SECU Committee Report
If you have any questions or comments regarding the accessibility of this publication, please contact us at accessible@parl.gc.ca.
| In accordance with its Order of Reference of Friday, October 3, 2025, your committee has considered Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, and agreed on Thursday, February 26, 2026, to report it with the following amendments: |
| Clause 2 |
| That Bill C-8, in Clause 2, be amended by adding after line 12 on page 1 the following: “15.02 For greater certainty, in sections 15.1, 15.2, 15.5 and 15.7, interference with or manipulation, disruption or degradation of a telecommunications system include actions of a technical nature that impede the operation of the telecommunications system but do not include the effect of lawful expression, persuasion or political debate.” |
| That Bill C-8, in Clause 2, be amended (a) by replacing line 13 on page 1 with the following: “15.1 (1) Subject to section 15.201, if the Governor in Council believes on reason‐” (b) by replacing line 4 on page 3 with the following: “15.2 (1) Subject to section 15.201, if there are reasonable grounds to believe that” (c) by adding after line 33 on page 5 the following: “15.201 (1) An order may not be made under section 15.1 or 15.2 unless the Minister first obtains the authorization of a judge under subsection (2). (2) A judge of the Federal Court may, subject to any conditions that the judge considers appropriate, authorize the Governor in Council or the Minister, as the case may be, to make an order under section 15.1 or 15.2 on ex parte application by the Minister that sets out the reasons why the order is necessary.” |
| That Bill C-8, in Clause 2, be amended (a) by replacing line 17 on page 1 with the following: “or degradation, and that it is reasonable in relation to the gravity of that threat, the Governor in Council may, by order” (b) by replacing line 7 on page 2 with the following: “stance, be necessary and reasonable in relation to the gravity of the” (c) by replacing line 7 on page 3 with the following: “interference, manipulation, disruption or degradation, and that it is reasonable in relation to the gravity of that threat,” (d) by replacing line 22 on page 3 with the following: “terference, manipulation, disruption or degradation, and that it is reasonable to do so in relation to the gravity of that threat, the” (e) by replacing line 39 on page 4 with the following: “or (2) must, in scope and substance, be necessary and reasonable in re‐” |
| That Bill C-8, in Clause 2, be amended (a) by deleting lines 10 to 12 on page 2. (b) by adding after line 22 on page 2 the following: “(4.1) A judge of the Federal Court may, on application by the Governor in Council and subject to any conditions that the judge considers appropriate, make an order prohibiting the disclosure by any person of some or all of the contents of the order if the judge is satisfied that there are reasonable grounds to believe that the disclosure would be injurious to international relations, national defence or national security or endanger the safety of any person.” (c) by replacing line 23 on page 2 with the following: “(5) Subject to any order made under subsection (4.1), the Governor in Council may cause a draft order to” (d) by replacing lines 25 to 28 on page 2 with the following: “(6) Subject to any order made under subsection (4.1), an order made under subsection (1) must be published in the Canada Gazette within 90 days after the day on which it is made.” |
| That Bill C-8, in Clause 2, be amended by adding after line 12 on page 2 the following: “(3.1) Before including in the order a provision to prohibit the disclosure of its existence, or some or all of its contents, the Governor in Council must consider (a) the extent to which the disclosure could, in the Governor in Council’s opinion, compromise the objective of the order; (b) the necessity of including such a provision in light of the nature of the threat; (c) the possibility of limiting the scope of the prohibition; (d) the impact of non-disclosure on the principles of transparency and accountability of the Government of Canada; (e) any representations made by the affected telecommunications service providers; and (f) any other factor that the Governor in Council considers relevant.” |
| That Bill C-8, in Clause 2, be amended (a) by replacing line 20 on page 2 with the following: “services in Canada, including on the confidentiality and security of telecommunications; and” (b) by replacing line 14 on page 5 with the following: “services in Canada, including on the confidentiality and security of telecommunications; and” |
| That Bill C-8, in Clause 2, be amended (a) by adding after line 20 on page 2 the following: “(c.1) its potential impacts on the privacy of Canadians; and” (b) by adding after line 14 on page 5 the following: “(c.1) its potential impacts on the privacy of Canadians; and” |
| That Bill C-8, in Clause 2, be amended by adding after line 18 on page 3 the following: “(1.1) Despite paragraph (1)(b), no order may be made directing the suspension of service to an individual, unless the order is necessary to secure the Canadian telecommunications system against any specified threat of a technical nature.” |
