The Filing Cabinet

Two arms of the same government looked at the same thing and wrote down two different definitions of it. In March 2024 the Supreme Court of Canada held that your IP address is private — “the key to unlocking a user’s Internet activity and, ultimately, their identity” — and that the police need a warrant to get it. In 2026 the government tabled a bill whose Charter statement calls the same class of identifier “not particularly sensitive,” reachable on a lower standard: “reasonable grounds to suspect.” The minister described the new apparatus as “like a filing cabinet.” This case is about that gap — the distance between two official definitions of one datum, and the office-furniture word stretched across it to make the lower one sound like housekeeping.

§01 — The move named

The temptation is to read Bill C-22 as a fight about surveillance — too much power, or not enough — and to pick a side. That argument is real, and it is not the one this series runs. Strip the politics out and a familiar grammar remains: the definitional dodge first named at policy scale in Case 21 · The Definition, here run not on a word in a handbook but on a category of evidence. The move is to take a thing the law already defines one way and quietly re-file it under a cheaper definition — then build the machinery before anyone forces the two definitions back into the same room.

Name the structure before the evidence. A single category of data — the subscriber and IP records that link a person to their online activity — is being given, by one government, two legal weights at once. Case 22 showed a compulsion addressed in the vocabulary of a favour; this is a privacy interest the country’s highest court has already recognized, addressed in the vocabulary of a stationery cupboard.

• P1 The investigative need is real: police and intelligence services face genuine friction getting data tied to serious crime, and some modernization is defensible. Grant it in full (§05).
• P2 The same data the bill reaches — IP and subscriber identifiers — is what the Supreme Court, in R. v. Bykovets (2024), defined as privacy-attracting and warrant-requiring.
• P3 A real need (P1) does not change what the data is (P2). Necessity is an argument for a warrant; it is not a reason the datum stops being sensitive.
• P4 The bill writes the lower definition of the data into statute — “not particularly sensitive,” reachable on “reasonable grounds to suspect” — and offers “lawful access” and “a filing cabinet” as if that settles the privacy question it actually steps around. The substitution of the cheaper definition is the laundering.

Counter: when a government tells you a category of data is “not particularly sensitive,” ask who else has ruled on the same category — and whether the new definition is a finding or a convenience.

§02 — The datum, as the Court defined it

Start with the higher definition, because it came first and it is binding. On 1 March 2024, in R. v. Bykovets, 2024 SCC 6, the Supreme Court of Canada held — by a 5–4 majority, Justice Karakatsanis writing — that an IP address attracts a reasonable expectation of privacy, and that a police request for one is therefore a search under section 8 of the Charter, requiring prior judicial authorization.primary

An IP address is the crucial link between an Internet user and their online activity… it is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy.Karakatsanis J., for the majority — R. v. Bykovets, 2024 SCC 6

The reasoning matters as much as the result. The Court did not say an IP address is sensitive because of what it spells on its own; it said the identifier is sensitive because of what it unlocks — the trail of activity, and through it the person. That is the same logic the digital-rights group the Electronic Frontier Foundation puts plainly: metadata “can reveal a lot about who you communicate with, where you go, and when you do so.” The EFF’s illustration — that a pattern of visits could expose a pregnancy, or a person seeking gender-affirming care, to anyone who reads the pattern — is theirs, named and attributed; the point this case takes from it is narrower and is the Court’s own: the value of the identifier is the door it opens.analysis

Note the split: 5–4. This is a contested holding, not a unanimous one; four judges would have dismissed the appeal. Reported honestly, that cuts both ways — it is the law of the land, and it was a close call. Either way, it is the definition the state itself arrived at, in its highest court, for this exact category of data.

Counter: a precedent that was 5–4 is still the precedent. “It was close” is a reason to legislate carefully, not a licence to legislate around it.

