The Reading Order

Three government bills are moving through Parliament at the same time. One would require platforms to establish how old their users are. One would rewrite the rules governing what companies may do with personal data, and move the office that enforces them. One would require providers to retain metadata and to build and maintain a standing technical capability for state access. Each has its own sponsor, its own department, its own committee, its own critics, and each will be argued on its own merits. There is nothing improper in that; it is how Parliament is built. But set the three side by side and they settle, between them, every question you would ask about an information architecture: what data comes into existence, who may use it and on what permission, how long it is kept, whether systems are designed to be opened, who may reach in, who regulates, and who watches the regulator. No committee is handed that question, because the question is not a bill. And the order in which they finish inverts the order in which they were assembled. The access layer was tabled first and has already cleared the House. The two bills that create and govern the data it would reach have not yet reached a committee.

§01 · The three files, at their best

Take each one on the terms of the people advancing it, because each of those terms is defensible and the case does not need them to be otherwise.

Bill C-34, the Safe Social Media Act, tabled 10 June 2026 by the Minister of Canadian Identity and Culture.record It regulates social media services, chatbot services and other regulated online services, sets a minimum account age of sixteen, and creates a Digital Safety Commission of Canada to write the rules, take complaints, audit, order compliance and fine, to the greater of ten million dollars or three percent of gross global revenue, and twenty million or five percent for the most serious offences. The goal is real. Children are harmed on these services and the harm is documented.

Bill C-36, the Protecting Privacy and Consumer Data Act, tabled 15 June 2026 by the Minister of Artificial Intelligence and Digital Innovation.record It replaces PIPEDA, which has governed private-sector personal data since 2000. It adds documented privacy impact assessments, disposal duties, an assessment requirement before personal information is transferred outside Canada, real penalties, and a private right of action for people harmed by a contravention. Anyone who has watched a Canadian privacy complaint end in a recommendation with no consequence can see why a government would want this.

Bill C-22, the Lawful Access Act, 2026, tabled 12 March 2026 by the Minister of Public Safety.record It creates a production order for subscriber information, permits metadata retention, and requires electronic service providers to develop and maintain technical capabilities so that lawful interceptions and data production can actually be executed. Investigators do face a genuine problem: an order a provider is technically unable to comply with is an order that does nothing. That is not a pretext. It is the problem the bill is written to solve.

Three good-faith readings, three legitimate goals, three separate rooms. Everything that follows takes all of that as given.

§02 · The reading order

Parliament calls its stages readings. Here is where the three stood on 23 August 2026, from the parliamentary record.record

Read the column on the right in the order the machine is assembled rather than the order the bills are numbered. Collection first: a service establishes who its users are. Governance second: the law says what may be done with what has been collected, and by whom, and for how long. Access last: the state reaches into what exists. That is the logical order, and it is precisely the reverse of the parliamentary order. The layer that reaches in is three quarters finished. The layers that determine what there will be to reach into have not had a witness called.

This is a timetable, not a plot, and the distinction matters.analysis C-22 is ahead because it was tabled in March and the other two in June. There is no need to suppose anyone arranged it. But a timetable is exactly the kind of object that no one in the process is assigned to read. A committee reads a bill. The Senate reads a bill. A minister answers for a bill. The sequence in which three bills from three departments will land, and what the sequence means for the ones still behind, belongs to no one's mandate. It is nobody's file, and so it is nobody's objection.

§03 · The seven questions

Any information architecture answers seven questions. Ask them of each bill separately and each gives a partial answer, which is what a bill is for. Ask them of the three together and the architecture appears.analysis

Every cell in that grid is defensible in its own column. The bottom row is the one no single committee will ever see whole. And the grid is not an inference about intent; it is an inventory of what the three texts say.

§04 · Four tensions in the bills' own terms

These are not objections from outside. Each is a tension a supporter of the bill would recognise as a real design question, stated so that they would accept the statement.

One. An age rule requires assessing everyone. A service cannot apply a rule about people under sixteen without establishing the age of the people it serves, and it cannot know which of them are under sixteen without assessing all of them.analysis The restriction falls on a minority; the assessment falls on the whole user base. What methods will be permitted, whether government identification, facial age estimation, or a third-party provider, and what may be retained afterwards, are not settled in the bill. That gap is the tell, and it is the gap where the privacy burden of the entire scheme is decided.

Two. Consent gets more demanding while the exception gets wider. C-36 tightens what must be disclosed for consent to be valid. In the same instrument it provides a legitimate interest ground permitting collection, use and disclosure without consent where the organisation's interest outweighs any reasonably foreseeable adverse effect and a reasonable person would expect the activity, supported by a documented assessment; and a business activities ground for listed purposes.reported Its predecessor, C-27, limited the equivalent ground to collection and use. C-36 extends it to disclosure. Both movements are real, and they run in opposite directions: the door you walk through with permission gets a longer notice on it, and a second door opens beside it.

