Privacy Commissioner Proposes Amendments to Lawful Access Act Bill C-22

Canada’s Privacy Commissioner, Philippe Dufresne, has formally proposed several amendments to Bill C-22, the controversial Lawful Access Act. The legislation, which grants law enforcement and national security agencies like CSIS expanded powers to monitor and collect personal data, is currently before the Senate.

For tech operators, one critical recommendation involves mandating that electronic service providers (ESPs) must trigger a preemptive, arm’s length assessment before complying with any access order. This mechanism would require companies to formally evaluate how an order impacts their operations prior to disclosure, adding a layer of procedural constraint to the process.

Furthermore, Dufresne advocated for integrating core legal principles, proportionality and necessity, into the Act. He noted that currently, there is no overarching requirement ensuring that all obligations imposed under Bill C-22 are both necessary and proportionate to the stated goal. This shift would significantly alter the legal threshold required for state data collection.

The pushback against Bill C-22 has been strong from civil liberties groups and parts of Canada's tech ecosystem, with some companies threatening to halt operations if the bill becomes law. The Commissioner’s proposals represent a formal attempt to balance increased security powers with fundamental privacy protections.