The Privacy Commissioner and leading cryptographers landed on the same conclusion this week: Bill C-22 needs a narrower door. The Canadian Press reported on Nov. 2, 2026 that Commissioner Philippe Dufresne told the Senate national security committee the bill's definition of subscriber information should be narrowed and compulsion limited to telecommunications providers.
Cryptographers Ian Goldberg, Peter Swire and colleagues made the technical case in a briefing covered by the Globe and Mail on Nov. 3, calling the bill incompatible with state-of-the-art security practices. Two different professions, privacy law and cryptography, are pointing at the same drafting problem.
Access built too broadly cannot be secured narrowly.
Lawful-access requirements shape how systems get built. If access capabilities must be designed into products and networks, those design choices affect encryption strength, key management and audit controls across Canadian systems. Builders weighing those trade-offs through systems design and integration work need the final rules to be precise, because vague obligations get implemented as broad access by default.
Watch the Senate amendments. If the definition narrows and compulsion stays limited to telecom providers, Canadian systems keep stronger encryption options. If it does not, every vendor and operator should expect access design to become part of procurement questions.