The House is on summer break, scheduled to return Sept. 15

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

This bill is from the 44th Parliament, 1st session, which ended in January 2025.

Sponsor

Marco Mendicino  Liberal

Status

At consideration in the House of Commons of amendments made by the Senate, as of Dec. 5, 2024
(This bill did not become law.)

Summary

This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
This Part also makes a consequential amendment to the Canada Evidence Act .
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, an excellent resource from Parliament. You can also read the full text of the bill.

Bill numbers are reused for different bills each new session. Perhaps you were looking for one of these other C-26s:

C-26 (2021) Law Appropriation Act No. 6, 2020-21
C-26 (2016) Law An Act to amend the Canada Pension Plan, the Canada Pension Plan Investment Board Act and the Income Tax Act
C-26 (2014) Law Tougher Penalties for Child Predators Act
C-26 (2011) Law Citizen's Arrest and Self-defence Act

Votes

March 27, 2023 Passed 2nd reading of Bill C-26, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Debate Summary

line drawing of robot

This is a computer-generated summary of the speeches below. Usually it’s accurate, but every now and then it’ll contain inaccuracies or total fabrications.

Bill C-26 addresses cybersecurity by amending the Telecommunications Act to prioritize security within the Canadian telecommunications system and creating a new Critical Cyber Systems Protection Act. It grants the government power to direct telecommunications service providers and compels designated operators in key sectors to establish cybersecurity programs and report incidents. The bill aims to protect critical infrastructure from cyber-attacks, while concerns have been raised regarding privacy rights, business impacts, and the breadth of the government's new powers.

Liberal

  • Supports cybersecurity bill C-26: Liberal members of parliament voiced strong support for Bill C-26, emphasizing that cybersecurity is national security. They highlighted the need for both public and private sectors to enhance their defenses against malicious cyber activities and cyber-attacks, ensuring the protection of critical infrastructure and the safety of Canadians.
  • Two main objectives: The bill aims to amend the Telecommunications Act to include security as a policy objective, aligning the telecommunications sector with other critical infrastructure sectors. Additionally, it introduces the Critical Cyber Systems Protection Act (CCSPA), requiring designated operators in finance, telecommunications, energy, and transportation to protect their critical cyber systems through cybersecurity programs, risk mitigation, incident reporting, and compliance with cybersecurity directives.
  • Commitment and investment: The Liberal party underlined their ongoing commitment to investing in cybersecurity and demonstrated the government's dedication to increasing the cybersecurity baseline across Canada, ensuring national security and public safety for all Canadians. The members cited significant investments to date, which include a national cybersecurity strategy, the creation of the Canadian Centre for Cyber Security, and increased RCMP enforcement capacity.
  • Focus on 5G security: Members highlighted the importance of addressing security vulnerabilities associated with the rollout of 5G technology. The bill aims to prohibit the use of products and services from high-risk suppliers in Canadian telecommunications systems, aligning with actions taken by allies to safeguard telecommunications infrastructure from potential threats.

Conservative

  • Supports moving to committee: While highlighting concerns around privacy and the impact on businesses, Conservatives will support sending the bill to committee to hear from experts and propose amendments.
  • Significant government overreach: The Conservatives express concern about the broad and sweeping powers granted to the Minister of Industry, allowing them to direct telecommunications service providers to do or refrain from doing anything, potentially without financial compensation for losses, and to exchange confidential information with various government agencies.
  • Privacy and civil liberties: There are concerns about the bill granting sweeping new powers to the government, potentially intruding on the private lives of Canadians, undermining privacy, and lacking sufficient accountability and oversight mechanisms to prevent abuse.
  • Red tape and business impacts: The Conservative Party also raises concerns about the potential for high red tape, the lack of incentives for companies to share best practices, and the absence of a balanced approach that considers both the sticks (penalties) and carrots (incentives) for compliance.
  • Accountability and transparency: There are worries about the lack of transparency in the bill, with concerns that the government could make secret orders without public knowledge, potentially eroding trust in the government due to past instances of hidden information and lack of accountability.
  • Need for cybersecurity framework: While identifying gaps and areas for improvement, members acknowledge the need for a new cybersecurity bill and framework to address foreign state-backed interference and the broader challenges in cyberspace.
  • Government's track record questioned: Conservative speakers express distrust in the government's ability to handle cybersecurity effectively, pointing to past delays and inaction, such as the Huawei decision, and raising concerns about the government's general competence and trustworthiness.

