Public Safety committee  We absolutely appreciate the intent behind this provision; however, I think an unintended consequence could be that it would effectively allow designated operators to determine, themselves, whether their existing cybersecurity programs meet the requirements of the CCSPA and whether they are therefore obligated to comply with the obligations regarding the cybersecurity programs.

Public Safety committee  Thank you for the question. No, it was exactly for that reason. The unintended consequence, unfortunately, with including the word “private” in there is that some federally regulated Crown corporations may not be captured, and so we wanted to expand the language to ensure they were included to capture the breadth of all federally regulated sectors.

Public Safety committee  Thank you for the question. The amendments will reinforce the policy intent of these sections, which was to create a strict liability offence for contravening the act as well as to ensure the applicability of a due diligence defence. In strict liability, the defendant is liable for the offences, regardless of intent.

Public Safety committee  Thank you very much for the question. In developing a cybersecurity program—perhaps my colleague can help me out with a bit more detail here—what we'd be looking for in that cybersecurity program is essentially just a layout of what the designated operators are doing to protect their critical cyber systems, the specific measures they're putting in place.

Public Safety committee  Put incredibly simply, it's reasonable steps to decrease the likelihood of the risk materializing and to decrease the impact of a risk materializing. Again, as my colleague pointed out, the details of that will be fleshed out in regulation.

Public Safety committee  In talking with stakeholders, one of the key things we heard was general support for the legislation. As was pointed out, and you've seen in your reports, several had different views, depending on the stakeholders. We heard some of them today. There's probably more information required on the privacy protections in place and questions around the ministerial powers that are included.