An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

Sponsor

Status

This bill has received Royal Assent and is, or will soon become, law.

Summary

This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.
Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,
(a) authorizes the Governor in Council to designate any service or system as a vital service or vital system;
(b) authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;
(c) requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;
(d) provides for the exchange of information between relevant parties and the disposal of personal information; and
(e) authorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.
This Part also makes consequential amendments to certain Acts.
Part 3 provides for a five-year review of the provisions enacted or amended by this Act.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, an excellent resource from Parliament. You can also read the full text of the bill.

Bill numbers are reused for different bills each new session. Perhaps you were looking for one of these other C-8s:

C-8 (2021) Law Economic and Fiscal Update Implementation Act, 2021
C-8 (2020) Law An Act to amend the Citizenship Act (Truth and Reconciliation Commission of Canada's call to action number 94)
C-8 (2020) An Act to amend the Criminal Code (conversion therapy)
C-8 (2016) Law Appropriation Act No. 5, 2015-16

Debate Summary

line drawing of robot

This is a computer-generated summary of the speeches below. Usually it’s accurate, but every now and then it’ll contain inaccuracies or total fabrications.

Bill C-8 proposes a new framework to enhance cybersecurity for Canada’s critical infrastructure and telecommunications systems. The legislation aims to strengthen national security and mandate incident reporting, while sparking parliamentary debate regarding the balance between government authority, privacy protections, and appropriate judicial oversight.

Liberal

  • Protecting critical infrastructure: The Liberals support Bill C-8 to safeguard essential digital systems, including banking, energy, and telecommunications, from evolving national security threats and state-sponsored cyber-sabotage.
  • Ensuring swift response: The party rejects amendments requiring judicial authorization for technical directives, arguing that real-time cyber defenses cannot be delayed by legal processes that could take months to resolve.
  • Strengthening incident reporting: Liberals advocate for mandatory reporting of even minor cyber incidents and near misses, asserting that proactive monitoring is essential for early warning and collective protection against coordinated attacks.
  • Balancing security with privacy: The government introduces safeguards to prohibit decoding encrypted communications and protect solicitor-client privilege, ensuring the legislation focuses on infrastructure security without infringing on the privacy of Canadians.

Conservative

  • Cybersecurity as national security: Conservatives view cybersecurity as a fundamental national security issue. They emphasize the necessity of protecting Canada's critical telecommunications infrastructure against various hostile actors, criminal organizations, and the emerging challenges posed by artificial intelligence.
  • Correction of government overreach: The party highlights its role in fixing provisions that originally granted the government sweeping, unchecked powers. They specifically oppose regulations that would allow the minister to arbitrarily suspend internet services for individuals without sufficient safeguards.
  • Protecting rights and privacy: Through committee amendments, Conservatives forced changes to protect lawful expression and ensure privacy is a mandatory consideration. They also raised the threshold for government intervention to require a standard of serious, systematic threats.
  • Concerns over judicial oversight: The party criticizes the government for removing a Conservative amendment that required judicial authorization before exercising new powers. They argue this removal leaves the legislation vulnerable to abuse and lacks necessary accountability.

Bloc

  • Support for cybersecurity legislation: The Bloc supports Bill C-8, asserting that while previous versions were flawed, the current bill was significantly improved through collaborative committee work and Bloc-led amendments to better serve the interests of Quebec.
  • Protecting Quebec's jurisdiction: Members emphasized the importance of respecting Quebec’s jurisdictions, successfully securing amendments that protect entities like Hydro-Québec from arbitrary federal decision-making and ensuring proper consultation regarding electricity transmission systems.
  • Digital encryption and privacy: The party prioritized digital security by ensuring encryption remains protected and advocating for information-sharing criteria based on necessity, proportionality, and reasonableness to prevent government overreach or abuse of sensitive data.
  • Future accountability and reviews: The Bloc secured a mandatory five-year review to adapt the law to evolving technology, though they expressed ongoing concerns regarding whistle-blower protections and budget cuts to national security oversight bodies.

