Evidence of meeting #101 for Public Safety and National Security in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was information.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Andre Arbour  Director General, Strategy and Innovation Policy Sector, Department of Industry
Colin MacSween  Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness
Stephen Bolton  Director General, Strategic Policy, Communications Security Establishment
Richard Larose  Senior Technical Advisor, Communications Security Establishment
Clerk of the Committee  Mr. Jean-François Pagé

April 8th, 2024 / 5:15 p.m.

Conservative

Glen Motz Conservative Medicine Hat—Cardston—Warner, AB

The amendment is that in clause 13, after line 34 on page 80, we add the following:

(2) In making regulations under subsection (1), the Governor in Council must seek to ensure consistency with existing regulatory regimes, such as those established by provincial regulatory agencies and the North American Electric Reliability Corporation Critical Infrastructure Protection Standards.

This particular amendment is to address two reoccurring concerns raised by witnesses during the study of this bill. One is that many provisions of this bill would be dealt with in regulations via the Governor in Council, and the other is that new requirements and definitions should be harmonized with existing regulatory requirements.

Manulife, the Canadian Gas Association, the Canadian Chamber of Commerce and the Canadian Electricity Association all agree and share those concerns, and I agree with them.

5:15 p.m.

Liberal

The Chair Liberal Heath MacDonald

Go ahead, Ms. O'Connell, please.

5:15 p.m.

Liberal

Jennifer O'Connell Liberal Pickering—Uxbridge, ON

I have some concerns, but I'm going to first ask Mr. MacSween, or whoever is best, to address it.

My initial concern is that this amendment just creates duplication, but if I'm wrong, I'm happy to open this up for a bit more discussion. I also think the word “must” might be a challenge.

I'll ask the officials to speak to this amendment first.

5:15 p.m.

Liberal

The Chair Liberal Heath MacDonald

Go ahead, Mr. MacSween, please.

5:15 p.m.

Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness

Colin MacSween

Thank you, Mr. Chair.

We greatly appreciate the intention of this amendment. It was certainly always intended that those considerations would be taken into the regulatory-making process. However, the amendment could remove discretion from the government on what regulations are appropriate.

The challenge with the word “must” is that it cannot be guaranteed that consistency will be ensured. Softening the language to “may” or to “consider” consistency could work in that circumstance. Here we are asking ourselves what the consequence would be if there are contradictory regimes. We want to make sure that we're putting in place the best regulations that make sense for Canada's critical infrastructure in consideration of other requirements as well.

The other aspect is that the legislation itself was intended to be agnostic and not speak to very specific requirements. Those considerations were intended to be built into the regulations. There is additional consideration for the committee there as well.

5:15 p.m.

Liberal

Jennifer O'Connell Liberal Pickering—Uxbridge, ON

Thank you.

5:15 p.m.

Liberal

The Chair Liberal Heath MacDonald

Go ahead, Mr. Motz.

5:15 p.m.

Conservative

Glen Motz Conservative Medicine Hat—Cardston—Warner, AB

Thank you.

I appreciate those comments, but I think we heard during witness testimony that when it comes to cybersecurity, our sector organizations should be directing their time, their money and their talent towards prevention, detection and rapid remediation of cybersecurity incidents rather than being bogged down in potentially duplicate paperwork and jurisdictional overlap.

If it works that we can change the wording from “must” to “should” or “may”—and I think it's important that we still have this language there, and it gives some comfort around the ability—then I would propose someone make a subamendment to my amendment.

5:20 p.m.

Liberal

Pam Damoff Liberal Oakville North—Burlington, ON

I'm wondering if Glen would be willing to remove naming the agencies and just say “existing regulatory regimes”. I think it's generally not a good idea to specifically spell them out. If that's okay, I would move that we change “must” to “may” in this amendment after the word “regimes”. It's Just to remove “such as those established”. It would just end at “regimes”.

5:20 p.m.

Conservative

Glen Motz Conservative Medicine Hat—Cardston—Warner, AB

Do you mean to take out “provincial regulatory”...?

5:20 p.m.

Liberal

Pam Damoff Liberal Oakville North—Burlington, ON

I think we could end it after “agencies”.

5:20 p.m.

Conservative

Glen Motz Conservative Medicine Hat—Cardston—Warner, AB

Yes, after “agencies” would work better. I'm fine with it. Then it would be “such as those established by provincial regulatory agencies.” Yes.

5:20 p.m.

Liberal

The Chair Liberal Heath MacDonald

Mr. Julian is next, please.

5:20 p.m.

NDP

Peter Julian NDP New Westminster—Burnaby, BC

Thank you, Mr. Chair.

I'm not sure that “may” is better than “should” as the operative word. It isn't giving permission to work to ensure consistency; it's more providing direction and saying that this is the goal that we are looking for, but it doesn't prescribe it.

I agree that “must” is far too rigid a word, but I would suggest “should” instead of “may” because I think that's the intent of the amendment as well.

5:20 p.m.

Liberal

The Chair Liberal Heath MacDonald

Go ahead, Ms. O'Connell.

5:20 p.m.

Liberal

Jennifer O'Connell Liberal Pickering—Uxbridge, ON

Thanks.

If we're in a debate about “should” or “may”, I don't know.... I was going to suggest “consider consistency” to make sure that it is being considered. If the debate is really now at “should”, “may” or “consider”....

Before we get to that, I would just ask for clarity.

Mr. MacSween, if we ended the amendment after “existing regulatory regimes”, is that ideal? Should we include “such as those established by provincial regulatory agencies”?

If we do leave in “such as those established by provincial regulatory agencies”, that's pretty specific to provincial regulated industries rather than existing regulatory regimes.

5:20 p.m.

Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness

Colin MacSween

Thank you for the question.

I don't see any concern with ending it at “provincial regulatory agencies”. The caveat to that comment, of course, is that the “must” is taken out.

5:20 p.m.

Liberal

Jennifer O'Connell Liberal Pickering—Uxbridge, ON

You're agnostic to the regulatory regimes and whether they're provincial or whatnot. The debate is around “may”, “should” or “must” at this point.

5:20 p.m.

An hon. member

We could use “shall”.

5:20 p.m.

Liberal

Jennifer O'Connell Liberal Pickering—Uxbridge, ON

“Shall” is the same as “must”.

5:20 p.m.

Liberal

The Chair Liberal Heath MacDonald

For clarity, Ms. Damoff used the word “may”. Are we sticking with that?

5:20 p.m.

Some hon. members

Agreed.

5:20 p.m.

Liberal

The Chair Liberal Heath MacDonald

Officials, is “may” okay?

It will soon be May.

We'll call a vote on the subamendment.

5:20 p.m.

NDP

Peter Julian NDP New Westminster—Burnaby, BC

Is the subamendment “may”?

5:20 p.m.

Liberal

The Chair Liberal Heath MacDonald

Mr. Julian, we'll read it. Let's be clear. We'll read exactly what it's supposed to say before we do anything further.