Key takeaways
- Last week the Senate debated Bill C-22, the Lawful Access Act, and Senator Denise Batters told the chamber that government officials briefed her that the first regulations would take 18 months to two years after Royal Assent, with the remainder possibly five years. The officials, she added, did not know for sure.
- Part 1 (new police powers, including the confirmation-of-service demand and subscriber-information production orders) takes effect 180 days after Royal Assent. Part 2, the Supporting Authorized Access to Information Act with its capability, device, and metadata-retention obligations, only comes into force by Cabinet order, after regulations that define who counts as a “core provider” and what they must retain.
- Section 7 of the SAAIA lets the Minister of Public Safety impose those same obligations on any electronic service provider by order before regulations exist, subject to Intelligence Commissioner approval, while section 15 bars the provider from disclosing the order’s existence or contents. The obligations can arrive by secret order years before the public rulebook defines them.
Two timelines, one problem
Bill C-22 is built like two bills in one. Part 1 amends the Criminal Code: a confirmation-of-service demand, a subscriber-information production order, and updated computer-warrant rules. It takes effect on the 180th day after Royal Assent, regulations or not. Part 2 enacts the Supporting Authorized Access to Information Act, the SAAIA, and only comes into force on a day Cabinet picks.
Michael Geist flagged the gap last week: officials told Senator Batters the regulations giving the SAAIA its substance would take 18 months to two years for the first phase, and possibly five years for the rest. So the Senate is being asked to approve capability mandates, device-installation powers, and metadata-retention rules without knowing which providers they cover, what providers must build, what metadata gets retained, or what it costs. It is a familiar pattern on digital bills, except here the punt comes with a side door.
| Part 1: Timely Access | Part 2: SAAIA | |
|---|---|---|
| What it does | Criminal Code powers: service-confirmation demand, subscriber-info production orders | Capability, device, and metadata-retention obligations for providers |
| Who it binds | Providers served with demands or orders | ”Core providers” (classes set by future regulation) plus anyone the Minister orders under section 7 |
| Takes effect | 180 days after Royal Assent, no regulations needed | Day fixed by Cabinet order, after regulations |
| Still unknown | Forms, review timelines | Almost everything: provider classes, capabilities, metadata categories, costs, fees, penalties |
The order power, read fairly
Section 7(1) is the sentence to read twice. It lets the Minister make an order “with respect to an electronic service provider” containing any provision that could appear in a regulation under section 5(2), “whether or not the provider is a core provider.” Before any regulation names the core providers, the Minister can impose the same obligations on any individual company. Section 13 makes the order prevail over an inconsistent regulation. Section 15 bars the provider from disclosing the order’s contents, its existence, or the fact that it is subject to one, except as the Act permits.
The honest counterweight matters too. The order needs the Intelligence Commissioner’s written approval, and the Minister must give the provider a chance to make representations first. There is a temporary exemption process, discretionary compensation for costs, and a systemic-vulnerability safeguard: no provider must comply with a provision that would force it to introduce a systemic vulnerability or stop it from fixing one. Metadata retention is capped at one year, and content, web browsing history, and social media activity are expressly excluded.
Still, the procedural wrapping is thin where it counts. The Statutory Instruments Act does not apply, so no automatic publication in the Canada Gazette. The mandatory parliamentary review waits until the third year after all provisions are in force, so if Cabinet holds Part 2 back until regulations are ready, that review may not happen until seven or eight years after Royal Assent.
What the community is flagging
Practitioners on Reddit are reading the same text and landing in the same place. The dominant sentiment: the bill pairs the two features people trust least, unchecked executive discretion and secrecy. Australia’s 2018 Assistance and Access Act keeps coming up as the precedent, with commenters noting it was applied more broadly than promised. The one technical objection that keeps returning: any mandated capability to assist access is a backdoor in practice, whatever the statute calls it.
The business signal is not abstract. Geist notes companies continue to warn they may exit Canada if the bill passes in its current form, and practitioners on Reddit report exit chatter with VPN services singled out over retention costs, though no company has named itself. A one-year metadata retention mandate is a storage, security, and breach-notification cost that somebody pays, and the bill leaves fees and compensation to future regulation.
What to do while the page is still blank
Waiting for the regulations is the wrong posture. The order power exists to fill the gap before regulations do.
- Scope yourself honestly. “Electronic service provider” covers anyone providing services to persons in Canada or carrying on business here. Assume you could be ordered, not just designated a core provider.
- Inventory your transmission data. Map what metadata you hold, how long you keep it, and what a one-year retention mandate would cost. Note the exclusions (content, browsing history, social media activity) and design around those lines now.
- Document your vulnerability analysis. “Electronic protection” means authentication, encryption, and any other prescribed type. Where could an assistance order touch your architecture? Write down why mandated capabilities would or would not create a systemic vulnerability. That becomes your representation evidence under section 8.
- Name your counsel and build the file. Providers get a chance to make representations before a ministerial order. Have counsel identified and the feasibility, cost, and privacy-impact evidence ready before the letter arrives.
- Track the Senate, not just the regulations. The bill is at second reading in the Senate after debate on October 8. Amendments to the order power, the secrecy default, or the review timeline are all still possible there.
The move: Treat the 180-day Part 1 clock as already ticking, because Royal Assent is the trigger and no regulation can pause it. For Part 2, plan for the order power, not the regulations: map your metadata, document why your encryption cannot carry mandated capabilities safely, and brief leadership that the government’s most consequential obligations under this bill can arrive in a letter you are legally barred from disclosing.