Green

  • Opposition despite improvements: The Green Party opposes the bill despite minor improvements, arguing it remains flawed, contains too many loopholes, and fails to adequately protect private information and encryption.
  • Excessive ministerial power: The legislation concentrates too much power in the hands of individual ministers. It lacks necessary warrants and judicial oversight for orders that could affect telecommunications access and Canadian privacy.
  • Restricted parliamentary rights: May criticizes procedural rules that limit the ability of members from unrecognized parties to introduce substantive amendments in the House, undermining their democratic rights and the legislative process.
Was this summary helpful and accurate?

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:45 p.m.

Bloc

Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC

Madam Speaker, that is indeed a problem, considering the work and analysis that goes into amendments. These amendments had been thoroughly debated by the Standing Committee on Public Safety and National Security, and though they were deemed inadmissible by the committee chair, we had strong arguments to show that the chair was mistaken. Democracy prevailed, and we overturned the chair's decision. It is regrettable that, despite the debates we had in committee, the Speaker of the House has this additional power to overturn the committee's decision.

I believe these rules should be revisited because it does not make sense that, in the context of a minority government, the Speaker of the House had the final say on Bill C-8 after it was thoroughly debated in committee.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:45 p.m.

Conservative

Dane Lloyd Conservative Parkland, AB

Madam Speaker, it was a true pleasure working with my colleague on the public safety committee. I want to talk about one particular area where we worked together to improve the legislation.

Often, we have seen, when passing new or novel legislation that would give the government new powers, we put in review clauses to ensure that, after a specified period of time, usually five years, we could review the legislation to make sure that it is working as intended. Unfortunately, we have seen many pieces of legislation passed for which these reviews have never taken place.

I am very proud that I was able to work on what was initially brought forward by my colleague to try to strengthen that, to ensure that the government has to complete a review. It cannot just keep kicking the can down the road. I want to know what the member's thoughts are on that particular amendment.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:45 p.m.

Bloc

Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC

Madam Speaker, I want to thank my colleague for being a paragon of collaboration. He is one of my colleagues on the Standing Committee on Public Safety and National Security, and when I tabled my amendment, he came to see me and said that if we added what he just mentioned to the amendment, the government would be subject to more oversight and would have less time to present the analysis and report.

There was a minor flaw in the wording of my amendment, a minor weakness that would have allowed the government to keep discussing the bill beyond five years. My colleague improved it by moving a subamendment. Honestly, I really appreciated his subamendment, which was adopted by all members of the committee, including those on the government side. I just want to say that when we work as a team and our objective is clear, straightforward, precise, positive and constructive, namely, to protect the public and offer security, then amendments and subamendments are welcome. That is what my colleague did.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:50 p.m.

Green

Elizabeth May Green Saanich—Gulf Islands, BC

Madam Speaker, I have a question for my colleague from Beauharnois—Salaberry—Soulanges—Huntingdon. I am a member of the House, but I am not a member of a committee.

I want to add a few words to support the position of my colleague and friend from the Bloc Québécois, because it is not just the majority of the committee members who accepted the amendments. There are also two other parties in the House whose members cannot vote in committee. The NDP member for Vancouver East and myself, from the Green Party, also agree with the changes that were made by the committee following clause-by-clause consideration but that were ruled out of order by the Speaker of the House. I simply want to add that I think the majority, plus two other members, agree that the bill should be improved.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:50 p.m.

Bloc

Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC

Madam Speaker, I understand my colleague's frustration because, at the end of the day, she has just as much right to be here in the House as I do. Her voice carries just as much weight as mine and those of all our colleagues in the House. However, it is true that the rules in committee are such that unrecognized parties are not represented around the table during committee deliberations. My colleague was able to introduce her amendments but was not able to debate or vote on them. I understand her frustration. There are many rules in the House that need to be reviewed and many things that need to be modernized. The point is that we need to take the time to do so. Here in the House of Commons, amending the rules has not exactly been commonplace since I was first elected. I understand her frustration and I empathize with her concerns, but this is a broad debate that we could perhaps have a little later, in the context of other bills.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:50 p.m.

