Politics · Canada · 1 hr ago
Privacy commissioner and cryptographers urge changes to Canada's Bill C-22
Canada's Senate has begun reviewing Bill C-22, a proposed law that would expand police and intelligence agencies' access to digital information.
The bill passed the House of Commons in June and was introduced by the Liberal government.
It would lower the threshold for obtaining basic subscriber details and require electronic service providers to build capabilities for responding to lawful surveillance requests.
Privacy Commissioner Philippe Dufresne says the bill's definitions and rules could expose sensitive information, and he wants further safeguards.
Cryptographers warn the required system changes could weaken security, leaving services more vulnerable to hackers and potentially encouraging Canadians to use foreign technology.
The government says the bill would give authorities tools they need, and it amended the proposal after criticism, including clarifying that companies without an encryption key would not have to decrypt information.
Senators are now examining the bill, with Public Safety Minister Gary Anandasangaree and Justice Minister Sean Fraser due to answer questions.
Bill C-22, Canada’s lawful-access bill, is under Senate committee review after passing the House in June.
Privacy Commissioner Philippe Dufresne says further amendments are needed to protect Canadians’ privacy.
Cryptographers warn the bill could weaken security and encourage Canadians to use technology services outside Canada.
The bill would require electronic service providers to build surveillance and monitoring capabilities into their systems.
The government says lawful-access tools are needed by police and intelligence agencies, while amendments have been made in response to criticism.
- Who
- Privacy Commissioner Philippe Dufresne and four cryptography and privacy authorities are urging changes. The bill was introduced by the Liberal government.
- What
- They warn that Bill C-22 could intrude on privacy and weaken the security of digital systems.
- When
- The Senate committee began its review in November 2026. The bill passed the House in June.
- Where
- Canada; the Senate’s national security committee is reviewing the bill.
- Why
- Dufresne says changes are needed to better protect privacy. Cryptographers warn the bill could create security risks and encourage people to use foreign technology services.
Privacy commissioner and cryptographers
Liberal government
Aspect
Privacy commissioner and cryptographers
The bill’s risks
Liberal government
The bill’s purpose
Privacy
Privacy commissioner and cryptographers
Dufresne says the definition of subscriber information and who can be asked to provide it are too broad.
Liberal government
The government says law enforcement and intelligence agencies need tools to do their work.
Security
Privacy commissioner and cryptographers
Cryptographers warn that required surveillance capabilities could weaken systems and create openings for attackers.
Liberal government
The government has amended the bill in response to criticism, including clarifying that providers without an encryption key would not have to decrypt information.
Public Safety Minister Gary Anandasangaree introduced amendments to Bill C-22, and the bill passed the House.
The Senate national security committee began its review of Bill C-22.
Philippe Dufresne testified to the Senate committee, calling for further amendments.
- Bill
- C-22
- House passage
- June 2026
- Committee
- Senate national security committee
- Privacy commissioner
- Philippe Dufresne
- Public Safety Minister
- Gary Anandasangaree
- Proposed threshold
- From “reasonable grounds to believe” to “reasonable grounds to suspect
3 sources
What people are saying
Extra amendments, I believe, are still necessary to better protect the privacy of Canadians while continuing to provide to state authorities the tools needed to carry out their important work
Encryption protects almost 100 per cent of the web traffic on the Internet today, and for good reason: It is the strongest tool we have to secure people’s information
If local protocols are broken, users in Canada can decide to use open-source models or use services that are hosted in other countries where the Canadian law can’t require broken encryption.