Public Safety Committee on Jan. 27th, 2026

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Thank you, Mr. Chair.

I would like to come back to the issue of harmonizing the reliability standards of the North American Electric Reliability Corporation, or NERC. I'm thinking a lot about the fact that Electricity Canada really insisted that Bill C‑8 include a provision that a member who meets NERC standards complies with Bill C‑8. That would be much simpler than proceeding through regulations and negotiations, because I think that this North American reliability standard is very high. It is widely used, and disclosure practices have been developed. It's as if Bill C‑8 were playing around with these very reliable players.

Mr. Arbour, would it be complicated to add a provision stipulating that compliance with the NERC standards, the international standards, is sufficient to satisfy Bill C‑8?

[Andre Arbour]

Thank you for your question.

Questions about the regulation of the electricity system fall under the jurisdiction of the Department of Natural Resources, rather than the jurisdiction of the telecommunications sector. However, I know that they are already in the habit of taking harmonization issues into consideration to avoid a conflict or overlap in the rules of the electricity system.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Therefore, it wouldn't be inconsistent—it might even be appropriate—to include a provision in Bill C‑8 that would send a strong signal of intent to recognize those who meet these very high reliability standards. This is a major concern for Electricity Canada, of which Hydro‑Québec is a member. However, I wanted to let you know that this is something that concerns them greatly.

The provinces often have dealings with the federal government. They aren't always harmonious, they are lengthy, and the provinces are concerned. I thought that perhaps an amendment should be proposed to make that very clear. The minister's goal is to provide robust protection. If they already have it, why not recognize it? That's what I'm wondering.

My other question concerns the retention of personal information.

Witnesses told us that the bill didn't really provide any framework for the collection of personal information, how it is stored, how long it is kept and so on.

Do you think those concerns are justified? Should the bill be improved to provide a better framework for the retention of personal information?

[Andre Arbour]

I thank the member for her question.

With respect to part 1 of Bill C‑8 and the Telecommunications Act, I would first like to say that personal information is outside the scope of our activities when it comes to regulating telecommunications networks.

Personally, I don't see a problem with the management of that information. The information that is important to us is the type of equipment, the tower's location, the battery system and the backup system in the context of a network outage. In addition, personal information is not relevant to those activities.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Mr. Arbour, I'm surprised you're telling me that. I don't want to question what you're saying, quite the opposite. However, many witnesses have told us about the risk, the breach of personal information, the poor governance, among other things. It seems as though those witnesses did not understand Bill C‑8. When I listen to you, I get the impression that the witnesses did not understand the bill. They talked a lot about privacy. That's what surprises me about your answer, when you tell us that privacy is excluded. The witnesses we heard from are experts, after all, and they did express their fears about this to us.

[Andre Arbour]

I thank the member for her question.

Part 2 brings up some concerns about the possibility of some personal information being accidentally transmitted when incidents are reported. That situation currently exists in the case of voluntary reports. So there are systems for managing that type of situation, under the Privacy Act and Communications Security Establishment Canada's system. That system currently exists, and having mandatory reporting in part 2 would not change that system or the existing controls.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Okay.

Do I have any time left, Mr. Chair?

[The Chair, Liberal, Jean-Yves Duclos]

Unfortunately, your time is up already, Mrs. DeBellefeuille. We'll come back to you a little later.

I will now give the floor to you, Mr. Caputo, for five minutes.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Thank you, Mr. Chair.

Monsieur Arbour, I want to pick up on something that was mentioned. I believe it was one of my Liberal colleagues who asked the minister whether a warrant is commonplace in any other of our Five Eyes jurisdictions. You commented that a warrant is typically used in criminal law based on evidence that has been gathered by the police.

I want to reorient, though, how we're looking at this. A warrant is a type of judicial authorization, and a judicial authorization permits the government or the state, if you will, to take certain action. Where somebody has an expectation of privacy, that's where you get a warrant in criminal law, for instance.

Bearing that in mind, that judicial authorization or whatever you want to call it, some sort of judicial order.... Would this legislation be precluded by...? I'm not talking about exigency, in terms of exigent circumstances, but where there is a threat and the government is going to act under section 15, could this legislation not be amended to give the Federal Court the ability to give some sort of judicial authorization—based on oath or affirmation, which is how an authorization works—so that it's not the minister making the call, but it's the court making the call?

Am I being clear on this?

[Andre Arbour]

Certainly, what the committee chooses to do with amendments is the committee's prerogative. I think there are two considerations that I would flag just to provide information to the committee. The first one has to do with a more substantive set of considerations, and the second is more procedural.

In terms of a substantive basis—and I speak on this having been involved in the regulation of the telecommunications system, infrastructure, providers, for quite some time—the activities that go into that regulatory activity are very different from those that courts contemplate. It is quite rare, in a regulatory context, to have a non-expert court having oversight in that context. In terms of establishing rules for how.... These have the force of law. These are not something that can be done just willy-nilly; they have to be done with due care.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Can I stop you there, please?

