

There are exceptions to the consent requirements, including certain disclosures for investigations and law enforcement purposes. But these are limited statutory exceptions. They are not a general licence for a private company to collect information about everyone who drives past and make that information continually available to government agencies.

Providing information in response to a properly authorized police investigation is one thing but creating a standing arrangement to supply police with access to information about everyone is another.

And there's a second legal obstacle.

A REASONABLE PURPOSE IS REQUIRED, EVEN WITH CONSENT

Section 5, subsection 3 of PIPEDA contains one of the most important provisions in Canadian privacy law.

It says that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Think about that for a moment.

Even if an organization obtains consent, it still has to demonstrate that the purpose is appropriate.

The Office of the Privacy Commissioner of Canada has published guidance explaining how this test works.

Among other things, regulators consider whether the organization has a legitimate need for the information, whether the collection is effective in meeting that need, whether less privacy-invasive alternatives are available, and whether the loss of privacy is proportionate to the benefits.

Now apply that test to a networked, multi-user surveillance system.

Is preventing theft from a shopping mall a legitimate purpose?

Yup.

Could security cameras contribute to that purpose?

Yup.

But is it necessary to retain a searchable record of every vehicle that enters the mall?

Is it necessary to contribute those records to an interconnected surveillance network?

Is it proportionate to make information about thousands of innocent customers available to law enforcement agencies for investigations having nothing to do with the shopping mall?

I think Canadian privacy regulators would have some serious concerns.

And I would go further.

I don't think routine, indiscriminate collection of vehicle movement information for contribution to a nationwide surveillance network would satisfy the reasonable-purpose requirement.

The fact that some of that information might someday be useful in an investigation doesn't make collecting all of it reasonable today.

And that's really the problem with the crowdsourcing model.

Each individual business can reasonably collect information for its own security.

But the system creates an additional purpose: accumulating surveillance information for use by other organizations. That is a fundamentally different purpose.

And it's one that needs its own legal justification.

THE B.C. PRIVACY COMMISSIONER ALREADY CONSIDERED THIS

Now, we don't have to speculate entirely about how Canadian privacy regulators might approach this.

In 2012, the Information and Privacy Commissioner for British Columbia, Elizabeth Denham, published an investigation into the Victoria Police Department's use of automated licence plate recognition.

It's Investigation Report F12-04. I’ll link to it below.

And even though the report is more than a decade old, its reasoning is relevant to today's debate about Flock.

At the time, Victoria Police were using ALPR cameras mounted on patrol vehicles.

The cameras scanned passing vehicles and compared licence plates against information identifying vehicles of interest to police. The system operated in partnership with the RCMP.

The RCMP maintained the underlying alert database, and Victoria Police supplied information generated by its ALPR system. (In British Columbia, many municipalities like Victoria have their own police departments, and the RCMP acts as the provincial police department and is the police agency of jurisdiction where there is not a municipal force.)

One of the first questions the Commissioner considered was whether the information collected by the cameras was personal information.

The Victoria Police Department had suggested that it wasn't.

The Commissioner disagreed.

She concluded that licence plate numbers, associated photographs, and information about the time and place where a vehicle was observed constituted personal information.

The reason was straightforward.

Police could connect licence plate numbers to identifiable individuals through motor vehicle and other law enforcement databases. That’s one factor that distinguishes this from the Alberta Court of Appeal decision in Leon’s: a retailer can’t connect a license plate to its owner. The police can.

The information collected by the ALPR system could reveal where someone's vehicle had been at a particular time.

And that made it information about an identifiable individual, because cops can make that connection.

So the Commissioner concluded that ALPR was collecting personal information.

But that didn't mean the police were prohibited from using the technology. In fact, she recognized that police could lawfully collect information to compare licence plates against a list of vehicles of legitimate law enforcement interest.

And here's where the distinction between “hits” and “non-hits” becomes crucial.

When the system scanned a licence plate and found a match with a legitimate police alert, that was a hit.

Police could investigate the hit and retain relevant information for an authorized law enforcement purpose.

But when the system scanned a licence plate and found no match, that was a non-hit.

And the Commissioner concluded that the police no longer had a lawful purpose for using that information once the comparison had been completed.

The police had collected the information to determine whether the vehicle was of interest. The comparison was complete. The vehicle was not of interest. End of story.

The Commissioner recommended that information relating to non-hits be deleted immediately after the system determined there was no match.

She also considered the disclosure of non-hit information by Victoria Police to the RCMP.

And her conclusion was that this disclosure was not authorized under British Columbia's Freedom of Information and Protection of Privacy Act.

This is especially important.

The fact that the recipient was another police agency did not automatically make the disclosure lawful.

The Commissioner distinguished between sharing information associated with legitimate law enforcement hits and sharing information about vehicles that were not of interest to police.

The first could be authorized. The second, in the circumstances she investigated, was not.

And that is about as direct a challenge to the Flock model as you could imagine.

Because what makes the Flock network valuable is precisely its ability to retain and search historical observations, including observations that were not connected to any identified law enforcement concern when they were collected.

The B.C. Commissioner was saying that police couldn't simply hold on to those non-hits for speculative future use.

And they couldn't send the information to the RCMP merely because the RCMP operated the central system. That’s a disclosure of personal information that has to be justified under BC’s privacy law.

WHAT ABOUT THE REST OF CANADA?

Now, this was a British Columbia investigation, and we need to be careful about that.

Canada doesn't have one uniform privacy statute that applies to every police department.

Municipal and provincial police are generally subject to the applicable provincial public-sector privacy legislation. The RCMP is subject to federal privacy law, including the federal Privacy Act.

The precise statutory wording and permitted disclosures vary.

So it would be too simple to say that one B.C. investigation is binding on every police department in the country. But the underlying principles are not unique to British Columbia.

All of our public sector privacy laws have provisions that limit collecting information to an authorized purpose, limiting its subsequent use, protecting it from unauthorized disclosure, and not retaining personal information indefinitely just because it might be useful someday.

And we have support for those principles from Ontario. In December 2024, the Information and Privacy Commissioner of Ontario updated its guidance on the use of ALPR systems by police services.

The guidance makes the same fundamental distinction between hits and non-hits.

It says non-hit information should only be collected or used briefly, to determine whether the plate matches a legitimate alert.

And once the system determines that the information is a non-hit, it should be deleted as soon as technologically feasible.

The Ontario guidance recognizes narrow circumstances in which police may need to preserve particular information while establishing whether they have lawful authority to use it.

But that's very different from indiscriminately retaining everyone's movements.

