Through the metaphor of “Big Brother,” George Orwell imagined a society in which privacy could disappear under the constant gaze of the state. Modern democracies are premised upon resisting such unchecked surveillance power through law and oversight. Yet, while intended to strengthen Canada’s ability to confront emerging security threats, Bill C-22 would also expand the state’s access to citizens’ private communications and data. The result is a fundamental tension between national security and the democratic values of privacy, civil liberty, and free participation. Gaps in Canada’s current framework for regulating commercial spyware — which refers to surveillance software sold by private vendors to governments — risks leaving the democratic freedoms that sustain civil society insufficiently protected, particularly for journalists, activists, and human rights defenders. Bill C-22 illustrates this challenge; it expands state monitoring powers without introducing corresponding accountability measures.
Canada’s regulatory framework has struggled to keep pace with rapidly evolving surveillance technologies, both in the laws governing their use and in their implementation by law enforcement. The Venice Commission’s 2024 recommendations set out minimum safeguards for rule-of-law-compliant spyware regulation, which Canada’s current framework fails to meet. For instance, the Venice report suggests limiting the use of spyware to a narrow set of very serious offences; such as mafia-type organized crime or offences committed for terrorist purposes. In contrast, Part VI of Canada’s Criminal Code permits spyware deployment for nearly 200 offences, including mischief, copyright infringement, and the possession of unstamped vaping products. The safeguards that do exist are narrower than those the Venice Commission recommends. The Criminal Code restricts interception of private communications at lawyers’ offices and requires judicial oversight when monitoring journalistic communications. Both protect specific professional relationships, but they do not extend to government critics and foreign political dissidents. In practice, police use of spyware has expanded with little public transparency. In 2022, the RCMP disclosed that it had used on-device investigation tools — software allowing covert data collection from a targeted device — in 32 investigations since 2017 without notifying Parliament. In 2025, reports linked the Ontario Provincial Police to the acquisition of services from Paragon Solutions, an Israeli spyware vendor. These cases illustrate the legal backdrop against which Bill C-22 emerges.
Also known as the Lawful Access Act, Bill C-22 would confer new surveillance powers on Canadian law enforcement agencies. Particular concern has centred on Part 2 of the bill, the Supporting Authorized Access to Information Act (SAAIA); as introduced, it would impose obligations on electronic service providers (ESPs) to access, record, and retain metadata of every user — including personal information, physical location, and history of interactions — for up to one year. Given the breadth of the definition of an ESP, a wide range of digital service providers could fall within the scope of these obligations: from private messaging applications, to businesses operating a Wi-Fi network, to retailers offering mobile shopping services. If enacted, these requirements could compel service providers to introduce vulnerabilities — described by critics as “surveillance backdoors,” or deliberate weaknesses built into encrypted systems that allow outside parties to bypass security protections. The risk is that such backdoors could be exploited by anyone able to find them, well beyond the government agencies for which they were designed. As Apple warned before the parliamentary committee, building a backdoor into encrypted devices creates vulnerabilities that anyone can walk through, including cybercriminals and hostile foreign actors. The Citizen Lab, a Munk School-based digital policy research laboratory, denounced this as “constitutionally fatal.” Yet, Bill C-22 was fast-tracked through the House of Commons on June 18, 2026, and now sits before the Senate — a strikingly rapid progression amid extensive criticism.
The government presents Bill C-22 as a necessary modernization: police and security institutions need modern tools to investigate crimes committed through digital platforms. It responded to criticism by capping metadata retention at six months and limiting it to metadata essential investigations. Minister Anandasangaree asserts that Bill C-22 was never intended to undermine privacy protections and that its implementation would remain subject to required legislative approvals, while insisting that the bill would not be optional. The question, then, is whether these safeguards are proportionate to the scale of the power Bill C-22 would confer. Civil society organizations and privacy scholars argue that they are not, particularly for those whose work depends on confidential communication. SAAIA’s obligations would require virtual private networks (VPNs) to retain user data, undermining a tool relied on by journalists, human rights defenders, political dissidents from authoritarian regimes, and members of vulnerable communities to protect their identities and locations. Weakening these protections could deter them from freely and safely participating in public discourse and civic activism. On April 21, 2026, a coalition of 14 organizations spanning civil liberties, refugee rights, academia, and digital rights, alongside 15 privacy scholars, presented an open letter to Prime Minister Carney and Parliament demanding the full withdrawal of Bill C-22 in defence of free speech, privacy, and security. As Citizen Lab (PDF) has stated, “fractures to Canadian democracy can become a seedbed of public distrust or discontent.” In an interview for this article, Citizen Lab Director Ronald Deibert noted that this dynamic is already underway, arguing that the Canadian government has done virtually nothing to regulate mercenary surveillance, whether through sanctions, allowlists, or export controls. He adds that Canada’s security agencies offer little transparency or public accountability over their own use of spyware, which he believes to be almost certainly routine. Dr. Deibert’s warning, alongside the concerns raised by civil society organizations, underscore the need for the government to respond meaningfully to calls for stronger safeguards and clear limits on surveillance.
Addressing the regulatory gap requires a framework that treats democratic participation as a precondition for security rather than a casualty of it. The concessions made by the government do not resolve the underlying concern: the bill maintains metadata retention as the structural core of its framework, enabling continued state access to users’ private information. Three key measures are therefore necessary to address these shortcomings. First, the Criminal Code should limit Part VI’s spyware authorizations to serious offences, in line with the Venice Commission’s standards. Second, Canada should establish categorical protections, tiered by risk. For professions whose work depends on confidentiality, such as lawyers and journalists, the law should bar spyware targeting unless the person is personally suspected of a serious offence and the investigation is authorized by a superior court. For human rights defenders and dissidents, whose work is not covered by such confidentiality rules, the law should bar authorizations based on lawful advocacy or protest. Third, following New York State and New Zealand initiatives, an independent advisory panel should be established to ensure that constitutionally protected rights are adequately safeguarded by the amendments introduced by the first two recommendations.
The challenge for Canada is not merely to strengthen its ability to confront emerging security threats, but to ensure that those powers do not take precedence over the democratic freedoms they are intended to defend. A state need not become “Big Brother” to wield powerful surveillance tools, but it must maintain adequate safeguards and independent oversight to preserve accountability and public trust. With Bill C-22 now before the Senate, its task is to reconcile national security with the values that uphold a democratic society.
Photo: “Persons Under CCTV Cameras” (2016), by Matthew Henry via Unsplash. Public Domain (CC0 1.0). https://www.pexels.com/photo/374103/.
Disclaimer: Any views or opinions expressed in articles are solely those of the authors and do not necessarily represent the views of the NATO Association of Canada.