| That Bill C-8, in Clause 2, be amended by adding after line 37 on page 4 the following: “(2.1) Despite subsection (2), the Minister must not order the decoding of an encrypted private communication, as defined in section 183 of the Criminal Code.” |
| That Bill C-8, in Clause 2, be amended (a) by replacing lines 4 to 6 on page 5 with the following: “(5) A judge of the Federal Court may, on application by the Minister and subject to any conditions that the judge considers appropriate, make an order prohibiting the disclosure by any person of some or all of the contents of the order if the judge is satisfied that there are reasonable grounds to believe that the disclosure would be injurious to international relations, national defence or national security or endanger the safety of any person.” (b) by replacing line 17 on page 5 with the following: “(7) Subject to any order made under subsection (5), the Minister may cause a draft order to be published” (c) by replacing lines 19 to 22 on page 5 with the following: “(8) Subject to any order made under subsection (5), an order made under subsection (1) or (2) must be published in the Canada Gazette within 90 days after the day on which it is made.” |
| That Bill C-8, in Clause 2, be amended by adding after line 6 on page 5 the following: “(5.1) Before including in an order made under subsection (1) or (2) a provision to prohibit the disclosure of its existence, or some or all of its contents, the Minister must consider (a) the extent to which disclosure could, in the Minister’s opinion, compromise the objective of the order; (b) the necessity of including such a provision in light of the nature of the threat; (c) the possibility of limiting the scope of the prohibition; (d) the impact of non-disclosure on the principles of transparency and accountability of the Government of Canada; (e) any representations made by the affected telecommunications service providers; and (f) any other factor that the Minister considers relevant.” |
| That Bill C-8, in Clause 2, be amended by adding after line 24 on page 6 the following: “15.211 The Minister must, within seven days after an order is made under section 15.1 or 15.2 — other than an order that includes a provision prohibiting the disclosure of its existence, or some or all of its contents — give a notice containing the order to any person specified in that order.” |
| That Bill C-8, in Clause 2, be amended by replacing line 19 on page 7 with the following: “believes on reasonable grounds is reasonable to provide in relation to the gravity of the threat and necessary for the pur‐” |
| That Bill C-8, in Clause 2, be amended by adding after line 11 on page 8 the following: “(2.1) Personal information and de-identified information that is not designated as confidential under subsection (1) is deemed, for the purposes of this Part, to be designated as such.” |
| That Bill C-8, in Clause 2, be amended (a) by replacing line 12 on page 8 with the following: “(3) Subject to subsections (4) and (5), no person shall knowingly” (b) by replacing line 15 on page 8 with the following: “(4) Information referred to in any of paragraphs (1)(a) to (c) that is designated as confidential may be” (c) by adding after line 23 on page 8 the following: “(5) Information referred to in paragraph (1)(d) that is designated as confidential may be disclosed, or be permitted to be disclosed, if (a) the disclosure is required by law; or (b) in the Minister’s opinion, the disclosure is necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption, and the information, in scope and substance, is reasonable in relation to the gravity of any threat.” (d) by adding after line 10 on page 9 the following: “(1.1) For the purposes of subsection (1), information referred to in paragraph 15.5(1)(d) must not be collected or disclosed unless its scope and substance is reasonable in relation to the gravity of the threat.” |
| That Bill C-8, in Clause 2, be amended by replacing line 21 on page 8 with the following: “ion, given the gravity of the threat, to secure the Canadian telecommunications sys‐” |
| That Bill C-8, in Clause 2, be amended by adding after line 23 on page 8 the following: “(d) in the case of information referred to in paragraph (1)(d), the person to whom the information relates consents to its disclosure.” |
| That Bill C-8, in Clause 2, be amended by replacing line 24 on page 8 with the following: “15.6 (1) Despite section 15.5, to the extent that is reasonable in relation to the gravity of the threat and neces-” |
| That Bill C-8, in Clause 2, be amended by replacing lines 22 to 26 on page 9 with the following: “ment or organization, if (a) the Minister believes that the information may be relevant to securing the Canadian telecommunications system or the telecommunications system of a foreign state, including against the threat of interference, manipulation or disruption; and (b) the agreement, memorandum of understanding or arrangement provides for the disposal of that information once it is no longer necessary for the purpose for which it was disclosed.” |
