A secret order can still leave a record

Dynamic lawful access and Bill C-22

Mark Lizar, Transparency Lab · Published by Global Privacy Rights · 17 October 2026

Bill C-22 would let the Minister order providers to build access capabilities in secret, and bar them from saying so. A secret order can still leave a record. This piece proposes how, and what Canada loses if it does not.

What Bill C-22 leaves open

Michael Geist’s analysis of Bill C-22 sets out the problem precisely. Part 2, the Supporting Authorized Access to Information Act, leaves almost everything that matters to regulations that may take years to arrive: which providers are covered, what they must build, what metadata they must retain, and what “encryption” means. In the meantime, under section 7(1), the Minister may make an order containing any provision a regulation under section 5(2) could contain, valid for up to two years. Under section 12 an order prevails over an inconsistent regulation, and section 14 bars the provider from disclosing the order, or even the fact that it is subject to one. The only built-in review comes in the third year after every provision is in force, which Geist estimates could be seven or eight years after Royal Assent.

Lawful access has been before Parliament for twenty years: Bill C-74 in 2005, Bill C-30 in 2012, abandoned the next year, Bill C-13, passed in 2014, Part 15 of the Strong Borders Act in 2025, and now Bill C-22, at second reading in the Senate. The framing has barely moved. It is still security against privacy, with safeguards that can be checked only after the fact, in aggregate, or by bodies inside the security apparatus. NSIRA, NSICOP, the Intelligence Commissioner and the annual interception reports under the Criminal Code all matter. None of them is designed to witness section 7 orders as they are made.

The usual response is to argue about secrecy itself. That framing is a losing argument for both sides. Some orders do need to stay confidential, and an access regime that cannot keep a request confidential will quickly fail. But confidentiality of content is a different thing from secrecy of existence. An order can be confidential and still leave a record that an independent party holds, that a regulator can oversee, that a court or reviewer can check, and that the public can count and trust.

The notice Canada would have to give

At Transparency Lab we work on transparency notices within a cross-border consent framework. Its starting rule is simple. Before personal information or identifiers cross a border, the person is given a disclosure: who is accountable, for what purpose, and under which jurisdiction’s rules the data will be held. That disclosure is what makes consent real, and it is what gives data sovereignty a practical meaning, because the person and their regulator can see which law the data will answer to before it is moved.

Apply that rule to Bill C-22 as drafted. The honest standard disclosure for any service holding data in Canada would read something like this:

In Canada, data about you may be retained for the state, and made accessible to it, under orders the provider is not permitted to disclose, and your rights over that data may be derogated without notice to you.

A provider could not say whether it had received an order. It could only describe the regime. That is the point. The one thing the law would let it disclose is that rights are derogated, without saying when, how often, or for whom. European controllers already have to tell people when their data goes to a country outside the EU and on what basis. A regime of undisclosed orders is the kind of fact that reaches those notices, and the review of Canada’s adequacy.

A black box is the archaic way to provide lawful access, and an expensive one. Each provider builds and maintains capability in secret, with no record that shows it was used lawfully, and every partner downstream discounts Canadian data for the uncertainty. The fixed cost of secret capability falls hardest on smaller Canadian providers. Bill C-22 externalises the costs of short-sighted security onto Canadians. Signal, Windscribe, NordVPN and DuckDuckGo have already said they would limit or withdraw service from Canada rather than comply.

A record is the modern way, and it is an opening for Canada to compete internationally. A provider that can show, through independently witnessed records, that access to its customers’ data happens only by lawful, bounded and recorded request has something to offer at home and to partners abroad. Canada could set that standard, and compete for the trust of the countries building on Convention 108+, instead of legislating a black box.

Orders and accesses

Two different acts need records.

A section 7 order is a standing obligation on a provider: to build, to retain, to be ready. The bill already limits each order to two years. Each order should also be registered with an independent body when it is made, and renewed only on the record. The bill already contemplates disclosure of order information to a regulatory authority in some cases, so an independent record is a short step from where the bill stands.

An access is a single use of that readiness, made under a warrant or production order. The judge already approves it. What is missing is the evidence trail afterwards. An access becomes accountable when it has four checkable properties:

1. Credentialed. The request is made by an authority whose credential is verified at a stated assurance level, naming the instrument it relies on.
2. Logged to a party other than the requester. The requester never holds the only copy of the record of what it asked for.
3. Approved for this request. The authority is granted for this request, not held as a standing permission.
4. Bounded. The access is limited in scope and time, and the data obtained carries a recorded deletion date.

Each of these is a property of the access event, not a policy promise. A system either produces the evidence or it does not.

Recording without revealing

The objection is that any record defeats confidentiality. It does not have to.

A review body, such as NSIRA with a mandate amended for the purpose, can act as a notary. It receives only a salted fingerprint of each event and the time: a value that proves the record existed without revealing anything in it. It adds that fingerprint to an append-only log and publishes signed checkpoints of the log. A notarised record cannot later be altered or backdated without detection.

