John Carpay: The Quiet Expansion of State Power Over Canadians’ Digital Lives

The Canadian Press/Sean Kilpatrick

Commentary

Canadians are being asked to accept a quiet but profound transformation in the relationship between citizen and state. Under the banners of cyber security, fighting crime, and protecting children from social media harms, Ottawa is assembling new legal powers that expand government reach into private communications, financial records, location data, and online identities.

Three recent federal measures—Bill C-8, Bill C-22, and Bill C-34—show how this architecture is being constructed, one bill at a time. Each is presented as a measured response to genuine threats. Taken together, they form the foundation of an emerging surveillance state that can resemble the “social credit” system that is now in force in communist China.

Bill C-8, An Act respecting cyber security, received Royal Assent on June 15. This new law grants sweeping authority over telecommunications systems and critical cyber infrastructure. Enforcement officials may now access records and systems in the name of national and cyber security, frequently through secret ministerial orders. These orders can compel providers to restrict or remove services from individual Canadians, hand over private information about Canadians, and disconnect individuals from digital networks, often with limited independent oversight and gag provisions that prevent public or media scrutiny. Privacy advocates have warned that the practical effect is a capacity for warrantless intervention and even deplatforming, exercised largely outside the ordinary judicial process.

Bill C-22, the Lawful Access Act, passed third reading in the House of Commons on June 18 after being fast-tracked with limited debate. If passed, it will lower the legal threshold for obtaining subscriber information from electronic service providers. Where police once needed “reasonable grounds to believe” that a crime had been or would be committed, the new standard is the weaker “reasonable grounds to suspect.”

Bill C-22, now before the Senate, also authorizes new warrantless demands for certain categories of information and requires service providers to retain Canadians’ metadata (details about who communicates with whom, when, from where, and through which services) for periods of up to six months. Metadata of this kind reveals patterns of association, movement, and daily routine even when the content of messages remains encrypted. Courts in Europe have repeatedly struck down similar mandatory retention regimes as disproportionate interferences with privacy. Canada is now moving in the opposite direction, normalizing the long-term storage of digital trails that map the lives of the vast majority of citizens who have committed no crime.

Bill C-34, the Safe Social Media Act, goes further still. It opens the door to requiring all Canadians to prove their age and identity when accessing social media platforms, leading to increased collection of personal information by social media platforms, AI companies, and perhaps even government institutions. Bill C-34 also creates a new and very powerful super-regulator called the Digital Safety Commission. This Commission will be armed with broad, largely undefined powers to regulate online activity and to impose penalties of up to $10 million, or 3 percent of a company’s global revenues for non-compliance. What constitutes “harmful content,” including the vague category of material that “foments hatred,” will largely be left to the Commission to define and enforce through guidelines and orders after the bill becomes law.

To illustrate the danger of allowing governments to punish “wrong” opinions, Toronto police stopped a Rebel News billboard truck on July 23, 2026, and began investigating an alleged hate crime. The truck was displaying a paid advertisement from Canadian Women’s Sex-Based Rights stating that “Women and girls deserve safety on the field, privacy and dignity in the locker room, and fairness on the podium” and that “males are invading female sports.”

These newer statutes build upon existing frameworks such as the federal anti-money-laundering regime, which already requires extensive collection and sharing of personal financial information. The Customs Act allows border officials to search smartphones and electronic devices, often without the judicial authorization that would be required elsewhere. The cumulative effect of existing laws and new laws allows for far broader state access to Canadians’ communications, transactions, and online behaviour, justified by the ever-popular cause of “safety and security.”

This legislative trend collides directly with the privacy protections that the Supreme Court of Canada has carefully constructed since the Canadian Charter of Rights and Freedoms came into force in 1982.

Section 8 of the Charter guarantees that “Everyone has the right to be secure against unreasonable search or seizure.” In Hunter v. Southam Inc. (1984), the court held that this right protects a reasonable expectation of privacy wherever it exists, including personal data, devices, and communications. In R. v. Duarte (1990), the court ruled that secret electronic surveillance by the state violates section 8. The court further held that government cannot evade Charter limits by relying on intermediaries to obtain information it could not lawfully demand itself.

In R. v. Spencer (2014), the Supreme Court prohibited police from obtaining subscriber information from internet service providers without a warrant, even when the provider was willing to supply it voluntarily. In R. v. Marakah (2017), the court recognized that a sender retains a reasonable expectation of privacy in text messages stored on another person’s device; a warrant is therefore required before police may search a recipient’s phone for those messages. Each ruling expanded the zone of personal digital privacy against state intrusion.

The federal government’s new bills (and in the case of C-8, a new law that is now in force) effectively seek to reverse or circumvent Court rulings by lowering evidentiary thresholds, mandating data retention, authorizing warrantless demands, and creating regulatory bodies with expansive discretionary power. The result is an emerging surveillance capacity that gives the state continuous visibility into the associations, movements, and communications of ordinary citizens.

The sudden freezing of Canadians’ bank accounts without any due process during the Freedom Convoy protest in 2022, later ruled illegal by the Federal Court, have already demonstrated how quickly financial and digital tools can be turned against citizens who have committed no crime.

Canadians should refuse the false choice between privacy and security. Effective investigation of crime and protection of national security have long been possible within the constitutional boundaries set by the Supreme Court. There is no shortage of law enforcement tools.

Privacy is the precondition for freedom of thought, freedom of expression, personal autonomy, and human dignity. When citizens know or reasonably believe they are monitored, they self-censor. When the state can map the digital lives of citizens at will, the space for independent judgment and peaceful dissent shrinks.

Protecting privacy is therefore essential to preserving freedom itself. If governments wish to investigate crime and cyber threats, they can do so effectively while respecting our privacy and not turning Canada into a surveillance state.

John Carpay, B.A., LL.B. is President of the Justice Centre for Constitutional Freedoms (jccf.ca).

Views expressed in this article are opinions of the author and do not necessarily reflect the views of The Epoch Times.