The Canadian Senate on Thursday passed Bill C-8Introducing a mandatory cybersecurity framework to protect critical infrastructure in the country’s telecommunications, financial, energy and transportation sectors from new threats.
The Act achieves its objectives by amending the existing Telecommunications Act and adopting the new Act on the Protection of Critical Cyber Systems.
The changes to the Telecommunications Act grant the Governor in Council and the Minister of Industry new powers to actively secure national networks. These powers include the ability to issue binding administrative orders against large telecommunications service providers. In particular, the government can ban the use of products from certain suppliers and order the removal of risky devices from domestic networks. The bill also enforces strict regulatory compliance by imposing fines on non-compliant operators.
At the same time, the Critical Cyber Systems Protection Act creates a formal framework to protect critical operating systems and services critical to national and public security.
However, the passage of the law by the House of Commons and Senate has raised ongoing concerns about user privacy. The Office of the Privacy Commissioner of Canada warned He highlights several outstanding privacy risks and suggests that the legal limits on the exercise of these new government powers remain too broad. The commissioner also criticized the lack of a mandatory mechanism for notifying his office of serious cybersecurity breaches and pointed to inadequate minimum standards of data protection when sharing information with foreign governments.
The University of Toronto’s interdisciplinary research laboratory, Citizen Lab, is formally addressing these concerns submitted an expert assessment to the relevant standing committee and emphasized that the legislation still lacks necessary operational protection measures.
After successfully passing its final reading, Bill C-8 is currently awaiting royal assent to be formally adopted into Canadian law.
