Ottawa Repackages Its Surveillance Backdoor in Bill C-22

Bill C-22 lays the groundwork for a Canadian surveillance state.

March 12, 2026 — Today the federal government introduced Bill C-22, the Lawful Access Act, its third attempt in under a year to pass sweeping surveillance powers into law. The most dangerous provision from last year's widely condemned Bill C-2 is back — unchanged.

Bill C-22's Part 2 — the Supporting Authorized Access to Information Act — is in no way reformed since Bill C-2. Under Part 2, the Minister of Public Safety can secretly order any messaging app, cloud service, email provider, or platform with Canadian users to engineer law enforcement access capabilities directly into their infrastructure. The orders cover the entire Canadian digital ecosystem — not just telecoms. Companies that receive them cannot tell their users, cannot publicly confirm the orders exist, and face no independent judicial check before they are required to comply. There is no public registry of which platforms have been ordered to build what. Canadians have no right to know it is happening at all.

The security risk compounds the privacy one. Once a surveillance capability is engineered into a platform's infrastructure, it doesn't exist only for Canadian law enforcement — it becomes a permanent architectural feature that foreign intelligence services and criminal hackers can seek to exploit. This is not hypothetical: the UK government issued a similar secret order to Apple in 2025 demanding global access to encrypted iCloud data. During the very public debate that followed, Apple temporarily withdrew its strongest encryption feature from the UK rather than comply, and security experts worldwide warned that any capability built for one government's access cannot be contained to that government alone. 

Nominally, companies cannot be ordered to introduce systemic vulnerabilities that compromise user security. But the prohibition has an intentional hole: the government can redefine what counts as a "systemic vulnerability" by regulation, with no parliamentary vote required. Future governments can quietly adjust that definition to permit surveillance capabilities they aren’t mandating today — with no debate, no public process, no further review.

"Our government has not done the work to make Bill C-22 safe for Canadians," said OpenMedia Executive Director Matt Hatfield. "The biggest privacy problem in Bill C-2 has been carried forward intact. Part 2 of C-22 enables secret ministerial orders to any digital service Canadians rely on, with no public registry, no parliamentary approval, and no right for Canadians to even know it's happening. That's not lawful access — that's the architecture of a surveillance state, and it has to go."

Part 1 of C-22 does make real improvements over C-2. Warrantless demands from law enforcement are now limited to telecom companies, and what can be demanded without judicial approval has been narrowed to confirmation that an account exists. These are meaningful changes that reduce the risk of abuse.

"The changes to Part 1 are real — we'll take them," continued Hatfield. "But they don't touch the part of this bill that should alarm every Canadian. Part 2 needs a complete overhaul, and Part 1 still needs work, before Bill C-22 can be compatible with Canadian rights."

These powers were first introduced buried inside Bill C-2 alongside changes to Canada's immigration laws in June 2025. Over 300 civil society organizations — including OpenMedia, the CCLA, and CIPPIC — demanded withdrawal. The government shelved C-2 in October 2025 and has now reintroduced the lawful access provisions as a standalone bill.

Beyond the secret infrastructure mandate, Bill C-22 also:  

• Allows police to demand confirmation that you have an account with any telecom company without a warrant, with no right to be notified or challenge the demand;
• Enables production of your full subscriber record — name, address, device identifiers, account history — on the lowest standard in criminal law, “reasonable grounds to suspect”; 
• Opens a pathway for foreign governments, including US law enforcement, to access the data of people in Canada;
• Never requires any service provider to tell you your records were accessed.

More than 10,000 OpenMedia community members demanded our government drop Bill C-2. OpenMedia is calling on Parliament to strip Part 2 from Bill C-22 entirely and make foundational changes to Part 1 before the bill advances to committee.

About OpenMedia

OpenMedia works to keep the Internet open, affordable, and surveillance-free. We create community-driven campaigns to engage, educate, and empower people to safeguard the Internet.

Contact

Matt Hatfield | Phone: +1 (888) 441-2640 ext. 0  | [email protected]