It's also worth acknowledging that some Canadian police services have adopted more permissive retention practices, which may not align with legal requirements.

For example, Toronto Police publicly report retaining non-hit records for seven days.

That illustrates an important point: Canadian police practices are not entirely uniform, and there are unresolved questions about whether every deployment complies with the applicable privacy rules.

But the approach taken by the B.C. Commissioner and reflected in Ontario's guidance is clear.

A legitimate police need to identify particular vehicles does not create a general authority to accumulate information about every vehicle.

If a police agency wants to create a historical database of everyone's movements, it needs to establish a lawful basis for that collection, retention, and subsequent use.

It cannot simply assume that because a licence plate was visible on a public road, everything about the vehicle's movements is available for unrestricted police use.

A MULTI-USER, NETWORKED SYSTEM IS THE BIG PROBLEM

There's another important issue with the Flock model.

Even if a Canadian police agency could lawfully collect particular ALPR information, that doesn't mean it can freely disclose that information to everyone else.

Suppose a police department in Halifax collects information about vehicles on Halifax streets.

The records are stored using software supplied by a private company. That alone isn't necessarily unlawful.

Police and other public bodies routinely use private contractors and cloud service providers to process and store information without any issues.

The question is whether the contractor is processing information on behalf of the police, subject to appropriate contractual and statutory safeguards, or whether the information is being made available to other organizations for their own purposes.

Those are two very different situations.

Now imagine the Halifax police department enables searches by police agencies in Toronto, Vancouver, Calgary, and hundreds of smaller communities.

And perhaps those agencies make their own information searchable in return. That is not simply outsourcing data storage. That is an arrangement for cross-agency access to personal information.

And Canadian public-sector privacy legislation regulates disclosures of personal information.

Police departments may disclose personal information for legitimate law enforcement purposes where legislation authorizes them to do so. There are provisions permitting police information sharing and cooperation. But those provisions are not unlimited.

The original collecting agency must have lawful authority for the disclosure, and the recipient must have lawful authority for its own collection and use.

Having a common commercial software provider doesn't create that authority. Neither does a data-sharing agreement. And neither does the assertion that the information might someday help solve a crime.

Remember the B.C. investigation. The Commissioner specifically found that Victoria Police were not authorized to disclose non-hit information to the RCMP under the arrangements she investigated.

And that's especially important because the RCMP was an actual law enforcement agency involved in operating the ALPR program. If that disclosure was not permitted, imagine the difficulty of justifying routine access to non-hit information by thousands of other organizations.

And don't forget the private-sector contributors.

Police receiving information from a shopping mall or a residential community need to consider the legal basis on which that information was obtained and disclosed. The Supreme Court of Canada in Bykovets said that the police needed a court order to collect an IP address from a private company. A license plate number and a specific location is more sensitive and more “biographical” than an IP address, and would inherently have a higher expectation of privacy than an IP address for Charter purposes.

An organization can't make an otherwise unlawful surveillance arrangement lawful merely by inviting the police to participate.

IT DOESN'T MATTER WHETHER THERE IS ONE DATABASE

Now, Flock makes an important point about its architecture. It says it doesn't simply combine everybody's information into one national database. It says its customers own their data and control who can access it.

That may be an important contractual and technical distinction.

But for Canadian privacy law purposes, it isn't the end of the analysis.

If police department A can search records collected by police department B, there has to be a lawful basis for that access.

The same applies if the records are held by one company on two different servers.

Or in two different customer accounts.

Or through a federated search system where the information stays in separate databases.

The issue isn't where the database sits. It's what information is collected, who can access it, and what they're allowed to do with it.

If you create a system that permits thousands of different organizations to search records of people's movements, calling it a network rather than a database doesn't change the underlying privacy issues.

Nor does saying that every participating organization owns its own records.

Privacy law doesn't stop applying when information is shared between organizations that have signed contracts with each other.

Again, that may be entirely consistent with US laws, but Canadian privacy laws are significantly different and present a real barrier to the adoption of a system like this.

DOES THIS MEAN CANADA CANNOT USE ALPR?

Absolutely not. ALPR can be a legitimate and useful law enforcement technology. That kind of system can be designed to comply with Canadian privacy requirements. The Information and Privacy Commissioners of British Columbia and Ontario said as much.

Police may also be able to retain and disclose information relating to legitimate investigations, subject to the applicable laws.

And there may be narrowly tailored investigative uses of historical information where police have specific legal authority, including judicial authorization where required. None of this means police have to abandon modern technology.

The question is whether the technology has been designed around a legitimate and authorized purpose.

What I don't think fits within our existing legal framework is the idea that a range of private businesses, shopping centres, residential communities, and police departments can contribute collected vehicle observations to a searchable surveillance system.

This is particularly the case where the records concern people who are not suspected of any wrongdoing.

There's an enormous difference between using technology to identify a stolen car and using technology to create a retrospective history of everyone's movements just in case that information might someday be interesting. That distinction is fundamental to Canadian privacy law.

CONCLUSION — THE DIFFERENCE BETWEEN SEEING AND SURVEILLING

Here's where I think the Flock debate reveals something important about privacy.

We often hear the argument that if you have nothing to hide, you have nothing to fear.

And that if you're driving on a public road, you can't really expect privacy.

But privacy isn't just about hiding things.

It's also about limiting the ability of others, including governments and private companies, to collect and assemble information about our lives. It’s about the right to be left alone to live your life without constant surveillance.

You might reasonably expect that someone could see your car parked outside a restaurant.

That doesn't mean you should expect a private company to maintain a searchable history of every restaurant you've visited.

You might expect that a police officer could observe your vehicle on a public street.

That doesn't mean the police should be able to reconstruct months of your movements without an appropriate legal justification.

Canadian privacy law recognizes that distinction.

Information about identifiable individuals remains personal information even when it is collected in public.

The fact that it is publicly visible may affect the level of privacy protection that applies, particularly under the Charter. But it doesn't turn that information into something that can be collected, used, retained, and disclosed without limits.

Our private-sector privacy laws impose requirements for consent, lawful purposes, and proportionality. Our public-sector privacy laws impose requirements for authorized collection, use, retention, and disclosure.

And the B.C. Information and Privacy Commissioner's investigation into ALPR shows that these principles aren't just theoretical.

I think those principles create formidable barriers to importing a Flock-type surveillance network model into Canada.

Just because you can see it doesn't mean you can surveil it.