Completeness needs a second witness. The requesting authority registers each order and each access, and the provider independently registers each order it receives and each access it serves. An access with no matching order, or an order no one registered, shows up as a gap. Proofs are countersigned by more than one witness, so the notary is not a single point of trust.

The accountable privacy officers monitor the access numbers as they happen, and the numbers are published in delayed, aggregate bands, so the public can count the requests and their results without learning which provider was tasked, with what, or for whom. Where the law defers notice to the person, the deferral is itself recorded, with its legal basis and an end date, and when it ends the record shows the person was told.

None of this is exotic. It adapts the transparency logs already used to police the certificates that secure the web, and published research on accountable secret warrants. The limit should be stated plainly: the governance model proves that the records two independent parties keep have not been altered and agree with each other. It governs authorised access. It is not an argument for capability mandates, and recording access does not make existing systemic weaknesses safe.

How to apply it to Bill C-22

Enhancing existing infrastructure and policy is much cheaper. None of this needs the missing regulations to exist first. It could be required now, guardrails first, as conditions on the powers the bill already grants:

• Every section 7 order would be notarised when made, and any renewal would be on the record.
• Every access made under an order is registered by both the requester and the provider.
• The accountable privacy officers monitor access numbers as they happen, not only a review body, and the numbers are published in delayed bands.
• Data obtained carries a deletion date, and deferred notice is recorded with its basis and end date.
• Parliamentary review is triggered by the first order issued, not by the day the last provision comes into force.

This does not settle the encryption question or the scope of retention, and it should not be mistaken for doing so. What it does is give Parliament, the courts and the public a way to know that lawful access is happening, how often and under what authority, while it is happening rather than years later.

What is at stake

Canada’s security, privacy and data sovereignty are at stake, and with them our ability to secure ourselves as a nation, with fundamental impacts on Canadian culture. A retention mandate moves data out of the person’s control and into a datastore kept for and by the state, before any state request is made and whether or not one ever is. The metadata at issue carries no name, but it identifies people through linkage: who they contacted, from where, and when. The Supreme Court of Canada recognised that in R v Spencer (2014) on subscriber information and R v Bykovets (2024) on IP addresses. Metadata deserves the protection we give mail.

It also reaches Canada’s place in international data flows. In January 2024 the European Commission concluded that Canada’s adequacy decision continues to apply. The Court of Justice of the European Union has struck down or limited general and indiscriminate retention of traffic and location data in Digital Rights Ireland (2014), Tele2 Sverige (2016) and La Quadrature du Net (2020), with narrow exceptions. Canada is measured against those standards through the test of essential equivalence, and a retention mandate with secret orders is the kind of measure that test examines.

The trade-off is misconceived

Lawful access debates are framed as security against privacy. The framing persists because the record is missing. When access leaves no evidence, every safeguard is a promise, and every promise is contested. When each access is credentialed, witnessed by two parties, granted for the request and bounded, the officer has a request that holds up afterwards, the reviewer has something to inspect, the provider has proof that it did what the law required and no more, and the person has a record that will reach them.

Require the record, and accountability and access are available at once. Leave it out, and the standard notice for data held in Canada becomes a notice that digital rights are derogated here.

Parliament should ask three questions before third reading. What does secret capability cost the Canadian providers and privacy professionals whose work keeps Canada interoperable with international privacy regimes? Why should safeguards wait for regulations that are years away? And who benefits when only the largest platforms can afford to build for undisclosed access?

About

Mark Lizar is the founder of Transparency Lab, the research lab of Global Privacy Rights, based in Montreal. The Lab builds machine-readable transparency notices and receipt tools for registry-based assurance services.

The notarisation model described here is work in progress. It builds on open standards for notice and consent records, and on transparency principles shared by PIPEDA’s openness principle, Quebec’s Law 25 and Convention 108+, which is not yet in force.

References

1. Michael Geist, “Years of Uncertainty: Bill C-22’s Missing Regulations and Secret Ministerial Orders”, 14 October 2026. https://www.michaelgeist.ca/2026/10/years-of-uncertainty-bill-c-22s-missing-regulations-and-secret-ministerial-orders/
2. Bill C-22 (45th Parliament, 1st Session), Lawful Access Act, 2026, LEGISinfo. https://www.parl.ca/legisinfo/en/bill/45-1/c-22
3. Bill C-22, third reading text, Part 2, sections 7, 12, 14 and 15. https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/third-reading
4. Global News, report on companies warning they could pull services from Canada over Bill C-22, 4 June 2026. https://globalnews.ca/news/11886905/lawful-access-bill-c-22-companies-services-canada/
5. R v Spencer, 2014 SCC 43; R v Bykovets, 2024 SCC 6.
6. Court of Justice of the European Union: Digital Rights Ireland, C-293/12 (2014); Tele2 Sverige and Watson, C-203/15 (2016); La Quadrature du Net, C-511/18 (2020).
7. European Commission, report on the first review of the functioning of the adequacy decisions, 15 January 2024.

For media and press

AI Undermark um:0b44e9e1 · Version 1.2, revised 17 October 2026 · replaces um:79c0c70f · Level 0, resolvable, not signed · reuse terms 1.0