Bill C-22 (Lawful Access Act) passes House, moves to Senate, expanding surveillance powers

What happened

Canada’s Bill C-22, also known as the Lawful Access Act, has cleared the House of Commons and is now before the Senate. The bill would allow the Minister of Public Safety to compel digital services to create backdoors for law enforcement and require retention of metadata for up to a year. Critics say it threatens encryption, privacy and could enable cross‑border data sharing with the United States.

Why it matters for trust and compliance

• Its status is passed one chamber. It is not law yet. Track it, but do not treat it as an obligation.
• The bill could dramatically broaden government surveillance and weaken encryption for millions of Canadians.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Revisit retention schedules and data minimisation for the data involved.
3. Review the transfer mechanisms relied on for affected data flows.
4. Map the security requirements to existing controls and close gaps.