Public Safety committee  Thank you for the question. I don't see any concern with ending it at “provincial regulatory agencies”. The caveat to that comment, of course, is that the “must” is taken out.

Public Safety committee  Thank you, Mr. Chair. We greatly appreciate the intention of this amendment. It was certainly always intended that those considerations would be taken into the regulatory-making process. However, the amendment could remove discretion from the government on what regulations are appropriate.

Public Safety committee  Thank you for the question. There are some challenges. To your point, there is a potentially unintended consequence here. It could result in the government giving up some jurisdiction to provinces and territories in areas that are federally regulated. Obviously, because of that confusion, this could very much cause delays in implementation.

Public Safety committee  The disclosure and use provisions of the CCSPA only include protections for confidential information right now. That's partially because, again, the act was constructed in such a way that it only contemplated the collection of technical information, information related to commercial interests, and that type of thing.

Public Safety committee  It could potentially limit the information that could be shared. It is a bit difficult to say, because it does introduce, as I said, these two new concepts. There are two concerns. One is that depending on who is doing the disclosing, they would now need to consider these requirements above and beyond whatever safeguards are already in place.

Public Safety committee  There are two considerations for the committee related to this amendment. When the act was constructed, it was built in such a way as to contemplate the collection of technical information and information related to commercial interests and whatnot. The intention was that it would work with related pieces of legislation, such as those governing the agencies associated with it, which may, in some cases, already have requirements around the retention and disposition of information.

Public Safety committee  Yes, in a way it could be read to be overly broad. That's absolutely a consideration.

Public Safety committee  It's a difficult question to answer because, as I said, when we initially set up the legislation, we intended it to work with the existing pieces that were out there—for example, CSE's enabling legislation and the enabling legislation of public safety—and the retention periods that apply to those, whether that's from Library and Archives Canada or the Privacy Act, etc.

Public Safety committee  Yes, that is a concern. It is similar to the concerns raised when the committee considered part 1 of the act as well. It does create a time lag as to when the decisions can be made. Another unintended potential consequence with this specific amendment is that requiring publishing in the Canada Gazette could potentially, or would, make confidential or identifiable information about critical infrastructure public.

Public Safety committee  Thank you, Mr. Chair. During our consultations, one of the points raised most frequently was about harmonization with the requirement of CISA in the U.S., which is the 72-hour requirement. I don't recall any other input that specifically suggested that anything longer would be needed.

Public Safety committee  Yes, I believe that would be workable.

Public Safety committee  Yes, that would work. We could put that in regulations. For the committee's consideration, part of the rationale for recommending it be moved to regulations was to allow for flexibility—not just in changing it, but actually in recognizing the differences in sectors as well. When we did our consultations, we heard very clearly from the energy sector, for example, that they were very interested in a 72-hour time frame, obviously because of the cross-border linkages of the international pipeline, for example, with the U.S.

Public Safety committee  I believe it was codified in such a way as to say—I'm sorry; I forget the exact wording—“within 72 hours”. I feel that we'd be bound to that. However, that could make sense in the circumstance. As I understand it, I believe the proposal is for that to be captured in regulations, so that could also be amended through the regulatory process as well.

Public Safety committee  Yes, I think that's a valid point. When we reviewed the draft wording, that was one of the unintended consequences that was raised. It could leave crucial aspects of Canada's cybersecurity and the timeliness of cyber-incident reporting up to the discretion of the operators themselves.

Public Safety committee  On the timeline for the mandatory reporting, probably one of the benefits of moving it into regulations, as you mentioned, is that it does allow for more flexibility, not just in consideration of the different sectors and their abilities but also in terms of changes down the road.