The point I'm trying to make is this. If the government is going to take action, what does the government have to say? There is a threat, and this is a threat.... Right now it says “any threat”, and it compels any actor to potentially take any action.

I don't know that you need expertise. With all due respect, I'm sure the minister isn't an expert on all of these areas. They rely on the bureaucracy to advise. In that case, could you not have something procedurally that says that a government official must, on oath or affirmation, detail the nature of the threat and detail the action to be taken and how it fits within the act? Could a Federal Court judge not look at that and say, yes, you have met the requirements of the legislation, without being an expert, because it's clearly laid out in legislation what that is. The person is swearing it's true, in fact.

[Andre Arbour]

There are additional criteria as drafted: for example, that an order taken must be reasonable in relation to the gravity of the threat, and those types of things.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

Of course. I oversimplified. I know that, yes.

[Andre Arbour]

Just to be clear, this would still be quite a new activity for any court trying to consider this.

[Frank Caputo, Conservative, Kamloops—Thompson—Nicola, BC]

I acknowledge that.

[Andre Arbour]

I'll maybe just add that I've seen that when some of these questions come up that are completely new and unrelated to any type of established process, it's quite a lengthy and involved set of considerations.

The second aspect, from a procedural standpoint—and this would be ultimately a question for the chair, should an amendment come forward—is that there may be questions about scope and whether a royal recommendation would be needed. Under Bill C-26, it was quite a different subject matter. An amendment from the NDP member that had to do with the provision of special counsel was—

[The Chair, Liberal, Jean-Yves Duclos]

I'm sorry, but I will have to interrupt abruptly and rudely, because we now need to turn to MP Powlowski for five minutes.

[Marcus Powlowski, Liberal, Thunder Bay—Rainy River, ON]

This law protects critical infrastructure, power grids, nuclear reactors, transportation systems, pipelines, finance. We have concerns about cyber-attacks from China. We've heard about Huawei. Obviously, Russia is of concern. We are part of the Five Eyes.

How much is this act, and cybersecurity, blind to the country of origin of a cyber-attack? Could one of the members of the Five Eyes attack Canada, and would this legislation also guard us from that possibility?

[Andre Arbour]

The bill is country- and threat-agnostic in terms of the source. Cyber-attacks can come from many different places, including from organized crime, that are not affiliated with a government entity. Ransomware is an increasing tendency that we are seeing, enabled by cryptocurrency, which makes it much more profitable to engage in those types of attacks, and we see organized crime involved in those activities.

[Marcus Powlowski, Liberal, Thunder Bay—Rainy River, ON]

We're part of the Five Eyes. Is our cybersecurity so integrated with those other countries that we couldn't detect an attack from those countries? I would think that, given we're Five Eyes, we're all interconnected in cybersecurity. I mean from one of those countries, not a bad actor in those countries—let's say one of the governments in these countries decided they may want to attack some part of our economy.

[Andre Arbour]

I would start by saying, because I don't want to overstate the capabilities of my colleagues at CSE.... First and foremost, in terms of my mandate, it's related to the Telecommunications Act and working with my colleagues on securing, with the private sector, their underlying infrastructure. However, I do know that CSE, as part of its ongoing activities unrelated to this bill, has very impressive capabilities of identifying possible threats. Then, one benefit of the bill before us is the incident reporting, which allows for better visibility of what threats are interfacing with different vulnerabilities.

[Marcus Powlowski, Liberal, Thunder Bay—Rainy River, ON]

Okay. Well, here's a very broad question: What are you hearing from the business community? Is this something that protects and furthers their economic interests, or is it something that undermines their economic interests?

[Andre Arbour]

I speak to my colleagues in different telecommunications companies on a regular basis. Any time any government says, “I have some new regulatory obligations for you”, they don't necessarily jump up and down and say, “Oh, great! That's amazing!” There is some understandable caution: “Let's not go overboard here. Let's make sure that what you have in mind is realistic and practical.” That's perfectly understandable. At the same time, they recognize that this is absolutely necessary. These types of things are inescapable in any type of modern economy, as they've seen in our peer nations.

They also recognize that there are some real advantages to predictability. When something is just voluntary and just a suggestion, it can add a degree of vagueness that makes it harder to justify decisions to their corporate board, and they're in a bit of a grey area, whereas if something is clear in terms of regulation, then they know what their responsibilities are, and they know what they have to do.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you very much, Mr. Powlowski.

Mrs. DeBellefeuille, you have the floor for two and a half minutes.

[Claude DeBellefeuille, Bloc, Beauharnois—Salaberry—Soulanges—Huntingdon, QC]

Thank you very much, Mr. Chair.

With the minister, we touched on the issue of companies being responsible for building infrastructure that is robust enough to withstand cyber-attacks. Those are big players, and we started talking about smaller players, such as co-operatives and Internet providers. In my area, we have Coop CSUR and TARGO. Those are small companies that serve rural regions abandoned by the major providers.

Have you estimated the costs that small Internet providers will have to bear to comply with Bill C‑8, if it is passed? That concerns me a lot, as a lot of small Internet providers have set up shop in Quebec.

Have you estimated those costs?