Bill C-22, the lawful access bill, passed the House of Commons yesterday with the government invoking a single motion to approve several bills without further debate or individual votes as MPs raced for home for the summer. Bill C-22 will now head to the Senate, where it can expect a rougher ride when study begins in the fall. Rather than use the final days of the House session to answer the privacy, security, and oversight concerns raised by the Privacy Commissioner, academics, technology companies, and civil society groups, the government spent the time ensuring it would not have to, rushing the bill through committee, cutting off debate, and maligning critics with tactics that they once decried when in opposition.
Latest Posts
One Step Forward, Two Steps Back: Bill C-36 Modernizes Canada’s Privacy Law, Then Delays It to 2030
Canada’s private sector privacy law is more than 25 years old and there is broad consensus that a modernization is long overdue. Bill C-36, tabled on Monday, is the government’s third attempt at updating the law, following the failed efforts with Bill C-11 in 2020 and Bill C-27 in 2022. My first post on the new bill focused on what I think remains both the most important development and the biggest mistake: the decision to push the Privacy Commissioner of Canada out of private-sector privacy and to place the file with an overloaded digital safety commission. For years, privacy critics have argued that, given the absence of order-making powers or serious penalties, Canada’s biggest shortcoming has been weak enforcement. Yet just as the government adds much-needed new rights and penalties to the privacy law framework, it undermines enforcement once again by introducing a new regulator that will take years to establish. The consequence is that, rather than updating the law for 2027, it is updating it for 2030 or later.
Gary Anandasangaree’s Vic Toews Moment Shows the Government Has Lost Its Way on Lawful Access
As the government prepares to shut down debate on lawful access and push Bill C-22 through committee without even discussing or debating dozens of potential amendments, Public Safety Minister Gary Anandasangaree’s responded by saying it was time for opposition parties to “choose” whether to stand with law enforcement and victims of crime. The response was telling as it evoked a similar response to another lawful access debate in 2012. At that time, the Conservatives were in power and Vic Toews was the Public Safety Minister. Toews infamously had the following exchange with Liberal MP Francis Scarpaleggia, who is now the Speaker of the House.
Canada’s Digital Super-Regulator: Bill C-36 Pushes Out the Privacy Commissioner and Hands Private Sector Privacy to an Overloaded Commission
In the last act of an incredibly intense digital policy stretch, the government today tabled new private sector privacy legislation in the form of Bill C-36, the Protecting Privacy and Consumer Data Act. It is a big bill, and my initial take will be divided into two: this post will focus on the seismic shift the bill creates for privacy administration and enforcement, and a second post (hopefully tomorrow) will discuss the substantive changes and additions. I start with the enforcement side because the most consequential feature of C-36 is the question of who will administer the rules. The bill firmly cements the Digital Safety Commission as a new digital super-regulator in Canada, stripping the Privacy Commissioner of authority over private sector privacy law and handing it instead to the same five-member commission the government created a few days ago to police online harms. I believe the approach is unprecedented among peer countries and will have negative repercussions for Canada’s standing in the privacy world. Indeed, removing an Agent of Parliament from private-sector privacy enforcement after decades isn’t something you tuck into a lengthy bill, but rather requires extended public consultation and analysis on how best to ensure Canada has effective privacy enforcement. This is a stunning abrogation of good policy development and a poorly conceived vision of the breadth and importance of privacy.


