Bloc

Alexis Deschênes Bloc Gaspésie—Les Îles-de-la-Madeleine—Listuguj, QC

Madam Speaker, I thank my colleague very much for her speech and for walking us through the legislative process. I have a question for her. Can she inform the House about the balance that we struck between the imperative need to protect our facilities from cyber-attacks and the need to avoid compromising people's privacy, particularly when Internet service providers are allowed to do certain things?

How does Bill C‑8 strike a balance between these two important principles?

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:50 p.m.

Bloc

Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC

Madam Speaker, I thank my colleague, who always asks very relevant questions. Indeed, that is what motivated us throughout our work in committee. In other words, when we analyzed Bill C‑8, we wondered how we could both ensure security and protect privacy and personal information.

I think we achieved that. It is not perfect, but I think we achieved that by incorporating the amendments proposed by the Privacy Commissioner and by adding the analysis criteria, namely necessity, proportionality and reasonableness. That gives us some assurance. Before anyone gets access, they have to be screened. Those criteria have to be recorded, observed and documented before someone can get access or issue orders.

We think that the requirement to go through this screening offers some security around the whole issue of confidentiality and privacy.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 3:50 p.m.

Green

Elizabeth May Green Saanich—Gulf Islands, BC

Madam Speaker, it is an honour for me to speak to Bill C-8 this afternoon.

I have a few comments regarding the substance of the bill, but in light of the previous speeches, I think I can clarify the situation regarding unrecognized parties, although it is a bit complicated.

The reality of it is that we do not have to change our rules, but I share with my other colleagues that we have the right, as members of Parliament in parties with fewer than 12 MPs, under our standing rules and procedures of Parliament to stand in this place at report stage and present and debate substantive amendments. That is as a right, not as a favour on unanimous consent. That right we have at report stage is one that exists in our rules.

Why it does not happen goes back to a long story, and I do not want to lose my time to discuss Bill C-8 by explaining this. Back when Stephen Harper was the prime minister, the governing party objected to my efforts to try to protect environmental legislation in an omnibus budget bill in the spring of 2012. I presented amendments on the floor of the House at report stage. Long story short, the Prime Minister's Office of the day decided it was too much trouble to change the rules to deprive members of Parliament in a situation such as my own, which is now a situation the NDP finds itself in. Not long ago in the past, the Bloc Québécois was in the same situation.

Rather than change the rules, they came up with a simple expedient: Tell every committee to pass an identical motion to say members of Parliament serving in a party of fewer than 12 MPs or as independents would be given a short timeline of 24 hours' notice to present amendments at committee which are deemed to have been tabled. This was because, as non-committee members, we do not have the right to argue for our amendments, except during a one-minute period. We also do not have the right to withdraw our amendments, but the deemed presentation of our amendments occurs.

I have spent days in committees at clause-by-clause, waiting hours for the one chance I have to present one amendment and argue for it for a minute.

This is all to say that this process, in the case of Bill C-8, gave me a front-row seat to really good, strong attempts by Conservative members of Parliament, by the Bloc Québécois, by one NDP member in the same situation I am in and by a number of Green Party amendments that were put forward to try to improve the act. It is worth noting at this point that it represents four of the five parties that serve in this Parliament, working together to try to improve the legislation, with the governing party members opposing.

Even though we got through committee a number of strong amendments, at the end of the day, here in this chamber, an ex post facto change was made to the rulings that the majority of the committee members who had a vote, and, if we had had a vote, the other members of Parliament who were sitting at the table and presenting amendments, would have concurred in.

It is a strange road that leads me to every single committee on almost every piece of legislation when it gets to clause-by-clause to try to improve the legislation. As a right, I should not have to run from committee to committee. I should be able to make my amendments at report stage in one room, rather than sometimes simultaneously running from committee to committee.

I raise this because members of committee now routinely pass a motion sent down to them from on high. They do not question it or realize that what they are doing is reducing my rights as a member of Parliament. I have more rights if they do not pass that motion in committee, but it is now a mindless procedure. They never call me beforehand to ask how it would affect my rights or if they should pass it or not.

