Canada Bill C-22 (Lawful Access Act)
What it does
Bill C-22 would require telecoms, internet companies, and other digital providers to build interception and monitoring capability for police and CSIS, with the Minister of Public Safety able to demand technical changes, which reaches encryption. Providers would retain metadata, the record of who contacted whom, when, and from where, for up to a year, and the bill expands information sharing with foreign governments. It revives Parts 14 and 15 of 2025's Strong Borders Act, pulled after public backlash while the border provisions went ahead separately as C-12; some demands are narrower than the C-2 versions, and the capability orders and retention carry forward. The Commons has passed it; the Senate has not, and Senator Wyden wrote to the US State and Justice Departments on July 16 warning that Ottawa could secretly order American companies to weaken their own security with Americans in the crosshairs.
Why it matters
This is the UK Investigatory Powers Act pattern arriving in Canada: capability mandates, secret ministerial demands, and metadata retention across an entire population. A capability built for Canadian orders exists for every future order, and Wyden's letter spells out the cross-border stakes: a US platform engineered to satisfy Ottawa is engineered, full stop.
Our take
Canada watched the UK send one secret letter and drive encrypted backups out of the country, then drafted the same power for itself. The Senate is the last check, and the capability mandate is the clause to watch: once the machinery is required to exist, the arguments about safeguards are about who flips the switch.
Timeline
- March 12, 2026First reading (Commons)
- April 20, 2026Second reading (Commons)
- June 18, 2026First reading (Senate)
- June 18, 2026Passed the Commons
- July 16, 2026Senator Wyden warned Washington that C-22 could conscript US companies against Americans
Related bills
Our coverage: all surveillance stories · Status checked July 20, 2026