Canada tabled new lawful access legislation this week as the federal government seeks to close a gap between its surveillance powers and those of its Five Eyes allies – a push that comes against the backdrop of biometric privacy guidance the country’s Privacy Commissioner published last year.
Bill C-22, the Keeping Canadians Safe Act, was tabled on March 12 by Public Safety Minister Gary Anandasangaree. The bill updates Canada’s lawful access framework, which officials say has fallen “woefully behind” those of Five Eyes partners – the United States, United Kingdom, Australia, and New Zealand. Under the proposed legislation, CSIS and law enforcement agencies would be authorized to compel telecoms such as Bell and Rogers to answer a binary question: whether a specific suspected individual is a subscriber on their network. The bill does not authorize access to browsing history, private messages, emails, or social media data. If investigators need deeper information, existing judicial warrant processes apply.
Anandasangaree described the legislation as a calibrated balance: expanding investigative capability without enabling broad surveillance of ordinary Canadians. “It is not about surveillance of Canadians going on about their daily lives,” he said. “It is about keeping Canadians safe in the online space.” The bill is the government’s second attempt at lawful access reform; a prior effort, Bill C-2, was withdrawn after civil liberties organizations argued its powers were too expansive. C-22’s narrower scope reflects those concerns.
The legislative push sits alongside guidance the Office of the Privacy Commissioner issued in August 2025 on biometric data use in the private sector, with emphasis on the proportionality of facial recognition deployment. That guidance – issued under the Personal Information Protection and Electronic Documents Act (PIPEDA) – asks organizations to weigh whether the privacy impacts of any biometric initiative are justified by the security or operational benefits gained. It covers facial recognition, fingerprint scanning, and voice identification, and applies to commercial deployments across industries.
The Commissioner’s guidance asks organizations to demonstrate that biometric collection is tied to a clearly defined and proportionate purpose, that retention is minimized, and that individuals are informed. Facial recognition receives heightened attention given its capacity to reveal sensitive attributes such as race and gender characteristics. The guidance also addresses consent requirements, data safeguards, and accuracy testing obligations for biometric systems.
Together, Bill C-22 and the existing OPC framework illustrate the layered governance Canada is building around identity and surveillance: broader statutory access tools for security authorities operating under judicial oversight, and tighter proportionality constraints on commercial biometric collection under PIPEDA.
Sources: Radio-Canada, Office of the Privacy Commissioner of Canada
–
By Cass Kennedy
