Key takeaways
- Bill C-22 passed the House on June 18, 2026 and awaits Senate study this fall, with committee hearings expected in October and November. The encryption fight will be the centerpiece.
- The government’s “minor opening” compromise satisfies nobody: police say it gives them nothing they do not already have, while nearly two dozen technology companies say it still puts every user’s encryption at risk.
- Privacy teams should use the Senate window to map which vendors sit in the bill’s uncertain “core provider” category and which could face the six-month metadata retention mandate, because designations come after the bill passes, not before.
The minister’s “minor opening”
Public Safety Minister Gary Anandasangaree told the Toronto Star earlier this month that Bill C-22 strikes “the right balance” on encryption. Cracking encryption, he said, is “off limits” except in “extenuating circumstances” where there is a “minor opening.” Everyone, he added, has had to have “some water in their wine.”
The problem, as Michael Geist detailed on September 30, is that both sides of the debate say the middle ground does not exist. That makes the “minor opening” less a compromise than a question the Senate has to answer, since the House of Commons tried to avoid answering it.
The bill’s path so far: introduced in March 2026, it passed third reading in the House on June 18 and arrived in the Senate the same day. The government spent most of the year insisting the bill was “encryption neutral.” Then it amended the bill: nothing in the Act compels a provider to decrypt information unless the provider supplied the encryption and holds the key, and the “systemic vulnerability” definition was tied to “recognized international technical standards.” A carve-out excludes information about persons already subject to a warrant or other lawful authority.
Two sides, one verdict
| Side | What they say | Why it matters to you |
|---|---|---|
| Law enforcement | The OPP’s Thomas Carrique calls encryption “a significant sticking point” and says the bill leaves police “hindered in our ability to prevent and solve crime.” The RCMP told the House committee in May that it wants access to encrypted communications. | If police believe the bill delivers nothing new, pressure for a stronger version does not die with passage. |
| Technology companies | Nearly two dozen companies and industry groups, in a September 24 public letter, say the bill “could still require us to weaken encryption or build interception capabilities,” and that “a backdoor for law enforcement is a backdoor for everyone.” | Your vendors may be ordered to build capabilities that weaken the security you are buying from them. |
| The government | The bill is “encryption neutral” and decryption is “off limits” except for the “minor opening.” | The text, not the talking points, is what a judge will read. |
Apple made the technical case to Australia’s parliament back in 2018: “any process that weakens the mathematical models that protect user data for anyone will by extension weaken the protections for everyone.” The UK’s version of this fight ended with Apple withdrawing Advanced Data Protection from the British market, and Canadian companies are now saying they may have to leave the market too. The pattern is the same every time, and it is worth noticing that it keeps repeating.
The part that actually affects your operations
Encryption takes the headlines, but the bill’s operational teeth sit elsewhere:
- Metadata retention. The bill would let the government require providers to retain metadata for up to six months (cut from one year in the June amendments), including data providers do not currently collect for business purposes. Your vendor risk questionnaires ask about retention by design; this mandate works in the opposite direction.
- “Core provider” designation. The obligations fall on designated core providers, but which organizations land in that category is still uncertain. The telecom industry flagged the ambiguity in its own committee brief.
- Extraterritorial reach. As Access Now warned on September 14, the bill reaches providers whose services are used by people in Canada, Canadian providers used abroad, and even providers with no Canadian users that belong to a corporate group active in Canada. A Canadian minister could order a foreign company, in secret, to weaken product security or retain metadata.
The Senate window is the last open one
The Senate committee study is expected in October and November, with hearings bringing in the Privacy Commissioner, telecoms, civil liberties groups, and academics. Senate amendments are likely. Royal assent, if it comes, lands in early 2027, followed by regulations defining the “essential metadata” categories. That regulation phase is the second, and probably last, real chance to shape what this means in practice.
Actionable takeaway: Build a one-page C-22 readiness memo this month. List the providers that hold your sensitive data, flag any that could plausibly be designated core providers, and add a line to your vendor risk questionnaire asking how the provider would respond to a lawful-access capability order under C-22. If the Senate strengthens the encryption protections, you have done useful diligence anyway. If it does not, you will know exactly where your exposure sits before the regulations are written.