C-22 a major step forward, but loopholes still leave children at risk

Bill C-22 marks the most significant modernization of Canada’s digital evidence laws in years, and the Ontario Child Sexual Exploitation Investigators Association applauds the government for bringing forward these long-overdue reforms. For investigators who work daily to protect children from online exploitation, many of the bill’s proposed updates are not only welcome, but also are urgently needed.

But as these same investigators know all too well, the bill still leaves critical gaps. Unless parliamentarians strengthen C-22 before it becomes law, offenders will continue exploiting loopholes that allow evidence to vanish, multinational companies to refuse lawful orders, and investigations to stall at the very moment when speed matters most.

The Ontario Child Sexual Exploitation Investigators Association’s (OCSEIA) message to legislators is simple: you are very close to getting this right. But the bill needs a handful of targeted amendments to truly deliver on its promise.

Ensure tech giants comply with Canadian production orders

Canadian police still cannot obtain user-generated content—emails, chats, cloud files—directly from companies like Google, Meta, Apple, or Microsoft, even though all have a substantial physical presence in Canada. Instead, investigators are forced into the slow Mutual Legal Assistance Treaty process, which, as our submission to the House Public Safety and National Security Committee notes, can take over a year and is therefore rarely used.

These companies argue that only their United States parent controls the data. But this is a self-imposed limitation, not a legal one—and it should not be permitted to leave children at risk by denying investigators access to information that has already been judicially authorized in Canada. The U.S. CLOUD Act requires American firms to produce data stored anywhere in the world when served with a valid U.S. order. Canada should adopt the same principle.

If Parliament does not fix this, the most important evidence in child exploitation cases will remain effectively out of reach.

Require ISPs to retain subscriber records long enough for police to act

When investigators identify an IP address linked to child exploitation, they must obtain the subscriber information. But some internet service providers (ISPs) purge those records in as little as 30 days—far faster than the timeline of a typical investigation.

Once records are deleted, investigators cannot identify an offence location or a suspect, and the incident goes unsolved.

Bill C-22 requires companies to preserve certain metadata, including IP addresses, for up to 12 months. But without matching subscriber records, those IP addresses are meaningless. Parliament must require ISPs to retain subscriber information for at least 18 months so investigators can identify the predators harming our children.

Allow police to search individuals found at a warrant location

Under current law, if police execute a search warrant at a home, they cannot search the people inside—even if officers reasonably believe someone is holding a phone or hard drive authorized for seizure. If a device is in a pocket or even in someone’s hand, it is legally out of reach.

To obtain the device, officers must rely on a different authority and apply for a second warrant. This serves no real privacy purpose and simply slows investigations.

Bill C-22 should mirror the Controlled Drugs and Substances Act and allow officers to search individuals on site when there are reasonable grounds to believe they are concealing items listed in the warrant.

Modernize the rules for detaining seized devices

Digital forensics takes time—sometimes months. Yet, the law only allows police to hold seized property for 90 days before seeking an extension through a confusing and cumbersome process.

Extending the initial detention period to 120 days and simplifying extensions through an ex parte process would reflect the realities of modern investigations and reduce unnecessary administrative delays.

Protect exigent requests from being disclosed to suspects

Bill C-22 expands the ability of police to obtain subscriber or tracking data in emergencies. But it does not prevent telecom companies from immediately notifying the suspect—giving them hours to destroy evidence or harm a child.

The fix is simple: prohibit disclosure of exigent requests for seven days. This narrow, temporary restriction protects victims without undermining due process.

Parliament is close, but the job isn’t finished

OCSEIA applauds the government for taking action that is long overdue. Bill C-22 is a strong foundation that will finally provide investigators with 21st-century tools rather than the 20th-century ones they are forced to rely on today.

The expertise exists. The solutions are practical. And the stakes—the safety of our children—could not be higher.

If Parliament wants this bill to truly deliver on its promise, now is the moment to close the remaining gaps. The amendments we are proposing will strengthen legislation that addresses our shared imperative: protecting children from online predators who are too often one step ahead.

Andrew Ullock is the chairman of the Ontario Child Sexual Exploitation Investigators Association. 

The Hill Times