 

 

My testimony on Bill C-22, the Lawful Access Act of 2026, to the House of Commons Standing Committee on Public Safety and National Security

(The full stream of the four hour meeting is here and the Notice of Meeting with the roster of witnesses is here. I was on the second panel in the second hour.)

Here is my opening statement: 

Mr. Chairman, honourable members. Thank you very much for your kind invitation to share my views on Bill C-22. I am a partner with the law firm McInnes Cooper in Halifax, where among other things, I advise clients who are on the receiving end of orders for customer information. I also teach at Dalhousie law school.

I am appearing in my personal capacity. These are my own views, and I am not speaking on behalf of any of my clients. 

I have to commend the government for its comprehensive consultation with stakeholders since Bill C-2, to which I contributed. 

I have a number of concerns and recommendations. I will note that Part 2 of Bill C-22 is VERY problematic. I can’t adequately cover all my concerns in five minutes, so I look forward to the rest of our discussion.

First, narrow the scope or raise the bar for subscriber information production orders.

The bill lowers the threshold for police to obtain a production order for subscriber information from "reasonable grounds to believe" to merely "reasonable grounds to suspect”. 

The new production orders can be directed at anyone who provides services to the public. This means police could demand records from doctors' offices, hotels, banks, and grocery stores.

Even though the definition was narrowed from previous bills, police can still demand "all the subscriber information" a service provider holds. This goes beyond a name and address and includes the "types of services provided" and all "device identifiers". This could force a medical clinic to provide info about a patient's CPAP machine, or compel Apple to hand over the digital IDs for every device a person owns, including AirTags and iPads.

Narrow the scope of these orders, or raise the bar to reasonable belief. Or it'll be found to violate the charter. 

Part 2 - the Supporting Authorized Access to Information Act (SAAIA) Generally

Nobody has made a persuasive argument that anything in Part 2 of Bill C-22 is really necessary. The Government has had 20+ years to build their case, but as NSICOP observed they only have anecdotes. We should not be undermining the privacy and safety of every single Canadian based on anecdotes. 

Part 2 of the bill targets "electronic service providers" (ESPs), but the definition is so broad it likely includes most businesses in Canada. 

If it proceeds, the Bill should include necessary guardrails: Under no circumstances should the government  be allowed to require an electronic service provider to  

(i) make changes to products or services that a business provides in the ordinary course, 

(ii) collect and retain any data beyond what the business requires for its own purposes, and 

(iii) make any changes that would affect the functionality (including ordering additional functionality) for any products or services offered by the business. 

As written, the Minister could issue a secret order to turn your Amazon Alexa into a listening device. CSIS has explicitly said they want to be able to track every single phone in Canada in real time, and telcos must make every cell phone trackable. That’s absurd. 

The Government says “we don’t plan to undermine encryption” and there are “no backdoors”. You just have to read the words in the Bill and there’s nothing to prevent that. Government officials said at this committee the Bill is “encryption neutral.” Canadians are not “encryption neutral”. 

The words of the bill clearly permit – and certainly do not prohibit – backdoors and mandatory decryption. In secret with no transparency to Canadians and little accountability. 

What the government “intends” is not relevant. What is relevant is what words end up in a statute. 

The Bill should expressly prohibit undermining or circumvention of encryption. 

Next, ministerial orders have to go 

Under Part 2, the Minister of Public Safety can issue orders to service providers that come with mandatory, permanent secrecy. 

Currently, the police and CSIS can apply to a judge for an “assistance order”, to order a service provider to provide all reasonable assistance to give effect to a warrant. This can be accompanied by a gag order if appropriate. This is judicial control. Nobody from law enforcement has offered evidence that assistance orders are inadequate and should be replaced by secret Ministerial Orders. 

The UK equivalent of a Ministerial Order was used by the UK government to secretly order Apple to remove encryption on iCloud globally. Part 2 of Bill C-22 does not contain any guardrails that would prevent that overreach. 

Secret ministerial orders have to go.

Massive Cybersecurity Risks from "Backdoors"

As legions of cybersecurity experts have said, forcing companies to build surveillance capabilities into their networks creates inherent vulnerabilities. Use your favourite search engine to look up “Salt Typhoon” or “Vodafone Greece scandal” to see examples of lawful access capabilities being exploited for widespread illicit wiretapping. 

This makes Canadian infrastructure a massive target for cybercriminals.

Metadata Retention 

The Bill permits the government to require ESPs to retain metadata, which includes your location history. The government will require everyone’s cellphone to become a retrospective tracking device without any suspicion of wrongdoing. This will almost certainly be found to violate the Charter. 

Collected metadata will be sought by Canadian and non-Canadian authorities based on mere suspicion. That’s a record of everyone who sought reproductive health care in Canada, which might be of interest to law enforcement from a Five Eyes partner. 

Part 2’s authorities to access data

The government says that Part 2 does not create any new authorities to access data. That’s simply not true. Take a look at section 20. Persons designated by the Minister can enter any premises without a warrant and without notice, and can examine, copy and remove any information found in that place. They can order anyone in that place to provide any data they ask for. That’s a new authority, and if the premises are an ESP’s offices, that includes access to information about their customers. There are simply no guardrails. 

I look forward to a productive discussion. 

Lawful Access is back: Part 1 is much improved but Part 2 is deeply problematic

The latest attempt at so-called “lawful access” has just dropped in the Parliament of Canada. I have a few things to say about it. It’s better than the government’s last attempt, but take a moment and consider this: 

If Bill C-22, the Lawful Access Act 2026 becomes the law, the government of Canada will be able to secretly order Apple to build in a capability into its infrastructure to allow Canadian law enforcement and national security folks to track every iPhone, every iPad, every Apple watch, every Apple AirPod and every AirTag in real time. 

Then they’ll be able to require Apple to confirm whether they provide you any services. 

Then they can go to a justice of the peace and get an order – without actually believing that a crime has been or will be committed – requiring Apple to hand over EVERY device identifier for every device you use with their services. That’s the digital ID for your iPhone, iPad, Apple watch, Apple AirPod, Apple TV and AirTag. 

With that information, they can go back to the judge and get an order – again without actually believing that a crime has been or will be committed – requiring Apple to give them the moment-by-moment locations of all your devices. 

Oh, and that secret order also required Apple to keep your location history for a full year, so cops can get that too. Is that a power we want Canadian police and law enforcement to have? 

For literal decades, Canadian law enforcement and national security folks – working through both liberal and conservative governments – have tried to give cops and spies easier access to information about Canadians, and to plug directly into our digital infrastructure to get access to data. 

You might be thinking … “Didn’t we just do this?” 

