Lawful Access Act, 2026

This bill, known as the Lawful Access Act, 2026, updates how police, other public officers, and Canada's intelligence service (CSIS) can obtain electronic data and information during investigations. It also creates new obligations for companies that provide electronic and telecommunications services.

Part 1 changes the Criminal Code and related laws to speed up and clarify how investigators get information from telecommunications companies. Police can now send a simple "confirmation of service" demand asking a provider to confirm whether they serve a particular customer, without needing a full court order. Court-ordered production of basic subscriber information (name, address, account details, etc.) is streamlined, and companies have less time to challenge these orders. The bill also clarifies that police may receive information voluntarily provided by a company or that is publicly available without needing a warrant, and sets rules for obtaining evidence quickly in urgent situations. New rules let judges authorize police to examine computer data seized under a warrant, and to request data from foreign companies that provide telecommunications or online services to Canadians. Similar tools are extended to CSIS for national security investigations, and to enforcement under drug and cannabis laws. A new process also lets Canada enforce foreign governments' data-production orders against companies operating in Canada, under judicial supervision.

Part 2 creates a new law, the Supporting Authorized Access to Information Act, which requires certain "core" electronic service providers (companies designated by regulation, likely major telecom and tech companies) to maintain the technical capability to help authorized investigators access information under existing legal powers. The government can issue ministerial orders compelling specific companies to build or maintain such capabilities, subject to review and approval by the Intelligence Commissioner, and companies cannot be forced to create security vulnerabilities or break encryption they don't control. The law includes confidentiality rules, inspection and audit powers, compliance orders, and a system of fines and offences for non-compliance, along with an annual public report on how these powers are used.

Part 3 requires Parliament to conduct a full review of how these new powers and rules are working three years after the law fully takes effect.

This bill creates new police and CSIS powers to demand subscriber confirmation and data from telecommunications providers, expands computer-data examination and tracking warrants, allows requests to foreign entities for data, and enacts the Supporting Authorized Access to Information Act, which lets Cabinet and the Minister of Public Safety impose technical-capability and data-retention obligations on "core" electronic service providers.

• New investigative demands — peace officers and public officers can issue "confirmation of service demands" to telecom providers without prior judicial authorization, requiring confirmation of whether a subscriber/account exists, based only on "reasonable grounds to suspect"; non-disclosure conditions of up to one year can be attached.
• Computer data examination — warrants can authorize examining computer data already in police possession, and section 487.0195 allows officers to receive and act on voluntarily provided or "publicly available" information without any warrant, production order, or demand.
• Cross-border reach — a justice may authorize an officer to request transmission data or subscriber information directly from a foreign entity providing telecommunications or telecommunication-based services, and the Minister of Justice can authorize enforcement in Canada of a foreign state's or entity's production decision.
• New regulator over electronic service providers — the Supporting Authorized Access to Information Act lets the Governor in Council (Cabinet) designate classes of "core providers" and make regulations forcing them to build and maintain technical capabilities for authorized access, including metadata retention up to six months; the Minister of Public Safety can also issue individual orders (up to two years, renewable) to any electronic service provider, core or not, requiring similar capabilities, subject to approval by the Intelligence Commissioner.
• Compliance and penalty regime — the Act creates inspection powers (entry without warrant to non-dwelling places), compliance and audit orders, and administrative monetary penalties up to $250,000 for corporations, plus summary offences with fines up to $500,000 for corporations and $100,000 for individuals; non-compliance with confirmation demands under the Criminal Code carries a fine up to $5,000, while contravening a CSIS-related production order can carry imprisonment.
• Oversight — the Minister must report annually (with redactions possible), the Intelligence Commissioner and National Security and Intelligence Review Agency receive notice of ministerial orders, and Parliament's national-security committees must conduct a review three years after the Act is fully in force; there is no sunset clause on the powers themselves.