Three. Penalties go up while the independent regulator goes out. C-36 raises the consequences of getting it wrong and adds a private right of action, exercisable after a contravention has been established through the regulatory process.reported It also removes the Privacy Commissioner of Canada's jurisdiction over the private sector entirely, reassigning complaints, investigations, audits, codes of practice and penalties to the renamed Digital Safety and Data Protection Commission of Canada, which is the same body C-34 creates to police online content. The archive files the institutional half of that move separately, in The Merged Office. The design question here is narrower and answerable: within one commission that investigates, enforces, makes rules, handles complaints and adjudicates, what firewalls separate those functions, and are they described anywhere in the text?

Four. Access by design, beside secure by design. On 22 June 2026 the Five Eyes cyber security agencies, Canada's Cyber Centre among the signatories, published a statement whose core principle is that "secure-by-design and secure-by-default must become standard practice, not an aspiration," urging leaders to reduce attack surface by limiting unnecessary access to systems.reported C-22 Part 2 would require providers to build and keep a capability for interception and data production, which the Canadian Bar Association reads as requiring "the existence of a privileged access point within otherwise secure systems."reported This is best read as a conflict between two governmental functions, not as evidence of bad faith on either side: investigators want tools that work, and cyber-defence doctrine wants fewer standing doors. The archive carries it in full, and carries the backdoor dispute as a dispute, in The Two Letterheads.

§05 · The unit of scrutiny

Two moves live in this room, and only one of them is new. Name the older one first, because this Edition stands on it rather than beside it. The Convergence already lays six bills of this Parliament on one table, these three among them, and reads down the columns: power added, body empowered, oversight remaining. The move it names is aggregation. Six bills, each clean on its own page, are never added up, and the dispersal across six separate debates is what keeps the sum off the table. That argument is made, and it is not remade here.

This Edition takes three of those six and makes two narrower claims the aggregate reading does not reach.analysis The first is that these three are not merely pointing the same direction; they are specifying complementary parts of one artifact. A tendency and a design are different objects. Six bills that each expand state capacity share a direction. Three bills that respectively determine what data comes into existence, what may lawfully be done with it, and how it may be reached specify the inputs, the permissions and the access path of a single information system. The seven rows above are not a summary of a direction. They are a specification with three authors who have never sat in the same room.

The second is that the process has no unit larger than the bill, so it can neither add them, which is The Convergence's point, nor order them, which is this one's. Parliamentary scrutiny is organised around a document. A bill goes to the committee whose subject matter matches its department; witnesses are called on that bill; amendments are moved to that bill; a minister answers for that bill. The system is good at the question is this bill sound. It has no chair, no clerk and no standing order for the question in what order will these finish, and does the order matter. Here it does, because the layer that reaches in is the one three quarters through.

Compare the partition already on file in this archive. In The Two Letterheads the separation runs between agencies: one office co-signs a doctrine against standing vulnerabilities while another compels one, and the two statements are never required to lie on the same desk. This Edition is the same instrument moved up one level. There the partition is between offices. Here it is between bills, which is the harder one to see, because a bill boundary does not look like a wall. It looks like tidiness. It looks like exactly what a legislature is supposed to do.

And the archive already knows why the smallest-looking piece is not small. The Filing Cabinet reads the reclassification of subscriber information and metadata as ordinary records, obtainable on the lowest threshold in Canadian law, reasonable grounds to suspect. Content is excluded, which is the reassurance. But the identifier is the key to unlocking their identity, and identifiers combine.reported The question C-22 raises is not what a single subscriber record reveals. It is what can be inferred when subscriber data, retained metadata, and whatever the age-assurance layer of C-34 leaves behind are held by parties who can be compelled, at a threshold set for the least intrusive kind of search.

So the watch list, stated as things to watch rather than things predicted.analysis For C-22, now at first reading in the Senate: which providers can be served with a technical capability obligation, what capabilities can be demanded, whether any independent security testing or court review attaches to the demand, how often a non-disclosure period of up to a year may be used, and whether aggregate transparency reporting is required. For C-34 and C-36, still short of committee: which age-assurance methods are permitted, required or forbidden, and what may be retained afterwards; which services are inside the perimeter and what limits its future expansion; whether the under-sixteen exemption criteria exist before enforcement begins; what separates investigation, rulemaking, complaint handling and adjudication inside the merged commission; and what independence guarantee replaces the one being removed. For all three: whether anything in the fall timetable puts the combined effect in front of a single room before the first of them is finished.

§06 · What this is not

This is not a claim that three bills were coordinated. Three departments, three sponsors, three timetables, and no evidence of a single hand; the structural point survives without one, which is the reason to make the structural point instead. It is not a claim that any of the three goals is a pretext. It is not a prediction that the Commission will abuse its powers, that police will misuse a production order, or that a technical capability will be breached. It is not an argument that Canada should not regulate platforms, should not modernise its privacy law, or should not give investigators workable tools. It is not an encryption-absolutist case; the question whether a capability can exist that only lawful actors can ever use is a genuine dispute among serious people, and it is carried here as a dispute. Bill C-22 is not law. The Senate may amend it. Committees may amend the other two. Everything in the fall could go differently from every direction this Edition points.

The claim is one sentence. Three bills that between them determine what personal data exists, who may use it, how long it is kept, whether systems are built to be opened and who regulates all of it will each be examined only against itself, in a process that has no procedure for examining the thing they make together, while the one that reaches in finishes first.

You do not need a plan for that. You only need three good bills and a calendar.