§03 — The datum, as the bill defines it

Now the lower definition. Bill C-22, the Lawful Access Act, 2026 — introduced 12 March 2026 by Public Safety Minister Gary Anandasangaree, passed second reading on 20 April, and currently before the Standing Committee on Public Safety and National Security (SECU) — would, among other things, ease access to subscriber information and require “core” providers to retain certain metadata for periods not exceeding one year. The Department of Justice’s own Charter statement sets out the standard, and the standard is the tell.primary

The subscriber information sought does not by itself constitute particularly sensitive information, since it is limited to information that identifies clients and services, and does not include the contents of communications… The “reasonable grounds to suspect” standard is a recognized threshold for searches in the criminal context.Department of Justice — Charter Statement, Bill C-22 (justice.gc.ca)

Lay the two definitions side by side. They are descriptions of the same category of data, written by the same state, eighteen months apart.

The disagreement is not factual; both sides know what an IP address does. It is definitional. The Court located the privacy interest in the linkage the identifier creates; the bill locates the (absence of) sensitivity in the identifier read in isolation, “by itself” — precisely the in-isolation reading the Court declined to adopt. Writing the in-isolation definition into law is what lowers the threshold. The lower threshold is the point.primary

The Court said the key is sensitive because of the door. The bill says the key is just a key.

Counter: read the two sentences as one government talking to itself. When the courtroom definition and the committee-room definition of the same datum diverge, the gap is not a detail — it is the mechanism.

§04 — The tell: the filing cabinet

Every laundering case has a specimen — the single sentence where the reclassification surfaces in plain language. Here it is the minister’s. Asked to describe what the bill builds, the government likened it to office furniture: the changes would give investigators an organized system “like a filing cabinet, where certain types of information would be available with legal authorization.”primary

The image does two jobs at once, which is why it is the tell. It makes a mandatory, standing, provider-built retention system sound like a thing every office already has — domestic, inert, familiar. And it relocates the safeguard into the phrase “with legal authorization,” as if authorization were an external check rather than the very thing the bill is writing. That is the circularity opponents seized on: the legislation supplies the legal authorization, on a standard the same legislation lowers. The permission slip is printed by the office it admits you to. Before SECU, witnesses put the counter bluntly: democracies do not keep a filing cabinet of every citizen’s sensitive information on the chance it proves useful to police or spies.primary

And the title does its own quiet work. An Act respecting lawful access pre-loads the verdict: the access is “lawful” because the Act makes it so, and the word is then available to answer the very objection it begs. Naming is the first definitional move; Case 21 showed it done to a contested term, and Case 19 showed a record sanitized by the words chosen to file it. “Filing cabinet” and “lawful access” are the same device pointed at a category of data: the vocabulary that carries the cheaper definition past the ear.

Counter: a metaphor is an argument wearing casual clothes. When a minister reaches for furniture to describe a power, ask what the power does when you take the furniture away.

§05 — The strongest version of the other side

The discipline of this series is to build the other side’s case at its strongest before locating where it fails. So: the government’s position is not frivolous, and parts of it are correct. Serious investigations do stall on data held by providers who have no standard way to respond; a metadata record is genuinely not the content of a message; subscriber information really does, on its face, look like a name attached to a service. The bill keeps judicial authorization in the loop for many demands, and the government has said it will amend the bill to make clear that it does not require breaking encryption — that it is, in its phrase, “encryption neutral.” A reasonable person can hold that lawful-access rules need modernizing for an internet the existing statute never imagined.primary

Grant all of it. The narrow claim survives anyway, because none of it answers P2. That investigations are hard is an argument for a warrant on reasonable grounds — the Bykovets standard — not an argument that the datum has become less sensitive. “Not content” is true and beside the point: the Court’s holding was precisely that the non-content identifier is sensitive anyway, because of what it unlocks. The strongest version of the government’s case establishes that the access may be justified; it does not establish the lower definition the bill uses to make the access easy. Justification belongs at the threshold, in front of a judge, case by case. The bill puts it in the definition, once, for everyone.

