Bill C-22, the lawful access bill, was a focal point of debate in the Senate last week. While companies continue to warn they may exit Canada if the bill passes in its current form, the debate’s biggest revelation was that it may take years for the government to pass the regulations needed to fully implement the law. The delay is notable for several reasons, including the government’s insistence in the spring that passing the bill was urgent (to the point that it shut down committee clause-by-clause review) and the regulatory uncertainty that it creates. Indeed, the Senate is effectively being asked to approve a surveillance and data retention framework without knowing who will be covered, what they will be required to build, what data about Canadians will be retained, or what any of it will cost. If this sounds familiar, it is because it has seemingly become the government’s go-to approach on many of its digital bills, from privacy to social media regulation, where key decisions are left to regulations and regulatory processes that take years to complete.

Senator Denise Batters, the bill’s critic, disclosed the regulatory delays, telling the Senate that government officials advised her at a briefing that the first phase of regulations “would probably take 18 months to two years after the bill receives Royal Assent.” When she asked whether the remainder might take five years, the response was “Yes, probably five years,” though she added that “they didn’t even know.”

The timeline matters because of how Bill C-22 is structured. Part 1, which creates the new confirmation of service demand and the production order for Internet subscriber information, takes effect 180 days after Royal Assent, without waiting for any regulations. This means the new police powers will take effect within six months of Royal Assent. However, Part 2, which enacts the Supporting Authorized Access to Information Act (SAAIA), authorizes controversial metadata retention mandates and raises concerns about weakened encryption, but only takes effect on a date fixed by Cabinet order. Even then, the general obligations that apply to core providers depend on a long list of new regulations.

Consider the obligations that apply to “core providers,” defined as electronic service providers that belong to a class set out in the schedule to the Act. Currently, the schedule is empty because section 5(1) leaves it to Cabinet to establish the classes by regulation. Even if the core providers become known, their obligations are also largely subject to regulations under section 5(2): the operational and technical capabilities they must develop, the devices and equipment they must install, and the categories of metadata they must retain for up to six months are all still unknown.

Moreover, while the bill includes a systemic vulnerability safeguard and a new decryption provision, regulation can still shape the safeguard’s scope, since it turns on the meaning of “electronic protection,” defined as authentication, encryption, and “any other prescribed type of data protection.” Section 47(1)(c) grants Cabinet the power to define any term that the Act does not, which includes the meaning of “encryption.” The fees payable to providers and the amounts of administrative monetary penalties are also left to regulation.

One notable exception to the wait for regulations makes this worse. Section 7(1) of the SAAIA allows the Minister of Public Safety, once Part 2 is in force, to issue an order to any electronic service provider, whether or not it is a core provider, containing “any provision that may be contained in a regulation made under subsection 5(2).” This suggests that secret orders could be imposed on individual providers before public regulations are even established. The contrast with the exemption power in section 6(1), which refers to a provision “of a regulation,” meaning one that already exists, reinforces this reading, as does section 12, which provides that an order prevails over any inconsistent regulation and would be unnecessary if orders could only reproduce what regulations already say. The result is that the capability, device and metadata retention obligations in section 5(2) could be imposed on individual companies by ministerial order years before any regulation establishes them for the sector. Meanwhile, section 14 prohibits providers from disclosing their existence except as the Act permits, such as where the Minister authorizes it, which means the orders would be secret by default.

The bill raises serious concerns whether the rules come by way of secret ministerial orders or long-delayed regulations. If the government brings Part 2 into force before the relevant regulations are in place, ministerial orders could fill the gap. Alternatively, if the government waits to bring Part 2 into force until regulations are ready, much of the bill will not take effect for years, creating ongoing legal and regulatory uncertainty.

The delays also raise accountability questions. Bill C-22 requires a parliamentary review during the third year after all its provisions are in force. If Cabinet waits for the regulations before bringing Part 2 into force, that review might not occur until seven or eight years after Royal Assent, with elements of the law in effect for years before the mandatory parliamentary review. If Part 2 is brought into force early, the review could take place before the regulations that give the law its substance even exist.

The government rushed Bill C-22 through the House without full debate or transparency by creating a false sense of urgency. But the Senate faces no such rush. It must take the time to properly review the bill, consider the privacy and security risks raised by mandatory metadata retention and weakened encryption, and address the lengthy delays and uncertainty that come from punting many issues to future regulations or secret ministerial orders.