When MPs returned to Ottawa after the summer break, they were immediately confronted with Bill C-2, a massive piece of legislation presented as a border security package.
Buried within its hundreds of provisions, however, are lawful access rules that would permit police to obtain personal information without a warrant.
Privacy experts have warned that attaching these surveillance measures to a broad omnibus bill that also covers issues like cash transactions risks burying debate on fundamental rights.
Many argue that if the government insists on pursuing such powers, they should appear in a standalone proposal rather than hidden inside a bill that spans so many unrelated topics.
The opening day of debate illustrated how easily privacy concerns are overshadowed.
References to the widespread problems with fentanyl and border enforcement dominated, while personal data protections were barely mentioned.
Opposition parties have voiced resistance: the Conservatives and NDP are firmly against the legislation, though the Bloc Québécois signaled interest in supporting the government because of its border provisions. In a minority Parliament, Bloc support could give the Liberals the votes they need.
During the debate, Liberal MP Julie Dzerowicz attempted to justify the warrantless access sections.
“Some have argued that the lawful access regime being proposed is a major attack on privacy rights. I would argue that it is not,” she said.
“For the vast majority of information requests, a judicial warrant is required. There are a couple of exceptions to that, but they are ones that I believe all sides of the House can support.”
She argued that most requests would still require judicial authorization and that the exceptions were carefully defined.
“Bill C-2 clarifies the ability of law enforcement to use specific powers and seize specific information without a warrant in urgent, time-sensitive circumstances,” she added.
According to her, warrantless powers would apply only in urgent cases such, or in the early stages of an investigation when police need what she described as “basic information” that often amounts to yes-or-no answers.
The problem is that what the bill actually permits is far more expansive.
Police would be allowed to demand confirmation of whether an account, client, or identifier is tied to a service, and obtain details about when and where that service was used.
They could also request transmission data showing which apps were involved or who someone was communicating with. While they could not access message content without a warrant, the metadata available under these rules can reveal sensitive patterns of behavior, social connections, and physical movements.
Another issue lies in the low threshold required to invoke these powers. Officers need only “reasonable grounds to suspect” a violation of any federal law, not just the Criminal Code. That standard opens the door to demands in situations far removed from serious criminal investigations.
The scope of potential targets is also vast. The bill allows demands to be issued to “any person who provides services to the public.”
That could mean internet and telecom companies, but it might also include doctors, hospitals, universities, financial institutions, and more.
Service providers would be legally obliged to confirm whether they had dealings with a given individual, when those services were provided, and who else might have been involved.
Adding to the risk, Bill C-2 introduces a “voluntary disclosure” option. This allows organizations to hand over subscriber information without either a warrant or a formal demand, while granting them complete legal immunity if they do. Such a framework incentivizes cooperation with law enforcement at the expense of accountability, leaving individuals unaware that their data has been shared.
