Canada parliament passes cybersecurity bill amid privacy concerns

The Canadian Senate on Thursday passed Bill C-8, introducing a mandatory cybersecurity framework designed to protect critical infrastructure across the country’s telecommunications, finance, energy, and transportation sectors against emerging threats.

The legislation achieves its objectives by amending the existing Telecommunications Act and enacting the new Critical Cyber Systems Protection Act.

The amendments to the Telecommunications Act grant the Governor in Council and the Minister of Industry new authorities to actively secure national networks. These powers include the ability to issue binding administrative orders to major telecommunications service providers. Specifically, the government can prohibit the use of products from specified suppliers and mandate the removal of high-risk equipment from domestic networks. The bill also enforces strict regulatory compliance by introducing monetary penalties for non-compliant operators.

Concurrently, the Critical Cyber Systems Protection Act establishes a formal framework to safeguard critical operational systems and services that are vital to national security and public safety.

However, the legislation’s progression through the House of Commons and the Senate has drawn persistent concerns regarding user privacy. The Office of the Privacy Commissioner of Canada warned of several outstanding privacy risks, pointing out that the legal thresholds for exercising these new government powers remain too broad. The Commissioner also criticized the lack of a mandatory mechanism to notify their office of major cybersecurity breaches and highlighted inadequate minimum privacy standards for sharing information with foreign governments.

Echoing these concerns, the University of Toronto’s interdisciplinary research laboratory, Citizen Lab, formally submitted an expert assessment to the relevant standing committee, emphasizing that the legislation still lacks necessary operational safeguards.

Having successfully cleared its final reading, Bill C-8 is currently awaiting royal assent to officially pass into Canadian law.