NDP

  • Needs improvement: The NDP agrees that the bill should go to committee, as it is not ready to pass. It lacks detail and accountability mechanisms, and explicitly exempts itself from existing accountability measures.
  • Sweeping powers: The bill grants broad powers to the Minister of Industry and the Minister of Public Safety, including the authority to issue orders to telecommunications service providers and establish classes of operators responsible for cybersecurity programs, but lacks sufficient oversight and safeguards.
  • Balancing security and rights: The NDP wants to see protections for vulnerable groups from cyberattacks, but not with unchecked ministerial powers and without public oversight. The NDP emphasizes the importance of balancing cybersecurity measures with appropriate safeguards to prevent abuse and misuse, ensuring proportionality, and respecting privacy and other rights.
  • Behind on protections: The NDP recognizes the importance of cybersecurity and acknowledges that Canada is behind in its protections and needs to develop stronger frameworks and guidelines. They call for leveraging cybersecurity expertise to assist allies like Ukraine in combating international cyber threats.

Bloc

  • Supports the bill: The Bloc Québécois generally supports Bill C-26, viewing it as a potentially positive step towards adopting a cybersecurity framework and addressing vulnerabilities, especially in light of increasing cyber threats and foreign interference. They will vote in favour of sending the bill to a parliamentary committee to hear from experts.
  • Need for clarification: Members emphasize the need to clarify the bill's potential impact on Quebec, particularly regarding interprovincial power lines (like those managed by Hydro-Québec) and other non-federal infrastructures. The Bloc also wants to ensure that the regulation-making powers granted by the bill are justified and do not bypass Parliament unnecessarily.
  • Proactive vs. Reactive: Several speakers voiced concern that Ottawa is too often in reaction mode regarding cybersecurity threats. They point to long delays in addressing issues like the Huawei 5G network threat and ongoing cyber-attacks on infrastructure like Hydro-Québec.
  • Strengthening trust: Members believe the bill should aim to ensure that citizens can trust the mechanisms protecting them in cybernetics and cyberspace. They argued this trust is built through education, insight, and addressing the vagueness of Canadian foreign policy, and that the bill needs to strengthen trust to protect collective security.
Was this summary helpful and accurate?

Telecommunications ActGovernment Orders

December 1st, 2022 / 3:55 p.m.

Conservative

Damien Kurek Conservative Battle River—Crowfoot, AB

Madam Speaker, cybersecurity cannot be underestimated in its importance, especially in the world in which we live.

One of the concerns that has been highlighted to me, as I listened to security experts surrounding this issue, is how far behind Canada is in taking action on cybersecurity, whether that be the decision regarding Huawei, or how Canada lags behind its Five Eyes partners. Taking action is essential in ensuring that we are on the same playing field.

I am wondering if the member from the government would be willing to expand as to why, after years of being in government, this is only now being debated in the House of Commons.

Telecommunications ActGovernment Orders

December 1st, 2022 / 3:55 p.m.

Liberal

Ryan Turnbull Liberal Whitby, ON

Madam Speaker, I am not really sure how we get these types of critical remarks coming from the opposite side of the House given that in my speech I gave very tangible examples of two agencies that have been set up and some pretty significant investments that have been made since 2018. The $4.8 billion for cybersecurity is no small amount. We are making investments and setting up the systems and tools.

I have been briefed, as a member of the procedure and House affairs committee, on our House of Commons cyber-infrastructure and cybersecurity. Although those briefings were in camera, I know full well that very strong and resilient systems have been set up to identify and neutralize threats ahead of time to ensure our critical infrastructure in the House of Commons is protected. I think that extends right across Canada with the work that our government has been doing.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4 p.m.

NDP

Heather McPherson NDP Edmonton Strathcona, AB

Madam Speaker, I want to take a moment to apologize to the interpreters for when I completely forgot my headset previously. I am not feeling my best, and I am obviously not on my game.

I want to thank my colleague for his intervention today. It was very interesting. I agree with my colleagues from the Conservative Party that we are very late to the game, but I think it is vital that we get it right. It is just so important that we do that balance.

One of the concerns we are hearing from the stakeholders we have spoken to is that this bill has orders that will be exempt from the Statutory Instruments Act. Therefore, it would be unable to be reviewed under scrutiny at the regulations committee. Could the member speak to why the government made that decision?