Counter: the honest form of the government’s argument ends in a warrant standard, not a lowered one. Watch for the slide from “we sometimes need this” to “so it isn’t sensitive.”

§06 — What is left to be defined later

A definitional dodge has a second move available: don’t define the contested term at all in the part everyone reads — defer it to where fewer people look. Critics of C-22 argue that much of its real shape is left to be filled in later, through regulation made by the governor-in-council, an appointed body, rather than written into the Act and debated. That is the same deferral named in Case 26: the load-bearing parameter set after the vote, in a register with less light on it. Whether that characterization holds turns on the regulation-making provisions as enacted, so it is carried here as the critics’ reading, attributed and flagged.verify

Two further structures the critics point to belong to families this series has already mapped — and the bill’s first-reading text bears them out. First, ministerial orders: under section 7, “the Minister may make an order with respect to an electronic service provider… whether or not the provider is a core provider,” with the Intelligence Commissioner as the check — a commissioner appointed on the government’s recommendation. Second, secrecy: section 15 bars a provider from disclosing even “the fact that the electronic service provider is subject to the order.” That is the Case 29 sealed channel in a new statute: the order exists, acts on you, and cannot be spoken of. (First-reading text of the new Act in Part 2; committee may amend.)

And the international note: the United States — whose own lawful-access regime industry observers describe as narrower, not reaching “electronic service providers” or mandating year-long metadata retention — has been a source of pushback. In a May 2026 letter, two U.S. congressional committees warned the bill would force companies to choose between compromising their users’ security and leaving the Canadian market, and that “these pressures will fracture global cybersecurity norms and weaken our collective defenses.” Signal has said it would withdraw from Canada rather than comply: its VP of strategy and global affairs, Udbhav Tiwari, said the company “would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users,” adding that “end-to-end encryption is incompatible with exceptional access, no matter how creative the route taken to achieve it.” NordVPN and others have signalled the same.primary

Counter: “the details will be set in regulation” is not reassurance; it is a description of where to look next. A power you cannot read in the Act is still a power.

§07 — The datum, named

Strip it to the structure, and no villain is required. A government has a real problem — data tied to crime, held by providers, hard to reach. It has a binding definition of that data, written by its own Supreme Court: sensitive, warrant-bound. And it has a bill that needs the data to be cheaper to reach than that definition allows. So the bill supplies a second definition — “not particularly sensitive,” reachable on suspicion — names the whole apparatus “lawful access,” and describes it as “a filing cabinet.” Each step reads as housekeeping. The integration is a category of evidence the courtroom calls private and the committee room calls furniture, with the difference written into law where it lowers a threshold.

That difference is the laundering, and naming it does not require adopting the louder claims around it. The critics’ verdict — that C-22 is mass surveillance, that it makes Canada “no better than Russia” — is a real position, argued by serious people, and it is carried here as a named lens, not as this case’s finding. The opposite lens is carried too: that this is overdue modernization, judicially supervised, encryption-neutral. The series does not adjudicate between them. It only insists that the adjudication happen on the true definition of the data — the one the state already wrote down once, under oath, in a courtroom — rather than the convenience definition written into the bill and dressed as office furniture.analysis

It sits beside Case 21’s definitional dodge, Case 22’s compulsion-as-favour, Case 26’s deferral to the dark, and Case 29’s sealed channel. When the next power arrives described as a piece of furniture — a cabinet, a ledger, a registry, a folder — do the one thing the metaphor is built to prevent. Find the definition the same state already gave the thing somewhere it was under oath, and hold the new one against it. If they match, the furniture is honest. If the courtroom calls it a key and the committee room calls it a cabinet, you are not looking at storage. You are looking at the wash.

The courtroom called it a key, because of the door it opens. The bill calls it a filing cabinet. Same datum. Two definitions. One of them lowers a threshold.