Yes, that’s true. [A summary of the previous attempts at “lawful access”: https://blog.privacylawyer.ca/2025/06/past-canadian-lawful-access-attempts.html.]

In 2005 Liberal PM Paul Martin’s Justice Minister Anne Maclellan introduced Bill C-74, called the “Modernization of Investigative Techniques Act”. It didn’t pass. 

In 2009, Conservative prime minister Stephen Harper’s Minister Peter Van Loan introduced Bill C-47, renamed the “Technical Assistance for Law Enforcement in the 21st Century Act”. It also did not pass. 

A couple of years later, in 2011 Conservative Stephen Harper’s Minister of Public Safety Vic Toews tabled Bill C-52 in Parliament. This attempt was called the “Investigating and Preventing Criminal Electronic Communications Act”. Shocker – It did not pass. 

Apparently a sucker for punishment, Minister Vic Toews then tried another kick at the can the next year with Bill C-30, which was branded as the “Protecting Children from Internet Predators Act”. Yup, you guessed it – this did not pass.

Fast forward to 2025 … The very first substantial bill of the Prime Minister Mark Carney government was tabled by Public Safety Minister Gary Anandasangaree. That was Bill C-2 called the Strong Borders Act. Almost ten years dead, “lawful access” was pulled from its grave, crammed into Parts 14 and 15 of a border bill, only to be thrown back on the trash-heap. It never made it to committee because of the backlash over privacy.

I did a couple of episodes on how problematic Bill C-2 was. (Part 14 and Part 15.) It was universally panned and it was clear that it would not make it through the minority liberal parliament. Not to be deterred – but to his credit — the Minister of Public Safety went back to the drawing board to try to find a way to make it minimally palatable for it to make it through Parliament. Notably, the current parliament is not as “minority” as it was when Bill C-2 was introduced. 

I’m going to go through the Bill to let you know what it contains and what it is supposed to do. I’ll try to highlight the differences between what was attempted earlier in Bill C-2 and the changes they’ve made for Bill C-22, and I’ll also talk about what’s different from the current status quo. 

The bill is in two parts, which parallel Parts 14 and Parts 15 of Bill C-2, the Strong Borders Act. In going back to the drawing board, I think the government has largely fixed the big problems with what was Part 14 related to warrantless information demands and new production order powers. But I think that Part 2 is still a HUGE issue. 

Part 1 is called “timely access to data and information”. 

It contains some amendments to the general search warrant provisions of the criminal code to permit the examination of computer data in conjunction with the execution of a warrant when it's authorized by a judge. The status quo, as I understand it, would require the seizure of the computer, returning to court and then getting further authorization to search it. This creates a bit of a One-Stop shop. Criminal law practitioners may have more to say about this provision. 

The rest of Part 1 largely deals with new information demands and production orders. I should note at the outset that all the new information demands and production orders are equally available to the Canadian Security Intelligence Service as they are to the police. I’m just going to go through each of them once, rather than dealing with the Criminal Code and CSIS Act amendments separately. 

The first significant new power that the bill conveys on law enforcement and CSIS is something called a “confirmation of service demand”. Something similar was in Bill C-2, but this has been significantly scaled back. Essentially the new section 487.0121 will allow any police officer or any public officer to make a demand to a telecommunication service provider requiring them to confirm whether or not they provide or have provided telecommunication services to any subscriber or client. This could be done using the person's name, account identifier, IP address or telephone number. 

Confirmation of service demand

487.‍0121 (1)    A peace officer or public officer may make a demand in Form 5.‍0011 to a telecommunications service provider requiring them to confirm, within the time and in the manner specified in the demand, whether or not they provide or have provided telecommunication services to any subscriber or client, or to any account or identifier, specified in the demand.

The conditions for making the demand are actually quite low, being “reasonable grounds to suspect” that a federal offense has taken place and that the confirmation that is demanded will assist inthe investigation of the offense. 

Conditions for making demand

(2)           The peace officer or public officer may make the demand only if they have reasonable grounds to suspect that

(a)           an offence has been or will be committed under this Act or any other Act of Parliament; and

(b)           the confirmation that is demanded will assist in the investigation of the offence.

The telecommunication service provider simply has to provide a yes or no answer. Do they or do they not provide services to that person or in relation to that identifier. This is MUCH better than what was in Bill C-2. The revised demand can only be presented to a telecommunications service provider. The Bill C-2 version could have been made to anyone who provides services to the public, including a doctor’s office or a law firm. The previous version would have required – without a warrant – producing information about the nature of the services and anybody else that the service provider knew who might also provide services to that person. 

In Bill C-22, this is much more tailored and focused only on telecommunication service providers or TSPs. 

I'm actually surprised that it doesn't include a requirement to confirm the municipality or location where the services are provided, because it's my understanding that a large part of the justification for this in the first place was so that not only would the police be able to determine whether this service provider is the right person to send a production order to, but also who is the local police of jurisdiction. On a daily basis, the RCMP in Ottawa receive international reports related to criminal activity in Canada, such as dissemination of child abuse imagery and that report only includes an IP address or account identifier. That information does not necessarily tell them who is the local police of jurisdiction to refer the file to. I guess the government was so sensitive to the pushback they received on Bill C-2, that they removed what seemed to be pretty innocuous information, which had a compelling justification.

While I think this is much improved, I am still very concerned that any peace officer or public officer who makes a demand is able to impose a non-disclosure condition for up to one year. That is a significant period of time. I would much prefer it if it was something short like 30 days, and the officer could go to court to get it extended. 

Non-disclosure

(6)           The peace officer or public officer who makes the demand may impose conditions in the demand prohibiting the disclosure of its existence or some or all of its contents for a period not greater than one year after the day on which the demand is made. The peace officer or public officer may impose the conditions only if they have reasonable grounds to believe that the disclosure during that period would jeopardize the conduct of the investigation of the offence to which the demand relates.

Not surprisingly, they have included in subsection (12), a provision that says a peace officer public officer can just ask a telecommunications service provider to voluntarily provide the confirmation, and this confirmation can be provided as long as the TSP is not prohibited by law from providing it. Then it goes on to say that the TSP that provides a confirmation in these circumstances does not incur any liability for doing so. The Bill has other, similar Safe Harbors for voluntary disclosure, but related to much more sensitive information.

Request for confirmation

(12)        Despite subsection (1), no demand under that subsection is necessary for a peace officer or public officer to ask a telecommunications service provider to voluntarily provide the confirmation referred to in that subsection if the telecommunications service provider is not prohibited by law from providing it. A telecommunications service provider that provides a confirmation in those circumstances does not incur any criminal or civil liability for doing so.

