Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, proposes changes to the Telecommunications Act and would create the Critical Cyber Systems Protection Act. Its stated goal is to protect telecommunications and critical cyber systems and support the continuity and security of vital services; that is a goal, not a guaranteed result. If enacted, the provisions would work as follows:
The Governor in Council and the Minister could make security orders for telecommunications providers, including orders about products, services, networks, security plans and other specified actions. Orders must meet tests of necessity and reasonableness in relation to a threat.
The bill would give the Minister powers to require information and allow specified officials and bodies to collect and share information for security and compliance purposes, subject to limits and confidentiality rules.
The Governor in Council could add vital services and operator classes to schedules under the proposed Critical Cyber Systems Protection Act. Operators in a listed class that own, control or operate a critical cyber system would have to follow the Act and regulations.
Those operators would have to establish and maintain cyber security programs, address supply-chain and third-party risks, report incidents within a period set by regulation (no more than 72 hours), and comply with security directions.
The bill would create inspections, audits, compliance orders, administrative penalties and offences. It also requires a review of the Act within five years after Royal Assent.
Telecommunications providers: The Governor in Council could prohibit use of products or services supplied by a specified person, or require their removal from some or all of a network or facility. The Minister could also restrict or suspend services to specified persons; suspending service to an individual is allowed only to address a specified technical threat. Other possible orders include requiring network or procurement reviews, security plans, vulnerability assessments or mitigation, standards or backup systems, and action on service agreements or upgrades. Providers would not be entitled to compensation for financial losses resulting from these orders.
Operators in designated classes: If the Governor in Council adds a class to Schedule 2, an operator in that class that owns, controls or operates a critical cyber system would have to establish a program within 90 days of joining the class, unless an extension is granted. It must maintain the program, mitigate identified supply-chain and third-party risks, report incidents to the Communications Security Establishment and regulator, and keep records.
Businesses and individuals subject to these rules: The bill provides for administrative penalties and, for specified contraventions, criminal offences. Not every breach carries the same consequences: regulations would identify some administrative violations. For the proposed cyber-systems law, administrative penalties could reach $500,000 for an individual and $15 million for another person or organization. Some offences could carry imprisonment for individuals.
General public: The bill does not directly create a new public cyber-security service or a general right to compensation. It sets limits on certain information sharing and preserves privacy-law protections, but also permits some sharing of confidential or personal information when specified security conditions are met.
No publicly available information on the bill’s total public cost, expected savings or overall business compliance costs.
The bill would require operators to create and maintain programs, report incidents, keep records and comply with directions. These duties may involve costs, but no estimate is provided.
It gives regulators and officials inspection, audit and enforcement powers; no staffing or enforcement-cost estimate is provided.
The telecommunications orders described in the bill would not entitle affected providers to compensation for resulting financial losses.
The bill allows the Canadian Nuclear Safety Commission to charge prescribed fees for certain information, products or services under another federal Act. The fee amounts are not stated.
The supplied material does not list the proposed Schedule 1 vital services or Schedule 2 operator classes. The Governor in Council could also change those lists later.
Regulations would set important details, including cyber-program requirements, incident-reporting periods, record rules and which breaches carry administrative penalties.
The supplied material does not state when the main security provisions would start. It says the consequential amendments would start on dates set by Governor in Council order.
The bill allows some orders to restrict disclosure of their existence or contents. The supplied material does not explain how often that power would be used or what information would be withheld in practice.
The bill requires a five-year review, but its effectiveness cannot be known from the bill text.
A possible argument for the bill is that it creates duties to identify and address cyber risks, including risks from suppliers and third parties, before incidents disrupt vital services.
Requiring incident reports within a set period, capped at 72 hours, could help officials and regulators respond sooner.
The order powers are tied to stated tests of reasonable grounds, necessity and reasonableness. The bill also requires consideration of operational, financial, privacy and public-safety impacts in specified cases.
The bill includes reporting to Parliament, privacy-related limits and restrictions on orders requiring the decoding or interception of specified private communications.
The Governor in Council and the Minister would receive broad powers to direct telecommunications providers, while some orders could be kept secret and affected providers would not receive compensation for resulting financial losses.
The new operator duties may be costly and demanding. The bill does not set out all program requirements or provide a cost estimate; regulations would fill in key details.
Some enforcement orders must be followed while a review is pending, and some can be made outside the Statutory Instruments Act. This could leave operators with limited time to challenge an order before complying.
The bill permits information sharing, including some confidential and personal information, for security purposes. Its safeguards may not fully answer how much information would be shared in practice.