C-2: Strong Borders Act

Earlier this week, I wrote about how the government’s inclusion of warrantless information demand powers in Bill C-2 may make this the most dangerous lawful access proposal yet, exceeding even the 2010 bill led by Conservative Public Safety Minister Vic Toews. The post emphasized the broad scope of the information demand power. Unlike prior lawful access proposals that targeted telecom and Internet companies, Bill C-2 targets anyone that provides a service to the public. This could include physicians, lawyers, accountants, financial institutions, hotels, car rental companies, libraries, and educational institutions. The list literally never ends. Each of these service providers could be compelled to confirm whether they have provided services to any subscriber, client, account, or identifier. They must also disclose whether they have any information about the subscriber, client, account or identifier as well as advise where and when they provided the service. On top of that, they must advise when they started providing the service and list the names of any other person that may have provided other services. All without a warrant or court oversight. Department of Justice officials provided a briefing on the provisions yesterday and confirmed this reading of the bill. Officials acknowledged that Bill C-2 extends far beyond just telecom companies to services such as financial institutions, car rental companies, and hotels. When asked about hospitals, physicians, and other health professionals, the officials affirmed that they were covered as well (officials claimed that there would still be the need for a criminal investigation, but that is incorrect since this applies to any Act of Parliament, not just the Criminal Code).

CALGARY, AB: The Justice Centre for Constitutional Freedoms has launched a petition calling upon the Prime Minister of Canada to strike the criminalization of cash payments of $10,000 or more from Bill C-2 and to introduce legislation protecting the right of Canadians to use cash of any amount for legal transactions. Public Safety Minister Gary […]

Buried beneath the rhetoric of national security is a digital dragnet designed to sidestep the courts.

Canada’s Strong Borders Act opens the door for warrantless surveillance across every corner of public life, from haircuts to hospital visits.

The government’s plan for warrantless disclosure of Internet subscriber information is rightly attracting increasing attention as sneaking lawful access provisions into a border bill raises significant privacy concerns. As I pointed out last week, Bill C-2’s new “information demand” power - which can be used by a wide range of enforcement agencies over literally any potential offence of any Act of Parliament - is certain to spark a legal challenge given the Supreme Court of Canada’s previous decisions in Spencer and Bykovets. While the government has tried to paint the information at stake as “phone book” information with little privacy value, the reality is far different. The information demand includes whether the provider provides or has provided services to a particular subscriber or client, or to any account or identifier, whether there is transmission data on hand (who was the person communicating with and what apps were they using) as well as where and when the service was provided. The information demand can also cover when service began, when it ended, and what other communications services are used by the subscriber. The specific content would require a warrant, but all of this data, which can be very revealing, would be available without judicial oversight. Further, providers would be prohibited from disclosing the disclosure for a year and would receive legal immunity if they voluntarily provide the information without even requiring an information demand request.

The government yesterday introduced the Strong Border Act (Bill C-2), legislation that was promoted as establishing new border measure provisions presumably designed to address U.S. concerns regarding the border. Yet buried toward the end of the bill are lawful access provisions that have nothing to do with the border. Those provisions, which raise the prospect of warrantless access to information about Internet subscribers, establish new global production orders of subscriber information, and envision new levels of access to data held by electronic service providers, mark the latest attempt in a longstanding campaign by Canadian law enforcement for lawful access legislation. Stymied by the Supreme Court of Canada (which has ruled that there is a reasonable expectation of privacy in subscriber data) and by repeated failures to present a compelling evidentiary case for warrantless access, law enforcement has instead tried to frame lawful access as essential to address everything from organized crime to cyber-bullying to (now) border safety. Much like the government’s overreach last year on online harms, Bill C-2 overreaches by including measures on Internet subscriber data that have nothing to do with border safety or security but raise privacy and civil liberties concerns that are bound to spark opposition. This post provides the background on lawful access and an overview of some Bill C-2’s provisions with more details on key elements to come.

On June 3, 2025, the Canadian government tabled Bill C-2, omnibus legislation that, if passed, would introduce a wide array of new federal agency and law enforcement powers, and would significantly reform substantive and due process laws in Canada for migrants and asylum seekers. Our preliminary analysis of Bill C-2 situates the legislation within the context of existing research by the Citizen Lab about two potential data-sharing treaties that are most relevant to the new proposed powers being introduced in Bill C-2: the Second Additional Protocol to the Budapest Convention (2AP) and the CLOUD Act. Both of which carry significant constitutional and human rights risks.