The main feature in my view of Part 1 is a new “production order for subscriber information”. 

Before we get into it, it's really important to note that the Criminal Code currently provides for something called a general production order by which a cop can go to a judge and if they have reasonable grounds to believe a crime has been committed or will be committed, they can get an order requiring a third party to produce records that are listed in the production order. On a daily basis, police seek and obtain subscriber information using these production orders. What is different here, mainly, is significantly lowering the threshold so that the officer only has to have reasonable grounds to suspect an offense has been committed. They don't even have to have reasonable grounds to believe it has been committed. They don’t even have to believe that a crime has been or will be committed. 

Reasonable grounds to suspect doesn’t mean that they actually have to suspect a crime, it just means they have reasonable grounds that could make someone suspect a crime. This is extremely low. 

So the new section 487.0142 says that on an ex parte application made by a peace officer or a public officer, a justice or judge may order a person who provides services to the public to prepare and produce a document containing all the subscriber information that relates to any information, including transmission data, that is specified in the order and that is in their possession or control when they receive the order.

Production order — subscriber information

487.‍0142 (1)    On ex parte application made by a peace officer or public officer, a justice or judge may order a person who provides services to the public to prepare and produce a document containing all the subscriber information that relates to any information, including transmission data, that is specified in the order and that is in their possession or control when they receive the order.

Unlike the confirmation of service demand, this is not limited to telcos. This can involve anyone who provides services to the public. So this does include doctors offices, hotels, grocery stores and banks. 

You will see that in subsection (2), it says that before making the order the Justice or judge must be satisfied by information on oath that there are reasonable grounds to suspect an offence has been or will be committed under the Criminal Code or any other Act of Parliament and the subscriber information is in the person's possession of control and will assist in the investigation of the offense. 

Conditions for making order

(2)           Before making the order, the justice or judge must be satisfied by information on oath in Form 5.‍004 that there are reasonable grounds to suspect that

(a)           an offence has been or will be committed under this Act or any other Act of Parliament; and

(b)           the subscriber information is in the person’s possession or control and will assist in the investigation of the offence.

You should also note that this is not limited to serious crimes. These powers can be used for any offence under federal law, such as offences under the National Parks Act, like sleeping outside of a campground. 

It is also important to understand what is included in “subscriber information”, and I will note some of the differences from Bill C-2 to Bill C-22. The bill says: 

subscriber information, in relation to any client of a person who provides services to the public or any subscriber to the services of such a person, means

(a)           information that may be used to identify the subscriber or client, including their name, pseudonym, address, telephone number and email address;

(b)           identifiers assigned to the subscriber or client by the person, including account numbers; and

(c)           information relating to the services provided to the subscriber or client, including

(i)            the types of services provided,

(ii)           the period during which the services were provided, and

(iii)         information that identifies the devices, equipment or things used by the subscriber or client in relation to the services.

In Bill C-2, subscriber information included any information provided by the customer to the service provider in order to obtain the services. This could have included banking information and passwords. It could have included medical information. Remember, such an order can be directed to a medical clinic. When you go to a clinic for the first time, you fill out a pretty detailed form related to your medical history, and that would be in the category of “information provided by the customer in order to receive the services”. Thankfully, that has been removed. The definition of subscriber information is much more scaled-back in Bill C-22, but information about the “types of services provided” along with device and equipment identifiers can be sensitive information that goes beyond mere identifying a possible suspect. For many people, their internet service provider is also their cable TV provider. Do those “services” include premium pay-per-view access? Hmm? Scaled back but still a bit too far. 

This new bill also includes quirky “foreign entity information requests”. These are kind of weird because what it amounts to is an application to court to get permission to make a request, which is voluntary, to a foreign entity that provides telecommunications services. 

So what they end up with is a piece of paper asking an entity to voluntarily provide subscriber information. It is not an order requiring the entity to produce the information, but it does have judicial approval in Canada. This is intended to address the question of whether Canadian orders can be enforced outside of Canada, or more accurately avoid that question entirely. It should be applicable where voluntary disclosure can be obtained and where the service provider wants to be sure that there is some third-party judicial approval. It also should mean that whatever information is obtained can be used in a Canadian court, because Canadian police have been authorized by a judge to obtain it. Personally, I think this is a really clever solution for a real issue.

Subsection 4 of this provision says that the production request can be required to include information required by the foreign entity, the foreign state or any magic words that are required by an international agreement or arrangement to which Canada and the foreign state are parties.

Earlier I mentioned the gag orders that can accompany a confirmation of service demand. Part 1 also amends the existing section 487.0191 of the Criminal Code to authorize a judge, on an ex parte application, to issue a gag order related to confirmation of service demands. 

Part 1 of Bill C-22 also affects the scheme for judicial review of production orders generally, not just this new production order for subscriber information. It compresses the timeline during which the recipient of a production order is able to seek judicial review, in order to have it modified or revoked. That deadline will be “within 10 business days after the day on which the order was received”. In Bill C-2, it was way shorter – five days after the order was issued – and actually seemed to be designed to prevent the judicial review of production orders. I have seen production orders served more than five days after they are issued, so it would be too late by the time you received it. Ten business days is still pretty short, but much more reasonable than what was in the Strong Borders Act.

Part 1 of Bill C-22 also tweaks the existing provisions in the Criminal Code related to voluntary disclosure of information from any person to the police or a public officer. It says that documents or information can be provided voluntarily and it also says that no person incurs any criminal or civil liability for doing so. 

For greater certainty

487.‍0195 (1)    For greater certainty, no preservation demand, preservation order, keep account open or active order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving, to voluntarily keep an account open or active that the person is not prohibited by law from keeping open or active or to voluntarily provide a document or information to the officer that the person is not prohibited by law from disclosing.

No civil or criminal liability

(2)           A person who preserves data, keeps an account open or active or provides a document or information in those circumstances does not incur any criminal or civil liability for doing so.

It's kind of extra weird because subsection (1) says “hey you can voluntarily provide it if a law doesn't prohibit you from voluntarily providing it”. Then subsection (2) says if you provide it, you will have no criminal or civil liability. If no law prevented them from providing it, why do they need immunity from criminal or civil liability? 

This actually does NOT fix the issue that arose in the Supreme Court of Canada case of R v. Bycovets. In that case, a payment service processor voluntarily provided IP address information related to suspected fraudulent transactions, and the Supreme Court of Canada said that the police were not able to use that information or even obtain it without a production order. This does nothing to address that issue. The Bykovets issue is still there. 

