Bill C-2: Expanding the scope of law enforcement powers to obtain subscriber information and other data

For a summary of Bill C-2’s proposal to enact provisions in the Criminal Code that will give law enforcement access to an individual’s “subscriber information”, including personal information, online unique identifiers and transmission data when using internet services, see our team’s related client bulletin.

On June 3, 2025, Parliament introduced Bill C-2: An Act respecting certain measures relating to the security of the border between Canada and the United States and respecting other related security measures.^[1] Bill C-2 proposes significant amendments to various statutes, including the Criminal Code, in respect of how subscriber information is defined and handled.

Key Amendments:

1. The introduction of a statutory definition of “subscriber information”;
2. The expansion of law enforcement’s ability to make demands for subscriber information and transmission data, among other things;
3. The ability to make demands of foreign service providers; and
4. The expansion of investigative police powers where exigent circumstances exist.

In this post, we elaborate on these proposed legislative amendments and discuss potential implications. 

Expanding the legal definition of “subscriber information”

Bill C-2 proposes to add a new definition of “subscriber information” in the Criminal Code. There is currently no definition of the term in the Criminal Code, but the Supreme Court has defined subscriber information as  “the name, address, and telephone number” of a customer associated with a particular Internet Protocol (IP) address^[2] and, more recently, as “the name, address, and contact information … associated with an individual [IP] address.”^[3]

At common law, prior judicial authorization is necessary to obtain subscriber information, as “an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity.”^[4]

The definition of subscriber information proposed in Bill C-2 is more expansive. While it includes a customer’s name, address, telephone number, and contact information (specifically an e-mail address), it more broadly encompasses:

• “information that the subscriber or client provided to the person in order to receive the services”, including a pseudonym;
• “identifiers assigned”, including account numbers; and
• “information relating to the services provided to the client”, including types of services, timeline of services, and information that identifies specific devices or equipment.

Notably, and unlike the common law definition, the proposed statutory definition is not restricted to information associated with an IP address. Rather, the proposed definition is not a closed list and could include a wide variety of information.

The proposed definition is also aimed at “a person who provides services to the public.” This could include Internet Service Providers and other third-parties who have “clients” or “subscribers” with IP addresses.

Providing authority to demand information without prior judicial authorization

Bill C-2 would also permit an officer, upon forming a reasonable suspicion that an offence has been or will be committed, to demand a wide range of preliminary information from a service provider without a warrant or any other prior judicial authorization. 

The information that an officer may demand includes, but is not limited to, whether a service provider has provided services to a particular subscriber or client; whether the service provider has any transmission data about the subscriber or client and the details involved; and information related to anyone else who has provided services to the subscriber or client.^[5] This information can later be used later in the investigation to, for example, form the grounds to obtain a production order or make requests to other service providers who may have information on the same suspect.

Given the relatively low threshold of reasonable suspicion for the demand, the lack of the need for prior judicial authorization, and the Supreme Court’s previous pronouncements on the reasonable expectations of privacy in internet activity, challenges to this provision are likely if the Bill becomes law.

Permitting Production Orders for subscriber information relating to “any information”

Bill C-2 would authorize the police to seek a production order compelling a service provider to prepare and produce a document containing “all the subscriber information that relates to any information, including transmission data, that is specified in the order”.^[6]

Building off the new proposed definition that is not restricted to an IP address, the new production order provision could, in theory, include the production of metadata, including the time and date of information used to identify, activate, or configure devices or communications. It may also encompass more sensitive information beyond “transmission data”, which is already defined in the Criminal Code.

Allowing law enforcement to compel foreign telecommunications entities

Bill C-2 introduces a significant expansion of police powers in Canada by allowing law enforcement to compel a foreign entity that provides telecommunications services to the public to produce subscriber information and transmission data. This provision marks a notable shift in extending Canadian jurisdictional reach arguably beyond domestic borders and into the realm of international telecommunications. The assertion of jurisdiction is consistent with the goal of enhancing Canadian law enforcement relating to financial crime, but may face resistance from international players claiming that it is overreaching.

Expanding the scope of the exigent circumstances doctrine

Bill C-2 also seeks to broaden the range of investigative powers available to police and expand the type of evidence they are authorized to collect in situations involving exigent circumstances.^[7]

The proposed legislation would therefore expand the scope of the codified doctrine of exigent circumstances. Specifically, the amendments would, first, permit law enforcement to obtain transmission data through the use of a transmission data recorder—pursuant to s. 492.2—in exigent circumstances. Second, the amendments would authorize police to collect “subscriber information” without a warrant. This would include tracking data that would ordinarily be obtained pursuant to an order made under s. 487.017(1).

Key Takeaways:

The proposed changes in Bill C-2 are significant  in a few key ways:

• It is likely to increase the amount and scope of law enforcement requests to third parties who deal with the public, including Internet Service Providers;
• It will expedite police investigations allowing more efficient gathering of information necessary for production orders;
• Challenges to the law’s jurisdictional reach are likely; and
• Third parties who possess data about their clients will have to take additional due diligence to ensure they are complying with lawful requests as well as any other reporting or privacy obligations (and their policies).

We will continue to track the progress of Bill C-2 and will post any updates as they become available.

Should you have any questions regarding the impact of the proposed changes on your workplace, please contact a member of our White Collar Investigations and Defence Team.

^[1] Bill C-2, An act respecting certain measures relating to the security of the border between Canada and the United States and respecting other related security measures.

^[2] R. v. Spencer, 2014 SCC 43, at para. 11.

^[3] R. v. Bykovets, 2024 SCC 6, at para. 2.

^[4] R. v. Bykovets, 2024 SCC 6, at para. 28.

^[5] Bill C-2, s. 158, which would add s. 487.0121 to the Criminal Code.

^[6] Bill C-2, s. 159, which would add s. 487.0142 to the Criminal Code.

^[7] For a recent discussion of the exigent circumstances doctrine, see R. v. Campbell, 2024 SCC 42.