Unfortunately, this is the situation facing members of parties with fewer than 12 seats. We are only allowed to present amendments at report stage, here in the House.

The House is now considering Bill C-8 at third reading. Bill C-8, which we are debating in the House this afternoon, is virtually identical to Bill C-26, but it includes certain improvements that were made to that bill, which could not be passed because the House was prorogued.

We know that Bill C-26 was the first attempt to have a cybersecurity framework for this country to protect Canadians and be prepared for the numerous ways in which we need a proper framework for cybersecurity. Bill C-8 is an improvement over Bill C-26. There is more transparency. Improvements have been made, and there is more clarity around the question of what is essential infrastructure for Canadians in this area.

Bill C-8 is an omnibus bill that would create an entirely new act, the critical cyber-systems protection act, and amend many other acts. As much as we can stand here and say it is an improvement, it is also an improvement because at least some of the amendments that were made in clause-by-clause in committee, amendments primarily from the Conservative Party members of committee, improved the legislation and did more to protect privacy for Canadians. However, still, despite some improvements that we welcome, I will be voting against Bill C-8 because there are still too many loopholes and too many flaws.

I am quite certain of the bill's passage, and we do need legislation in this area, but not this. We are not ready yet. I very much hope that the Senate of Canada, in exercising sober second thought, will look at the debates here today and consider the briefs that were presented to the public safety committee from the Canadian Civil Liberties Union; the Citizen Lab, which is part of the Munk School of Global Affairs and Public Policy; OpenMedia; and a number of other concerned technical expert groups that, while looking at cybersecurity, think that this bill still has flaws that would create constitutional weaknesses and fail to properly protect encryption and the security of private information.

The concerns fall into a couple of broad categories. Again, when the Senate of Canada looks at this, I would ask it to please consider if the legislation is good enough to pass the tests. Cybersecurity is an interesting area, where Canada, in passing legislation, has an eye on what the U.K. threshold tests looks like for protection of personal information before our products can be used within the U.K. Certainly a number of experts have looked at this and think that Bill C-8 does not get us across the threshold for what privacy protections are required in other countries.

In general, despite improvements in transparency, the reality is that this law, Bill C-8, like other laws passed recently, would give individual ministers too much power. We do not have the requirement for warrants. There is not enough judicial oversight. We still have a situation where many of these orders can be made without the public knowing. The notion is that the minister alone would decide whether they can order a telecommunications company to pull access to their system or an individual Canadian, who will not necessarily know this is happening and not have an opportunity to speak to it.

The ongoing question is not only that this bill has loopholes, but it weakens existing protections that exist under other laws. Those points have been made well. I was going to particularly point to the brief of OpenMedia on Bill C-8, which points out, “A bad loophole you pass in this legislation does not just weaken the law; it will prove far more important than the law's intended purpose.” There are serious loopholes that must be fixed, and they have not been fixed. I certainly hope that the Senate will look at the Bloc Québécois amendment, which would make sure there is mandatory review of how this law is working within a confined and defined period of time.

In conclusion, it is clear that this bill is imperfect. No member of Parliament believes that the bill has been improved enough to make it perfect now.

We cannot let the perfect be the enemy of the good. Let us hope that the Senate fixes the flaws, that the bill comes back to us and that the government accepts those fixes.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4 p.m.

The Assistant Deputy Speaker (Alexandra Mendès) Alexandra Mendes

Is the House ready for the question?

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4 p.m.

Some hon. members

Question.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4 p.m.

The Assistant Deputy Speaker (Alexandra Mendès) Alexandra Mendes

The question is on the motion.

If a member participating in person wishes that the motion be carried or carried on division, or if a member of a recognized party participating in person wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4:05 p.m.

Liberal

Arielle Kayabaga Liberal London West, ON

Madam Speaker, I request that it be passed on division.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4:05 p.m.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4:05 p.m.

Some hon. members

Agreed.

An Act Respecting Cyber SecurityGovernment Orders

March 26th, 2026 / 4:05 p.m.

The Assistant Deputy Speaker (Alexandra Mendès) Alexandra Mendes

(Motion agreed to, bill read the third time and passed)