We then have a new subsection (3) that says: 

For greater certainty, no production order or warrant, or confirmation of service demand made under section 487.‍0121, is necessary for a peace officer or public officer to receive any information from a person or a telecommunications service provider, as the case may be, who is lawfully in possession of it, and to act on the information, if the person, without being asked for it, provides it voluntarily or is required by law, including a law of a foreign state, to provide it.

There’s also a new subsection (4), which says:

For greater certainty, no production order or warrant, or confirmation of service demand made under section 487.‍0121, is necessary for a peace officer or public officer to receive, obtain and act on any information that is available to the public.

This seems pretty similar to what was included in Bill C-2, and received a lot of criticism. A number of smart folks were very concerned that hacked information and data leaks are included in what would be considered information that is available to the public. Should the police have the ability to exploit data that became public unlawfully? But here they can use it willy-nilly. I share this concern. 

Bill C-22 also amends the current provision in the Criminal Code related to what are called “exigent circumstances”. Police can search and demand a whole range of data without a warrant or a court order if the conditions for obtaining an order exist, but by reason of exigent circumstances it would be impracticable to obtain an order. It is not all that new, but just extends the authorities to include the new production order powers. 

487.‍11 A peace officer or public officer may, in the course of their duties,

(a)           exercise any of the powers described in section 487 [search warrants], 492.‍1 [tracking warrants] or 492.‍2 [transmission data recorder] without a warrant if the conditions for obtaining a warrant exist but by reason of exigent circumstances it would be impracticable to obtain a warrant; or

(b)           seize any subscriber information that may be the subject of an order made under subsection 487.‍0142(1) [subscriber information] or any data that may be the subject of an order made under subsection 487.‍016(1) [transmission data] or 487.‍017(1) [tracking data] if the conditions for obtaining an order exist but by reason of exigent circumstances it would be impracticable to obtain an order.

We will see that tracking things and tracking people is a theme of this bill. Bill C-22 adds a new subsection to section 492.1 related to tracking orders. These are orders that are obtained from a judge authorizing a police officer or a public officer to obtain tracking data related to a person or a thing. Subsection (2.1) is being added to permit an authorization to track other things that might be associated with a person where that thing might not have been known to the officer at the time.

Tracking similar things

(2.‍1)       A justice or judge who authorizes a peace officer or public officer to obtain tracking data that relates to the location of a thing that a person uses, carries or wears may, in the warrant, authorize the peace officer or public officer to obtain tracking data that relates to the location of any similar thing that is unknown at the time the warrant is issued if the justice or judge is satisfied that there are reasonable grounds to suspect that the person will use, carry or wear that similar thing.

Scope of warrant

(3)           The warrant authorizes the peace officer or public officer, or a person acting under their direction, to install, activate, use, maintain, monitor and remove the tracking device, including covertly. The warrant also authorizes a person acting under the direction of the peace officer or public officer to obtain the tracking data that is authorized to be obtained under the warrant.

I can imagine this would include getting an order to track somebody's vehicle, and to add on authority to track their phone and maybe their smartwatch. Subsection (3) is also amended to say that an officer can authorize somebody else to obtain the tracking data authorized to be obtained under the warrant. 

Parallel amendments are made to the similar Criminal Code provisions related to transmission data warrants.

So that's largely what is in Part 1 of the new Lawful Access Act, 2026. As you can see, while there are some things to quibble over, it is a significant improvement from what was in Part 14 of the Strong Borders Act. 

Now we are going to look at Part 2, which I think is and remains a huge problem. The outcry associated with the Strong Borders Act was principally focused on warrantless information demands and overbroad subscriber information orders. In a lot of the debate and discussion, Part 15 of that Bill was largely ignored. I really hope that the equivalent of that Part in Bill C-22 gets as much attention as it deserves. 

In a nutshell, Part 2 will require a huge range of service providers – well beyond traditional telecommunications service providers – to build in real-time interception and monitoring capabilities so that cops and national security folks can just plug into the systems to access data when “authorized” to do so. 

Currently the cops can go to a judge and get a wiretap order to intercept the communications of a suspect in real time. They can go to a judge to get an order for just about any data that currently exists. 

What the cops are generally complaining about is that there isn’t a consistent interface for them to plug into and get the data among all the telcos out there. I can see that kind of sucks. 

But what they’re not emphasizing is that Part 2 of Bill C-22 will likely require telcos, AND cloud providers, AND social media companies, AND ai chatbots, AND VPN services, AND chat services and the like to build in not only the capability for Canadian police to plug directly in, but Part 2 will also require them to build in additional surveillance tools and collection capabilities that go well beyond what data the company actually needs to provide you with services. 

I lived in Romania just after the fall of the Iron Curtain. It was purported that the state security police had the capability to turn any landline telephone into a room bug with the flip of a remote switch. Part 2 of Bill C-22 could permit a secret order directed at telcos to create this capability. The Minister of Public Safety could order Samsung to turn your smart fridge into a listening device. The same with your Smart TV or Smart speakers. I find that worrisome.

So let’s talk about specifically what is in Part 2 of Bill C-22. 

Part 2 creates a new standalone statute called the Supporting Authorized Access to Information Act or SAAIA. Section 3 sets out its purpose: 

3             The purpose of this Act is to ensure that electronic service providers can facilitate the exercise of authorities to access information that are conferred on authorized persons.

So it talks about authorities that are conferred on authorized persons to access information. It doesn't say “lawful authorities”, nor does it say “judicially authorized authorities”. It just says authorities. From the discussion about Part 1, it’s clear that the police and CSIS are authorized to obtain data without a warrant by just asking for it.

The Supporting Authorized Access to Information Act has “electronic service providers” in its crosshairs. It is therefore really important to understand what an electronic service provider is. ESP is defined in the bill, as is an electronic service. 

electronic service provider means a person that, individually or as part of a group, provides an electronic service, including for the purpose of enabling communications, and that

(a)           provides the service to persons in Canada; or

(b)           carries on all or part of its business activities in Canada.‍ 

You will note that it says it provides an electronic service, “including for the purpose of enabling communications”. The use of the word “including” clearly signals that it is not limited to those providers who are strictly engaged in communications. It goes broader than that. We can see from the very broad definition of electronic service: 

electronic service means a service, or a feature of a service, that involves the creation, recording, storage, processing, transmission, reception, emission or making available of information in electronic, digital or any other intangible form by an electronic, digital, magnetic, optical, biometric, acoustic or other technological means, or a combination of any such means.‍ 

Hey, I am in the business of creating information in digital form. What is a YouTube video, or podcast? Or emails to my clients. My law firm is in the business of creating information in digital form. The Canadian Broadcasting Corporation, the Globe and Mail and the Canadian Press are in the business of creating information in digital form. I am not sure that any business exists in Canada that is not some way or somehow creating, processing or storing digital information. This is dramatically broad. In conversations I have had with people from Public Safety, it is clearly their intent to cover traditional telcos, internet service providers and ALSO cloud computing providers, social media providers and online game services. Again, this is dramatically broad. 

