The new Liberal government has tabled its first bill in Parliament, the Strong Borders Act, or Bill C-2. Buried within it are several new powers that give police easier access to our private information.

The bill responds to recent calls to beef up the enforcement of our border with the United States. It gives customs and immigration officials new powers: to search items being exported, like potentially stolen vehicles, and to deport migrants believed to be abusing Canada's refugee protections.

But while facing pressure from the U.S. to act, the Canadian government is using the apparent urgency of the moment to give police and intelligence agents a host of new powers to search our private data - powers that have nothing to do with the border.

Some of them are already controversial and will no doubt be tested in the Supreme Court of Canada, if and when they're passed. But many have also been on the wish list of previous governments, as part of "lawful access" bills that would make it easier for police to obtain details about a person's online activity in cases involving child pornography, financial or gang-related crime.

Why now? Why make another attempt to lower the barriers to police access to private data? And what is the controversy over these new powers?

The Charter of Rights and Freedoms protects the right to privacy of anyone in Canada. Police need authority - explicit permission set out somewhere in the law - to carry out a search or seizure of our private data for an investigative purpose.

A law that allows police to do this must itself be reasonable, in the sense of striking the right balance between law enforcement and individual privacy.

For the first 20 years of the web, it wasn't clear what the police could or couldn't do to gather information about us online.

The Supreme Court held in 2014 that when police ask Shaw or Telus to give them a name attaching to an online account, this amounts to a search. While a person's name and address may not reveal much on its own, the court held, it opens a door to something very private: a person's entire search history.

But the court in that case did not decide what kind of power police needed to make this demand, only that police need permission in law to make it.

In 2024, the Supreme Court held that when police ask for an internet protocol (IP) address linked to a person's online activity, even that is private because it can open a window onto a lot more personal information.

Police have been using warrant provisions in the Criminal Code to make a demand for an IP address, or the name and address linked to an online account. To get a warrant, in most cases, they need to show a judge they have reason to believe a crime has been committed that is linked to the account - in other words, they must show probable cause.

Police have complained about how difficult this can be in some cases. They've long been calling for more tools.

The Strong Borders Act makes it easier for police and other state agents in a few ways.

It will be easier to get a warrant because the new bill allows police to ask service providers like Shaw or Telus - without a warrant - whether they have information about an IP address or a person's account.

To then obtain that information, police need a warrant - but on the lower standard of reasonable suspicion of a crime, instead of probable cause. This can also apply to foreign entities like Google or Meta.

Canadian Security Intelligence Service agents can ask a provider like Shaw or Google whether they have information about an account holder on no grounds at all. But in this case, the person of interest can't be a citizen or a permanent resident.

More concerning are powers in the bill compelling companies like Google or Apple, along with Shaw and Telus, to assist police in obtaining access to private data.

Any company that provides Canadians with a service that stores or transmits information in digital form - pretty much anything we do on a phone or computer - can be ordered to help police gain immediate access to our data.

The bill does this by stipulating that a company can be told to install "any device, equipment or other thing that may enable an authorized person to access information."

There are important limits on this. Police can only gain access if they have a warrant or other lawful permission. And a service provider need not comply with any order that would "introduce a systemic vulnerability," like compelling them to install a backdoor to encryption.

But the point is that these new powers compel companies to implement "capabilities" for "extracting... information that is authorized to be accessed." They turn the brands we have an intimate relationship with - gmail, iCloud, Instagram and many others - into tools of the state.

For some of us, the thought that Apple or Google can now be conscripted to serve as a state agent to facilitate ready access to private data is unsettling. Even if there are safeguards.

Courts will have to decide at some point whether searches conducted under these new powers strike a reasonable balance between law enforcement and personal privacy. Courts have held that our privacy interest in personal data is high.

Whether police interest in quicker and easier access to that data in certain cases is equally high is an open question. But one thing is clear: it doesn't seem to have much to do with the border.