The government is set to introduce its long-promised privacy reform legislation early this week, with the recognition of a fundamental right to privacy expected to serve as a foundational element of the bill. Establishing privacy as a fundamental right would be a welcome and long-overdue development, one that many have called for and that was set to be added to Bill C-27, the prior attempt at privacy reform. Yet the framing is difficult to square with the government’s actual record on privacy, which over the past year has involved a steady stream of privacy-invasive measures that leave the fundamental rights rhetoric feeling more like virtue signalling than a genuine commitment. Simply put, the government cannot credibly claim to treat privacy as a fundamental right while actively undermining that right through a series of other bills and efforts to sideline the Privacy Commissioner of Canada.

Just over a year ago, the Carney government got off to a poor start on privacy with a pair of bills that left me asking, “What is with this government and privacy?” Bill C-2, the border measures bill introduced in June 2025, buried lawful access provisions unrelated to the border, including a warrantless information-demand power astonishing in its breadth that stood in direct contradiction to the Supreme Court of Canada’s privacy jurisprudence in decisions such as Spencer. The provisions attracted such a backlash that the government eventually removed them and reintroduced the border measures on its own. Days later, it introduced Bill C-4, an “affordability measures” bill that buried an exemption shielding federal political parties from provincial privacy law and made it retroactive to the year 2000. In other words, the instinct from the outset was to bury privacy-invasive measures in unrelated legislation and hope that few Canadians would notice.

If those early bills signalled a government with little regard for privacy, the situation today is worse, with more privacy threats moving through Parliament at once than under any government in recent memory. Bill C-34, the Safe Social Media Act introduced last week, pairs an under-16 social media ban with an age verification mandate that will require tens of millions of Canadians to place their privacy at risk by verifying their age to use services such as Facebook, Instagram and Reddit. Bill C-22, the lawful access bill now under clause-by-clause review, would impose mandatory metadata retention requiring providers to store data about the communications of all their users regardless of whether they are suspected of anything, compel the development of interception capabilities that place encryption at risk, and lower the evidentiary standard for access to subscriber information. And Bill C-25, the government’s second attempt at political party privacy rules after C-4, would still leave the parties subject to weaker privacy obligations than practically any other organization in the country.

The treatment of the Privacy Commissioner is particularly revealing, since a fundamental right to privacy means little without an independent regulator with the power and the standing to defend it. During the clause-by-clause review of Bill C-22, the committee invited the RCMP and CSIS, the agencies that lobbied for the new powers to guide MPs through the amendments, yet Liberal MPs have blocked efforts to ask Commissioner Philippe Dufresne to return to explain his recommended changes. The same disregard is evident in Bill C-34, where the government included a mandatory requirement to consult the Privacy Commissioner on the guidelines and regulations that will define age verification, only for officials to describe a plan that will bring the ban into force without the mandatory consultations.

The government’s underlying attitude toward privacy may be the most telling of all. Bill C-25 moved to shut down meaningful study, restricting the committee’s examination to three days in what appears to be a calculated bet that few Canadians would pay attention to a set of embarrassingly weak privacy rules. And on Bill C-22, when Conservative MP Jacob Mantle pressed the privacy implications of the bill during clause-by-clause, Liberal MP Sima Acan this week responded that the bill “has nothing to do with the privacy of people and their information,” a statement that, after months of hearings on mandatory metadata retention, weakened encryption, and warrantless access to personal information, is difficult to describe as anything other than ill-informed and suggests a government that does not conceive of privacy the way most Canadians do.

The new privacy bill deserves to be evaluated on its merits and if the forthcoming bill delivers a genuine fundamental right to privacy backed by meaningful enforcement, that will be welcome. But legislation does not arise in a vacuum and adding language proclaiming a “fundamental right to privacy” while actively undermining that privacy can’t be ignored. The government may talk the talk on privacy, but it is time for it to walk the walk as well.