The Bill is going to deal with two broad categories of electronic service providers. The first is something called a “core provider”, and there will be subcategories of core providers. The second group is the rest of the universe that could fit into the category or definition of “electronic service provider”. 

The categories of core providers are to listed in the schedule to the Act, which is currently blank, not surprisingly. So these core providers are going to be subject to a number of obligations that will be set out in the regulations. Subsection (2) describes these obligations, but note the use of the word “including” which means that the regulations and the obligations can go well beyond what is listed in subsections (a) through (d).

(a)           the development, implementation, assessment, testing and maintenance of operational and technical capabilities, including capabilities related to extracting and organizing information that is authorized to be accessed and to providing access to such information to authorized persons;

This is essentially a requirement to build in the operational and technical capabilities to enable access to information on the core provider’s infrastructure or within their systems.

(b)           the installation, use, operation, management, assessment, testing and maintenance of any device, equipment or other thing that may enable an authorized person to access information;

This can require core providers to install particular devices or equipment on their infrastructure.

(c)           notices to be given to the Minister or other persons, including with respect to any capability referred to in paragraph (a) and any device, equipment or other thing referred to in paragraph (b); and

It’s not yet clear what these notices are all about ….

(d)           the retention of categories of metadata — including transmission data, as defined in section 487.‍011 of the Criminal Code — for reasonable periods of time not exceeding one year.

The requirement to retain metadata was NOT in Bill C-2, the Strong Borders Act. This is very concerning. There are some small protections about this, in subsection (4). That says:

(4)           Paragraph (2)‍(d) does not authorize the making of regulations that require core providers to retain information that would reveal

(a)           the content — that is to say the substance, meaning or purpose — of information transmitted in the course of an electronic service;

(b)           a person’s web browsing history; or

(c)           a person’s social media activities.

Ok. That’s some protection. But it does not put location information out of scope, which is concerning. The government clearly wants all cellphones to be trackable, and under this authority they can be required to save your detailed location history for a full year.

Subsection (3) lists a number of factors that the government must take into account in creating and drafting the regulations which place the specific obligations on the core providers. These include …

(a)           the benefits of the regulation to the administration of justice, in particular to investigations under the Criminal Code, and to the exercise of powers and the performance of duties and functions under the Canadian Security Intelligence Service Act;

(b)           the feasibility of compliance with the regulation for the core providers;

(c)           the costs to be incurred by the core providers to ensure compliance with the regulation;

(d)           the potential impact of the regulation on the persons to whom the core providers provide services;

(e)           the potential impact of the regulation on privacy protection and cybersecurity; and

(f)            any other factor that the Governor in Council considers relevant.

I am glad that they have included the potential impact on privacy and cybersecurity. I would like it if it required the government to release their analysis of all these considerations along with the regulatory impact analysis statement that will accompany the regulations when they are first published. 

The only good news when dealing with core providers is that these requirements will be in a regulation that will be public. We will be able to understand, at least in general terms, what obligations are being imposed on these core providers.

There is another bit of small comfort in subsection (5) which says 

(5)           A core provider is not required to comply with a provision of a regulation made under subsection (2), with respect to an electronic service, if compliance with that provision would require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability.

Of course, this turns on what is a “systemic vulnerability”, which is defined in the bill: 

systemic vulnerability means a vulnerability in the electronic protections of an electronic service that creates a substantial risk that secure information could be accessed by a person who does not have any right or authority to do so.‍ 

electronic protection means authentication, encryption and any other prescribed type of data protection.‍ 

Note that it is limited to systemic vulnerabilities in “services”. It does not include devices or processes. Just the services themselves. Professor Robert Diab has pointed out that there’s enough wiggle room in this for the Minister to say that an operating system, such as Windows or iOS is not a “service”. Firmware is a part of the device, so please root them all. (The use of the word “please” is only because we’re Canadian … it would actually be an order.)

Also, what this does NOT say is that the government is prohibited from requiring an ESP to circumvent or undermine encryption. We have been told by the government that they would never do that, but they do not seem willing to put it in the law.

The second significant power contained in the Supporting Authorized Access to Information Act are ministerial orders, set out in Section 7. Essentially, the minister of Public Safety can issue secret orders directed at any one or more electronic service providers to implement measures that could have been contained in a regulation for a core provider, but these are secret and would be limited to a defined time period. Of course this time can be extended at the discretion of the minister. These orders can also be directed at ESPs that are already core providers. Bonus requirements! 

The only real protection introduced since the Strong Borders Act is in subsection (2), which says that these secret orders must be approved by the Commissioner designated under the Intelligence Commissioner Act. I think this is a real protection, principally because the intelligence commissioner has to be a former Superior Court judge who would have spent a career dealing with criminal law matters and Charter rights. He is currently entrusted with approving certain National Security orders as a form of semi-judicial oversight. This is, in my view, real progress. 

Subsection (3) of Section 7 sets out the sorts of considerations that the Minister has to take into account before issuing a secret ministerial order. This parallels the considerations that the government would have to take into account in issuing regulations affecting core providers. 

And subsection (5) has a parallel provision saying that 

(5)           The electronic service provider is not required to comply with a provision of the order, with respect to an electronic service, if compliance with that provision would require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability.

Section 14 creates an obligation for all electronic service providers to assist a range of people to do a range of things on the Minister’s request. Remember, while we review this, that my law firm, your doctor’s office and Apple are all “electronic service providers”. It reads:

14 (1)   On request made by the Minister, an electronic service provider must provide all reasonable assistance to a person or class of persons specified in the request to permit the assessment or testing of any device, equipment or other thing that may enable an authorized person to access information.

Persons to be assisted

(2)           Only the following persons or classes of persons may receive assistance:

(a)           the Minister;

(b)           an employee of the Canadian Security Intelligence Service;

(c)           a person appointed or employed under Part I of the Royal Canadian Mounted Police Act or a civilian employee referred to in section 10 of that Act;

(d)           a civilian employee of another police force;

(e)           a peace officer, as defined in section 2 of the Criminal Code.