Telecommunications ActGovernment Orders

December 1st, 2022 / 4 p.m.

Liberal

Ryan Turnbull Liberal Whitby, ON

Madam Speaker, as I am not sure of the specific details the member opposite is referring to in her question, I would have to say, in good faith, that I will get back to her on that after doing a bit more research on why that decision was made.

What I can tell her is that the key provisions in this act really do further the overall objectives of protecting our critical infrastructure. It specifically adds to the Telecommunications Act the objective of the “promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to”—

Telecommunications ActGovernment Orders

December 1st, 2022 / 4 p.m.

The Assistant Deputy Speaker (Mrs. Alexandra Mendès) Alexandra Mendes

I must interrupt the hon. member. We are way over time.

Resuming debate, the hon. parliamentary secretary to the government House leader, Senate, has the floor.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4 p.m.

Kingston and the Islands Ontario

Liberal

Mark Gerretsen LiberalParliamentary Secretary to the Leader of the Government in the House of Commons (Senate)

Madam Speaker, I thank the member for Whitby for sharing his time with me.

It is very important that we talk about such an important piece of legislation that has been brought forward, Bill C-26. The reality is that the changes in technology are happening so incredibly quickly. At times, it seems a daunting task to keep up with them and to make sure that we are always ahead of those actors out there, whether state or non-state, who are trying to engage in activities that could seriously cripple our economy or other aspects of society in Canada.

It seems as though it was just yesterday that we did not have the Internet. I remember vividly when I signed up for my first Internet connection, a dial-up connection, and having access to the Internet. That was when I was a computer engineering student at a local college in Kingston back in 1995 or 1996. Downloading something as simple as a single image sometimes would take two or three minutes to get the full image on the screen.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4 p.m.

Philip Lawrence

What did you download?

Telecommunications ActGovernment Orders

December 1st, 2022 / 4 p.m.

Liberal

Mark Gerretsen Liberal Kingston and the Islands, ON

Madam Speaker, it was not an image of the member opposite who is asking.

The point here is that things are evolving so quickly, and we have come so far in such a short period of time in terms of our ability to utilize, perfect and, for lack of a better term, exploit everything that the Internet has to offer. We have seen it change commerce. We have seen it change how we engage with each other. We have seen it change just about every aspect of our lives. Unfortunately, with that comes new opportunity for people to try to affect what we do in our day-to-day lives. They are trying new forms of fraud, theft, harassment, intimidation and influencing elections, which are all nefarious manners in which people are trying to now utilize the Internet.

Of course, cybersecurity is a huge part of any government operation now, and every government should be seized with doing everything it can to secure it, because when we think about it, everything is connected. There could be a cyber-attack on a utility company, on a functioning parliament, a democracy. There could be an attack on just about every aspect of our lives, and it is critical that we have legislation in place to ensure that we can properly safeguard those things.

I have heard individuals in the House, and in the last two questions, one from the Conservatives and one from the NDP, suggesting that this is taking way too long and that we are behind other countries. I would caution members on that and suggest that it is not entirely accurate. For example, the United Kingdom has a very similar bill to this one that is being studied right now by its members of Parliament, a Conservative government, I might add. They are going through the exact same process as we are now. I think it is always easy to say, and it is one of the things we hear quite a bit from opposition parties, why is this taking so long?

I have my own opinion on why things take so long in this House, but the reality is that I do not believe we are significantly trailing behind other countries. Yes, some countries have done more than us. I am not going to disagree with that, but I disagree that we are significantly behind. I will come back to the United Kingdom where a Conservative government has introduced a very similar piece of legislation to what we have. This brings me to the legislation that we are debating today.

This bill has two primary parts to it. The first part would amend the Telecommunications Act to add the objective of the promotion of cybersecurity of the Canadian telecommunications system to Canadian telecommunications policy.

It also authorizes the Governor in Council and the Minister of Industry to direct telecommunications service providers to secure the Canadian telecommunications system. I think that is incredibly important. In this process, we have to remember that a huge part of what we need to do is work with private partners and the various telecommunications services that are out there. We need, from a policy or government perspective, to put in place some of the things that they need to do.

