Key takeaways
- On November 2, 2026, Privacy Commissioner Philippe Dufresne told the Standing Senate Committee on National Security, Defence and Veterans Affairs that Bill C-22’s new subscriber information production order needs targeted amendments: narrow the definition of “subscriber information” to a finite list of discrete identifiers, and restrict who can be compelled to “telecommunications service providers.”
- Bill C-22’s definition goes further than what the Supreme Court recognized in R. v. Spencer (2014) and R. v. Bykovets (2024). Beyond name, address, phone, and contact information tied to an IP, the bill adds email, pseudonyms, assigned identifiers like account numbers, and information about services, subscription duration, and devices. And “a person who provides services to the public” is undefined, so ISPs, social platforms, e-commerce sites, and cloud providers all sit in the frame.
- If the government will not narrow the definition or the recipients, Dufresne asked for a carve-out of medical and legally privileged information from the order. The Senate began its detailed study of the bill after second reading on October 22, 2026, and the minister’s answer on Monday was that engagement with critics “did not weaken the bill. It actually made it stronger.”
Monday in Ottawa, the Privacy Commissioner walked into the Senate’s national security committee with a short list. Philippe Dufresne did not ask the Senate to kill Bill C-22, the Lawful Access Act, 2026. He asked for something narrower and, in a way, harder to dismiss: three targeted amendments to the bill’s new subscriber information production order. Canadian Press reporting from the hearing put his central claim in one sentence: the proposed definition of “subscriber information” and the range of people it can be compelled from are broad relative to the reasonable suspicion threshold required to access it.
That sentence names the exact trade the bill makes.
What the order actually says
Today, police get subscriber data through a general production order. Clause 6 of Bill C-22 introduces a purpose-built one, new section 487.0142 of the Criminal Code. A peace officer applies to a judge without notice to the target, and the judge grants it where there are reasonable grounds to suspect that an offence has been or will be committed and that the information will help the investigation. That is a deliberately lower bar than the reasonable grounds to believe standard a general production order requires.
Then comes the definition, clause 4, where Dufresne’s pencil is. In R. v. Spencer (2014), the Supreme Court held that Canadians have a reasonable expectation of privacy in subscriber information (name, address, telephone number tied to an IP), which makes a police request for it a “search” under section 8 of the Charter. R. v. Bykovets (2024) said the same for IP addresses. The bill starts there and keeps going: name, address, telephone number, and email tied to an IP, plus the subscriber’s pseudonym, “identifiers assigned” such as account numbers, and “information relating to the services provided,” covering service types, subscription duration, and device identifiers.
Who can be compelled? Any “person who provides services to the public,” a phrase the bill does not define. The Library of Parliament’s legislative summary notes the obvious: read broadly, that could be internet service providers plus social media platforms, e-commerce sites, cloud providers, and other businesses holding data police want. Contrast this with the bill’s own clause 5 confirmation-of-service demand, which applies only to telecommunications service providers.
Where the Commissioner sees the break
Dufresne’s argument is arithmetic: a low threshold plus a wide definition plus a wide recipient class equals a tool that reaches further than its justification. He named healthcare providers, lawyers, financial institutions, and dating apps as the services whose information attracts “a heightened expectation of privacy due to its sensitivity.”
The three asks, in order of preference:
- Narrow the definition of subscriber information to a finite list of discrete identifiers. A closed list, not an open-ended category.
- Narrow the recipients to “telecommunications service providers,” matching the bill’s own confirmation-of-service demand.
- Failing that, carve out the sensitive core. If the government will not narrow the definition or the recipients, add a carve-out for medical or legally privileged information to the new order.
His office made the same case in its May 2026 submission to the House public safety committee. Monday was the same office pressing the same point at the Senate stage.
| Bill C-22’s definition | The Supreme Court’s definition |
|---|---|
| Name, address, phone, email tied to an IP | Name, address, phone/contact info tied to an IP |
| Pseudonyms and assigned identifiers (e.g., account numbers) | Not included |
| Service types, subscription duration, device identifiers | Not included |
| Compellable from any “person who provides services to the public” | n/a |
The other side of the room
The government does not see a broken tool. Public Safety Minister Gary Anandasangaree told the same committee Monday that the bill exists so that when a judge authorizes an investigation, law enforcement has the ability to carry it out. “The legislation before you today was shaped by significant engagement with stakeholders and parliamentarians,” he said, “and that collaboration did not weaken the bill. It actually made it stronger.” His stated position: the measure is not particularly sensitive, since it is limited to information that identifies clients and services, not the contents of communications.
Monday was not the backdoor debate. That fight, the cryptographers’ briefing warning about weakened encryption, runs on a parallel track at the same committee. Monday was about a production order with a low threshold and a wide net, and the commissioner’s point stands on its own math: the lower the threshold, the tighter the definition has to be.
Your desk this week
Whether or not the Senate adopts Dufresne’s amendments, three things belong on your list now:
- Map your “person who provides services to the public” footprint. If you run a SaaS product, a marketplace, a health app, or any service holding subscriber identifiers, you are in the recipient class as drafted. Know which databases hold subscriber information before a production order asks you to produce it.
- Update your law-enforcement request playbook for the lower threshold. Expect more orders, earlier in investigations. Your intake should distinguish the new s.487.0142 order from a general production order, and verify each order stays inside the categories of the statutory definition.
- Inventory the sensitive categories you hold. If your subscriber data includes medical, legally privileged, or otherwise highly sensitive information, the carve-out he asked for does not exist yet. Plan as though it will not.
Actionable takeaway: Pull your data map this week and mark every system holding subscriber identifiers against the three asks: the definition is still wide, the recipient class is still everyone, and the carve-out is still an ask, not a clause. The Senate study is where those lines get drawn, and it just started.