An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

This bill has two main parts.

Part 1 changes the Telecommunications Act. It adds "security of the Canadian telecommunications system" as an official policy goal. It gives the federal Cabinet and the Industry Minister broad new powers to order telecom companies (like phone and internet providers) to do or stop doing almost anything needed to protect the network from threats such as interference or sabotage — for example, banning or requiring removal of certain equipment or services, imposing conditions on suppliers, or requiring security reviews. These orders can sometimes be kept secret from the public, though there are reporting requirements to Parliament and oversight bodies, and rules preventing the government from ordering the decoding or interception of private communications. Companies that don't comply can face significant fines or, in serious cases, criminal charges. Companies can challenge these orders in Federal Court under special confidentiality rules.

Part 2 creates a brand-new law, the Critical Cyber Systems Protection Act. It lets the government designate certain services (like banking, telecommunications, pipelines, power lines, nuclear energy, and federally regulated transportation) as "vital," and identify companies ("designated operators") in those sectors. Those operators must create and maintain cyber security programs, manage risks from suppliers and third parties, report cyber security incidents quickly to the Communications Security Establishment, and follow any specific cyber security directions issued by the government. Regulators (such as the Superintendent of Financial Institutions, the Bank of Canada, the Canadian Energy Regulator, the Canadian Nuclear Safety Commission, and the Ministers of Industry and Transport) get powers to inspect companies, order audits, issue compliance orders, and impose penalties or prosecute violations. The law also sets rules for how confidential and personal information can be shared between government bodies, with privacy protections built in.

Part 3 requires the government to review how this whole law is working within five years and report the results to Parliament, including possible recommendations for further legal changes.

This bill creates powers for Cabinet and the Minister of Industry to order telecommunications providers to take or stop specific actions to secure Canada's telecom networks, and separately establishes the Critical Cyber Systems Protection Act, which requires designated operators in finance, energy, nuclear, transportation and telecommunications to build cyber security programs, report incidents, and comply with government directions, backed by inspection powers and financial penalties.

• Ministerial and Cabinet orders — the Governor in Council and the Minister of Industry can order telecom providers to use, remove, or restrict products/services, terminate contracts, or "do or refrain from doing" specified things to secure the telecom system, based on the Minister's or Cabinet's own belief of "reasonable grounds"; some orders can include non-disclosure provisions preventing anyone from revealing the order exists.
• New regulatory obligations on operators — designated operators in critical sectors must establish and maintain cyber security programs, mitigate supply-chain risks, report cyber incidents within a regulated period (up to 72 hours), and comply with binding cyber security directions issued by Cabinet, with no requirement for prior notice to Parliament before such directions take effect.
• Inspection and entry powers — regulators (the Superintendent of Financial Institutions, Bank of Canada, Canadian Nuclear Safety Commission, Canadian Energy Regulator, Minister of Transport, and designated inspectors) may enter places, examine and copy records, use or access cyber systems, and compel production of information, with warrants required only for dwelling-houses.
• Penalties — administrative monetary penalties reach $25,000 (individuals) / $10,000,000 (others) under the Telecommunications Act amendments, and $500,000 (individuals) / $15,000,000 (others) under the Critical Cyber Systems Protection Act; summary and indictable offences under the latter can carry prison terms up to 5 years for individuals.
• Information sharing — the bill permits collection and exchange of information, including confidential and personal information, among ministers, regulators, CSIS, the Communications Security Establishment, and foreign governments or international bodies, for purposes tied to securing telecom systems or critical cyber systems.
• Oversight — annual reports on ministerial orders must be tabled in Parliament, and the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency must be notified of orders that include non-disclosure provisions; judicial review of orders follows special rules allowing a judge to withhold and return government evidence deemed confidential; the whole Act is subject to a five-year review with a report tabled in Parliament, but there is no sunset clause.