Bill C-22, the lawful access bill, was a focal point of debate in the Senate last week. While companies continue to warn they may exit Canada if the bill passes in its current form, the debate’s biggest revelation was that it may take years for the government to pass the regulations needed to fully implement the law. The delay is notable for several reasons, including the government’s insistence in the spring that passing the bill was urgent (to the point that it shut down committee clause-by-clause review) and the regulatory uncertainty that it creates. Indeed, the Senate is effectively being asked to approve a surveillance and data retention framework without knowing who will be covered, what they will be required to build, what data about Canadians will be retained, or what any of it will cost. If this sounds familiar, it is because it has seemingly become the government’s go-to approach on many of its digital bills, from privacy to social media regulation, where key decisions are left to regulations and regulatory processes that take years to complete.