Public Safety Committee on Feb. 15th, 2024

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Can you get those estimates to us at least?

Do you not have economic modelling on what the red tape impacts, GDP impacts...? Do you have any of that modelling, and can you share that with this committee?

[Patrick Boucher]

There's no red tape impact being anticipated for implementation of this bill. This is about working with industry—

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

There's no increase in compliance costs from this legislation?

[Patrick Boucher]

This is about working with industry to make sure that we're protecting critical infrastructure on which Canadians rely on a daily basis.

[The Chair, Liberal, Heath MacDonald]

Thank you.

We'll go to Mr. McKinnon, please.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Thank you, Chair.

Thank you to the witnesses for being here.

We've heard from witnesses who allege that this bill will result in government accessing, collecting and, most particularly, misusing personal information, including personal cell phone information.

Is that likely to happen, and why or why not?

I would ask Mr. Schaan.

[Mark Schaan, Senior Assistant Deputy Minister, Strategy and Innovation Policy Sector, Department of Industry]

Mr. Chair, I want to thank the member for the question.

With regard to the collection of personal information, as noted in Bill C-26, the minister has order-making powers that will allow him to be able to issue orders to protect the security of the telecommunications system.

There are two things that I think are really important to note. The actions and orders related to the minister's order-making power have to be connected to that security objective and ring-fenced in that regard. Similarly, there's a proportionality test that applies as a function of administrative law to the orders that the minister is making.

Two things that I think are really important to note as well are, one, that the Privacy Act continues to apply, both to the Minister of Industry and to the minister's officials through the department; and, two, that the Personal Information and Protection of Electronic Documents Act, PIPEDA, continues to apply to the telecommunications providers for whom order-making would be done.

There are privacy protections in place on both entities, both on the government side and on the private sector side, and there are limitations to the order-making capacities of the minister.

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Thank you.

We've heard a lot about protecting our infrastructure from malicious actors, but we also heard of the need to protect ourselves from natural disasters and so forth—forest fires and floods and whatnot.

Can you tell us how this bill might facilitate that effort?

[Mark Schaan]

I'm happy to.

Thank you for the question.

I think it's important to note that the telecommunications security objective, as the minister outlined, actually allows for a broad reach of application, in the sense that security is fundamental to a number of contexts. While we often think about that as related to cyber, in this particular zone I think we need to think about security in things like whether you can securely access the telecommunications system in the event of natural disasters, which are increasingly common.

The industry minister has order-making powers under Bill C-26, for instance, to allow for a telecommunication service provider to develop a security plan in relation to its services, networks or facilities and—

[The Chair, Liberal, Heath MacDonald]

Thank you.

Ms. Michaud, please.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I think that the public servants gave good information to the ministers of their respective departments. All my questions were answered.

I'll give up the rest of my time, because I want us to discuss the time available to submit our amendments.

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Michaud.

Mr. Julian, please.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thanks for being here.

Earlier, I asked the question about NERC, the North American Electric Reliability Corporation, and the corresponding regulations. To what extent are the ministries reaching out to vital infrastructure associations like that to ensure we are not ending up in a compliance issue around the legislation and regulations that means a company or an entity might be pulled in two different directions?

[Patrick Boucher]

Through the development of this bill, there has been extremely extensive engagement with associations like the one you're referencing. That will continue through the regulatory process in establishing those regulations.

We also want to ensure we're engaging with provinces and territories to ensure for industry—possible entities that are subject to federal legislation like this, for example, and to provincial legislation—that there's harmonization within the implementation of those various laws. That's a commitment that I think is foundational to this bill and is something that we're going to continue to do through further engagement.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

When you say “harmonization”, are you suggesting, then, that the legislation or the anticipated regulations are being changed to some extent to ensure there isn't that duplication or contradiction between two different directions to assure cybersecurity? Or is the intent of the harmonization to get the other organizations to change their rules? Those are two very different approaches.

