Thank you.
5. The main submissions in this brief are set out in two parts:
a. Part 2: Bill C-26 and the Canadian Charter of Rights and Freedoms (“Charter”):
Part 2 of this Brief discusses the nexus between Bill C-26 and the Charter. It focuses, in particular, on how Bill C-26 may impact equality rights (Section 15), freedom of expression (Section 2(b)), and privacy (Section 8). The Charter implications of the proposed legislation should be a central consideration for this Committee, and throughout the Parliamentary process ahead.
I'll just put a pin in that, Mr. Chair. That's something that we'll want to discuss going forward as well—whether we want to link to a bill that is implied here could be violating numerous sections of the charter.
It continues:
b. Part 3: Recommendations for amendment to Bill C-26: “Cybersecurity Will Not Thrive in Darkness” provides substantive analysis and recommendations to address a series of thematic deficiencies identified in Bill C-26. We agree that these recommendations are appropriate in the spirit of addressing overarching deficiencies, including secrecy and transparency issues, and the need to incorporate guardrails for the new government powers that the Bill creates. As a result, Part 3 provides a summary of Dr. Parsons' recommendation, as well as comments and supplementary recommendations flowing from the Charter analysis in Part 2.
The next part is headed “Part 2. Bill C-26 and the Charter: Towards a Human Security Approach to Cybersecurity”. It continues:
6. In analyzing the proposed amendments to Canada's Telecommunications Act in Bill C-26, Dr. Parsons identified the following thematic deficiencies in the proposed legislation:
The breadth of what the government might order a telecommunications provider to do is not sufficiently bounded.
Excessive secrecy and confidentiality provisions in the bill threaten to establish a class of secret law and regulation.
Significant potential exists for excessive information sharing within the federal government as well as with international partners.
Costs associated with compliance with reforms may endanger the viability of smaller providers.
Vague drafting language means that the full contour of the legislation cannot be assessed.
There is no recognition of privacy or other Charter-protected rights in Bill C-26 as a counterbalance to the proposed security requirements, nor are appropriate accountability or transparency requirements imposed on the government.
7. These thematic deficiencies relate to the effectiveness of the government's cybersecurity strategy as well as to potential risks to Charter-protected rights. Like the Canadian Radio-television and Telecommunications Commission (“CRTC”), the federal government must act in a manner that is consistent with the Charter when regulating in respect of the telecommunication services and cybersecurity.
8. Following the publication of Dr. Parsons' report in October 2022 (including his recommendation that the federal government table a Charter statement in relation to Bill C-26), the federal government tabled its Charter Statement in the House of Commons on December 14, 2022. The “non-exhaustive” statement identifies areas where Charter-protected rights are engaged by Bill C-26. The statement, however, does not fully address relevant Charter-related issues linked to Bill C-26. In the following paragraphs...we raise additional Charter issues to, first, inform the appropriateness of amendments recommended by Dr. Parsons and, second, to underscore the importance of bringing a human rights and human security approach to cybersecurity and the regulation of telecommunications services.
Equality Rights and Section 15 of the Charter
9. This section identifies examples of equality-related issues that could foreseeably arise during the government’s implementation of Bill C-26.We raise the potential for adverse impacts in the implementation of orders and regulations under Bill C-26 in order to provide guidance to this Committee about the importance of ensuring that the transparency and accountability mechanisms surrounding Bill C-26 are fit-for-purpose to guard against foreseeable risks. As noted in paragraph 6, accountability and transparency gaps are a thematic deficiency in Bill C-26, which are the subject of recommendations throughout Part 3 of this brief.
10. In 2019, the federal government passed the Accessible Canada Act.... The Act recognizes the importance of the economic, social and civic participation of all persons in Canada, and to allow all individuals to fully exercise their rights and responsibilities in a barrier-free Canada. The Act notes equality and non-discrimination rights protected under the Canadian Charter of Rights and Freedoms, and the Canadian Human Rights Act, which are implicated by laws and public policies affecting the accessibility of telecommunications services.
Access to affordable, high-quality telecommunications services is unevenly available in Canada. Government measures that have the effect of exacerbating the “digital divide” for Charter-protected groups may result in discrimination under section 15 of the Charter. If Orders in Council, Ministerial orders, or regulations issued under Bill C-26 are implemented in a manner such that disadvantaged communities are disproportionately exposed to security vulnerabilities, or disproportionately unable to access network services, it perpetuates the disadvantage experienced by Charter-protected groups, thus engaging section 15 of the Charter.
The following are examples of equality-related issues that are foreseeable when considering the types of orders or regulations that may be imposed under the broad powers proposed in Bill C-26:
a. Firstly, barriers to affordable telecommunications services place a particularly heavy toll on low-income communities in Canada. There is a close connection between poverty and the historical disadvantage that is experienced by groups protected by s. 15 of the Charter. As a result, government orders or regulations that impose material costs on telecommunications services may result in heightened barriers to access, which would disproportionately affect historically disadvantaged communities.
b. Secondly, government orders or regulations that hinder efforts to redress regional disparities in access to telecommunications services in Canada, such as disparities between Indigenous communities and the rest of Canada when it comes to accessing high-speed internet services, can also disproportionately affect Charter-protected groups under s.15.
c. Thirdly, persons living with disabilities may also be impacted in unintended but foreseeable ways by orders and regulations issued under Bill C-26. For example, measures that slow the availability of secure network services may slow or impede secure access to assistive technologies enabled by connected homes or communities. As another example, orders or regulations that mandate the deployment of certain cybersecurity measures could bind companies to cybersecurity tools that are not accessible. While physical environments are more traditionally integrated into accessibility and inclusivity frameworks, cybersecurity tools often assume “that users are fully abled (e.g. can see the CAPTCHA), cognitively unimpaired (e.g. can create and retain passwords), have the necessary resources (e.g. time, appropriate technology and internet access in a distraction-free environment), and have the required dexterity to interact with the security system (e.g. can use the mouse and keyboard with ease).”
Fourthly, network insecurity and privacy risks also expose certain groups to heightened threats. Civil society, including dissidents, journalists, opposition politicians, lawyers, and family members are routinely exposed to targeted threats, hacks, and digital espionage. If governments and regulators fail to address persistent vulnerabilities in our network services—including the widespread abuse of telecommunications networks described in “Finding You”—certain groups (including communities protected by section 15) may be disproportionately left in harm’s way. As an alternative hypothetical, cybersecurity measures mandated through orders or regulations could lead to the unintended creation of new or worsening security flaws. Dr. Parsons provides the example that “in the process of prohibiting an upgrade, known-good security patches, hardware upgrades, or service offerings in the same update package might also be blocked.”
13. Ultimately, these tensions highlight the overarching importance of inclusivity in setting security standards, and the corresponding importance of regulating telecommunications in a transparent and accountable way that enables the government’s cybersecurity approach—
