Bill Detail
An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts ✓ Became Law
Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
authorizes the Governor in Council to designate any service or system as a vital service or vital system;
authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
provides for the exchange of information between relevant parties; and
authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
Bill C-8, now law, strengthens Canada's cybersecurity. It updates the Telecommunications Act to make securing our communication networks a key objective, allowing the government to issue directives to service providers and imposing penalties for non-compliance. This part aims to protect the networks Canadians rely on daily.
Furthermore, it introduces the Critical Cyber Systems Protection Act. This law establishes a framework to protect essential services and systems vital for national security and public safety, such as those in energy, finance, and transportation. Operators of these critical systems will face new obligations, including implementing cybersecurity programs, managing supply chain risks, reporting incidents, and following government directions, with penalties for failure.