[Patrick Boucher]

I think it's to ensure that there is that harmonization, the first aspect you touched on, making sure that they're not contradictory to each other, that these organizations aren't being pulled in two different directions.

Again, this is more engagement that we want to do with provinces. It's something we've committed to through our engagement to date with provinces and territories and with industry to make sure that through the regulatory process we get it right for industry.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

One of the aspects of the legislation is immediate notification around cyber-attacks. There have been I think strong suggestions from a number of witnesses that there needs to be a clearer period.

Some are suggesting a 72-hour notification period, the objective being to respond to the cyber-attack to stop the cyber-attack initially, hopefully. They are suggesting that the reporting and notification requirements have become onerous, so that you're not able to handle the attack and you're not fighting back against the attack. If you're spending more time being concerned about following the letter of the law rather than responding to the cyber-attack, this can be a real difficulty.

How does the ministry define immediate notification? Do you agree with what numerous witnesses have said, which is that what we need is a clear period, but one that allows the organization, the company or the entity to stop the cyber-attack first before they have to engage in a notification?

[Patrick Boucher]

Yes, I would agree that there needs to be a clear period for reporting.

This is something that we've discussed through engagement to date and something that we want to identify through further engagement as we establish that through the regulatory process, again, balancing the need for making sure we're aware of the threat so that we could apply the expertise we have at the CSE, but also to warn other sectors, for them to be able to build resilience measures within their own infrastructure while also considering the realities that you just elaborated on.

Absolutely, I think we're going to have to be clear on that, and that's something we're committed to working on with partners to establish.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Before we go any further, we have some administrative housekeeping that the clerk would like to get some answers on.

We talked about this at our last meeting. If the committee wishes to start clause-by-clause consideration of Bill C-26, on Monday, February 26, I recommend to establish the deadline for submitting amendments as Wednesday, February 21, at noon.

I know there was some conversation surrounding this, so I'll ask if that's still good.

Mr. Shipley.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you, Mr. Chair.

After the study we've just done, and what was heard today, I believe there are a fair number of amendments coming forward. I think next Wednesday is going to be a little tight to get those in. If we can maybe bump those back to the Wednesday when we're back, that gives us next weekend.

We don't have as many resources as the government side. Everybody knows that. We're going to try to get ours in, too, but an extra week would be helpful.

[The Chair, Liberal, Heath MacDonald]

Madam Michaud.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

My comment will tie in with my colleague's remarks. Our resources are also quite limited. Preparing amendments and verifying their compliance with the legislative counsel is time‑consuming. There's a great deal of back and forth.

February 21 is less than a week away, which gives us very little time. Remember, we'll start studying the bill the following week. We'll then be in our constituencies for two weeks. I think that we'll need to hurry to get our work done. The bill will then be put on hold, since we'll be spending a number of weeks in our constituencies in March.

I propose that we have a bit more time to submit our amendments. It seems reasonable to give us an extra week, as Mr. Shipley suggested. In the meantime, the committee could begin its study on car theft.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Mr. Julian, please.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

I agree with my colleagues.

We could start our study on car theft in a week and a half. By next Tuesday, we could submit the list of witnesses for Ms. Michaud's proposed study on car theft. We could set the deadline for submitting amendments for the following week.

I would like to suggest something for the following week. In the next seven weeks, there are just two sitting weeks. If we conduct our study on car theft next week, I suggest that the committee hold longer meetings to discuss the proposed amendments to Bill C‑26.

Honestly, I find it difficult to discuss amendments for two hours and then to continue our discussion three days later. The amendments are often connected. I think that it would be more useful to hold a meeting from 3.30 p.m. to midnight, for example. If we did that, we could finish studying the bill that week. I'm talking about the second sitting week in March.

I propose that we hold longer meetings, extend the deadline for submitting amendments and start our study on car theft the week after next.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Ms. O'Connell.