There is some protection in subsection (4) so that “the assessment or testing must not have the effect of granting access to personal information.”

One of the huge problems I have with these Ministerial Orders is the mandatory secrecy that surrounds them. Without exception, under section 15, an ESP is prohibited by law from revealing that they are subject to an order, the substance or contents of an order, any dialogue they’ve had with the Minister in connection with any order. 

This is draconian, overbroad and frankly offensive. There’s no requirement that the Minister be satisfied that disclosure of this information would be harmful to law enforcement or to national security. There is no sunset and no means by which an ESP can challenge the gag order if  they think it’s in the public interest to disclose the information. I am not sure that this provision, on its own, would survive a Charter challenge. It also means that a foreign company can’t advise their own government that they are subject to an order. 

I can’t help but think of the fact that under the UK equivalent of this law, Apple was issued with a secret order to circumvent or turn off encryption on iCloud. Apple couldn’t tell anyone, yet it somehow leaked. The United States government was of the view that this was contrary to an agreement between the UK and the US, but Apple was prohibited by UK law from letting their own government know what shenanigans the US’ own ally was engaging in. 

The bill does anticipate at section 17 that ESPs may seek judicial review of a Minister’s order, but the cards are again stacked in favour of secrecy, and conducting its business outside of public scrutiny.

Section 18 allows the government to make a range of regulations related to confidentiality and security. These are scaled back from the absurd scope anticipated in the Strong Borders Act. There are security and confidentiality rules for judicial proceedings provided for in subsection (b). Subsections (c) and (d) authorize regulations related to ESP employees and contractors involved with law enforcement and national security access to information, including security clearances and where they are located, and where facilities are located. As I understand it, most American service providers run this function from the US and I’m sure they will not be interested in moving that to Canada or having their employees subject to Canadian security clearances. I would imagine that some companies will just decide to not do business in Canada. 

Part 2 also contains a whole regulatory oversight structure, with inspections, audits and penalties. I’m not going to get into that today. 

Throughout this discussion, I can’t help but be reminded that the US has had something similar in their laws for some time, and the mandated intercept capabilities were used by Chinese hackers to get access to data. 

The "Salt Typhoon" hacking incident, attributed to a Chinese state-sponsored advanced persistent threat (APT) actor, came to light in late 2024 with revelations that the group had extensively compromised the computer systems of multiple major US telecommunications companies. The stolen information included call and text message metadata, and in some high-profile instances, even audio recordings of phone calls belonging to government officials and political figures. 

A critical factor facilitating the Salt Typhoon incident was the very infrastructure put in place to comply with the Communications Assistance for Law Enforcement Act (CALEA). Enacted in 1994, CALEA mandates that telecommunications providers build "lawful intercept" capabilities into their networks to allow law enforcement and intelligence agencies to conduct court-authorized wiretaps. While intended for legitimate surveillance, these mandated "backdoors" created inherent vulnerabilities within the telecom networks. Salt Typhoon exploited these CALEA-mandated systems, effectively turning the tools designed for lawful access into pathways for unauthorized espionage. 

This is what’s coming to Canada … 

So let’s bring this down to earth and make it more concrete. At a technical briefing this week, the government offered only two examples for why they think we need the Supporting Authorized Access to Information Act: 

CSIS cannot track a cellphone

CSIS is trying to determine the movements of a terrorist group and has received a warrant to track a person of interest’s cellphone. The electronic service provider did not have the necessary capabilities to track the device because they are not required to. As a result, CSIS had to resort to costly and risky in-person surveillance. 

With C-22: The GIC will have the authority to make regulations requiring that ESPs develop and maintain location tracking capabilities that are standard in Europe and among the Five Eyes.

First of all, I don’t really care what they are doing in the other Five Eyes. Essentially, the UK, Australia and New Zealand don’t have a Charter of Rights and Freedoms and their surveillance laws reflect that. And the law doesn’t we’ll just do what they do in “Europe and among the Five Eyes.” I bet the Chinese security services have this capability. 

Let’s take a moment to ponder this scenario and what it means. CSIS wants to be able to track any cellphone in real-time, with a warrant. That means that they want every cellphone in Canada to be a tracking device. And they want historical metadata – which includes location data – retained for one year.

The second example is equally sympathetic, but shows that the government wants everyone to be carrying a tracking device:

Police cannot consistently obtain location information 

An at-risk 16-year-old girl was reported missing. She had already been missing for 10 days when she made an emergency call. The telecommunications provider was able to confirm the call and the tower used to make the call but could not provide the last known location of the phone before it was disconnected since they are not required to have that capability. 

With C-22: Core providers would be required to maintain accurate and consistent localization capabilities across the country.

That device in your pocket will be a tracking device. And the law doesn’t say that this data can only be accessed if you’re a suspected terrorist or a missing teenaged girl. It can be tracked by ANY police agency in Canada with an order issued merely on “reasonable grounds to suspect.” Judicial authorization isn’t even required in a whole bunch of cases: There are dozens of laws that permit regulators and others to access this data without judicial authorization. 

“If you build it, they will come.” And the government wants ESPs to build the surveillance infrastructure for them, to which the police and others will almost certainly come. And this is even without considering that the backdoors will be a HUGE target for cybercriminals and threat actors. 

I don’t think that the government has come close to making any sort of compelling case for Part 2 of Bill C-22, and certainly not one that convinces me that the public safety interest in building all of this surveillance infrastructure outweighs the privacy and cybersecurity risk of doing so. 

We should also be looking at this through the lens of what we have now. If the police or CSIS get a production order, a wiretap order or a tracking order, they can also ask the judge to issue an “assistance order”. This is an order, directed at the service provider, ordering them to give all reasonable assistance, reasonably required to give effect to the production order, wiretap order or tracking order. On every occasion when I have brought this up with “lawful access” supporters, nobody has been able to point me to any problems with this. Assistance orders are like one-off ministerial orders that are appropriately tailored to the case and circumstances, and are signed off by a judge. And they’re subject to judicial review. I’m not sure the current system is broken. It just doesn’t give the police friction-free access to the universe of data that they want collected on their behalf. 

I expect I’ll probably have more to say about this as Bill C-22 works its way through Parliament. I will reiterate that I’m glad the government largely went back to the drawing board and largely fixed Part 1. Part 2 is better than it was before, but I don’t think it should be passed in its current form. It is wildly problematic.