The reality is that in a competitive business environment where various different telecommunications companies are fighting to be more competitive and more efficient to maximize profit, which we all appreciate is important in the capitalist environment we live in, we have to respect the fact that in order to ensure that some of these safeguards are in place, we are going to need to make sure that the legislation is there to make sure companies are doing what they need to be doing to create those safeguards. Otherwise, it might not happen to the degree it needs to because of the nature of the competitive environment they are in.

The other aspect of this bill is that it enacts the critical cyber systems protection act to provide a framework for the protection of critical cyber systems that are vital to national security and public safety. Of course, this is key because this is what everything else is built on in terms of our national security and the systems that we have. We need to make sure we can properly safeguard those. In that regard, it authorizes the Governor in Council to designate any service or system as a vital service or vital system. Just think about that.

When I was in college studying computer engineering and I went to get my first dial-up connection, who would have thought that a mere 25 years later we would be talking about designating some of these services as being vital to national security or public safety? The reality is that is where we are now. As we rely so heavily on these systems, we rely so heavily on ensuring that we have the systems in place that we do in order to protect our security as it relates to cyber-threats.

I appreciate the opportunity to talk about this very important piece of legislation. I get the sense it is being widely supported in the House. I hope we can move this along so we can get to the next steps, continue to move forward and get what we need into place in order to properly protect our cyber systems from a security perspective.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:10 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, I thank my colleague from Kingston and the Islands for his speech, which was informative as always.

However, I would like to know how this bill will enhance public trust in the Internet. What mechanism in Bill C‑26 will help guarantee public trust?

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:10 p.m.

Liberal

Mark Gerretsen Liberal Kingston and the Islands, ON

Madam Speaker, as I said in my speech, one of the things the bill does is it specifically directs what the various telecommunications providers need to do in order to maintain that security. That is what we do from a policy perspective. We establish what those requirements are that are required of the telecommunications systems in order to ensure that security is there. What we will see coming out of this is that the telecommunications systems, in a unified fashion, will promote these particular policies and safeguards that will be put through those directives.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:10 p.m.

NDP

Charlie Angus NDP Timmins—James Bay, ON

Madam Speaker, one of the things that has become very clear, particularly since the Russian invasion of Ukraine, is how destabilized our world is and how many bad actors are out there at the state level trying to undermine democracy.

My concern is about the ability of the federal government to withstand cyber-attacks. Earlier today, I talked about 2011 when actors out of China were able to shut down finance and the Treasury Board for days on end with relentless attacks. With the amount of financial information for Canadians that is in those departments, that is very serious.

We know that in the immigration department, which has turned into an absolute nightmare for anybody trying to navigate it, the system is breaking down. Staff in the department cannot access information files because the system is not up to speed. This will require a major investment to protect people, but also to deal with dark forces, whether they are Russians, the Chinese or any other non-state actor.

Has the government put in a credible plan to ensure we get our federal systems up to speed to be able to withstand hackers?

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:10 p.m.

Liberal

Mark Gerretsen Liberal Kingston and the Islands, ON

Madam Speaker, this is the basic fundamental principle to having our full and complete autonomy over our nation.

We need to ensure that these systems are secure—

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:10 p.m.

The Assistant Deputy Speaker (Mrs. Alexandra Mendès) Alexandra Mendes

Order. The hon. member's microphone is causing an audio problem that is interfering with the interpreter's audio.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:10 p.m.

Liberal

Mark Gerretsen Liberal Kingston and the Islands, ON

I apologize, Madam Speaker. It is not my first day. I should not have let that happen. I apologize to the interpretation staff, through you.

Getting back to what I was saying, in order to maintain that autonomy which we must have as a country, we need to make sure that the proper investments are in place to do that. The member indicated there would need to be a major investment. My own personal perspective is that we should spare no expense to ensure that security is absolutely robust.

Will there be penetrations or will there be times when it might be challenging to maintain that? Yes, but we learn from those. With regard to his example from 2011, I believe we learned from that and we made our systems even better as a result.

Telecommunications ActGovernment Orders

December 1st, 2022 / 4:15 p.m.

Conservative

Philip Lawrence Conservative Northumberland—Peterborough South, ON

Madam Speaker, I can attest that this is not the gentleman's first day. It seems like I have spent a year staring into his eyes here.

In the legislation, there is a fair bit of gray area with respect to definitions. Will the government be releasing additional information on such undefined terms as “cyber- incidents”?