| That Bill C-8, in Clause 2, be amended by adding after line 41 on page 9 the following: “15.701 Any person who collects or obtains information referred to in paragraph 15.5(1)(d) under this Part, with the exception of section 15.7, must dispose of that information if it is no longer necessary for any purpose related to the making, amending or revoking of an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a) — or to verifying compliance or preventing non-compliance with such an order or regulation — or in accordance with any requirement under the Privacy Act that applies to that information.” |
| That Bill C-8, in Clause 2, be amended by adding
after line 3 on page 10 the following:
“15.72 A person who performs or has performed duties or functions in the administration or enforcement of this Act must not disclose or permit to be disclosed to any other person, except to a Canadian law enforcement agency or for the purposes of the administration or enforcement of this Act, the identity of any individual who provided information on their own initiative to the Minister to achieve the objectives of this Act that relate to securing the Canadian telecommunications system and who has requested confidentiality.” |
| That Bill C-8, in Clause 2, be amended by adding after line 26 on page 10 the following: “(4) The Minister must publish a summary of the report on the website of the Department of Industry within 10 days after the day on which it is tabled in both Houses of Parliament.” |
| Clause 11 |
| That Bill C-8, in Clause 11, be amended by adding after line 8 on page 22 the following: “internal audit means an independent and objective assurance and advisory review conducted in accordance with any internationally recognized guidance on professional practices respecting internal auditing and specified in Treasury Board policies, such as the International Professional Practices Framework of the Institute of Internal Auditors. (vérification interne)” |
| That Bill C-8, in Clause 11, be amended by (a) adding after line 11 on page 22 the following: “personal information has the same meaning as in section 3 of the Privacy Act. (renseignements personnels)” (b) adding after line 13 on page 31 the following: “26.1 For greater certainty, nothing in this Act affects the provisions of the Privacy Act in relation to the protection of personal information.” |
| That Bill C-8, in Clause 11, be amended by replacing line 32 on page 26 with the following: “those risks. 15.1 The Communications Security Establishment may, in consultation with relevant industry stakeholders, develop guidelines on the mitigation of risks associated with supply chains and the use of third-party products and services, taking into consideration internationally recognized frameworks such as those developed by the International Organization for Standardization on cybersecurity in supplier relationships.” |
| That Bill C-8, in Clause 11, be amended by adding after line 24 on page 27 the following: “18.1 For greater certainty, nothing in sections 17 and 18 affects the provisions of the Personal Information Protection and Electronic Documents Act.” |
| That Bill C-8, in Clause 11, be amended by adding after line 2 on page 28 the following: “(1.1) Despite subsection (1), the Governor in Council must not order the decoding of an encrypted private communication, as defined in section 183 of the Criminal Code.” |
| That Bill C-8, in Clause 11, be amended by adding after line 9 on page 28 the following: “(b.1) its impact on the privacy of Canadians;” |
| That Bill C-8, in Clause 11, be amended by adding after line 15 on page 28 the following: “(3.1) The provisions of the direction must, in scope and substance, be reasonable in relation to the purpose of protecting a critical cyber system.” |
| That Bill C-8, in Clause 11, be amended by adding after line 24 on page 32 the following: “29.1 Any personal information, as defined in section 3 of the Privacy Act, that is collected or obtained under this Act must be disposed of if it is no longer necessary for the purposes for which it was collected or obtained or for verifying compliance or preventing non-compliance with this Act, and in accordance with any requirement under the Privacy Act that applies to it.” |
| That Bill C-8, in Clause 11, be amended by adding after line 24 on page 32 the following: “29.1 For greater certainty, nothing in this Act affects the provisions of the Communications Security Establishment Act in relation to the protection of personal information.” |
| That Bill C-8, in Clause 11, be amended by replacing line 26 on page 58 with the following: “(a) $500,000, in the case of an individual; and” |
| That Bill C-8, in Clause 11, be amended by replacing lines 34 to 36 on page 83 with the following: “ernor in Council must, to the extent possible, ensure consistency with existing regulatory and standards regimes, such as those established by provincial regulatory agencies or recognized industry standards development organizations. (3) In making regulations under subsection (1), the Governor in Council may provide that compliance with a requirement under a regulatory or standards regime referred to in subsection (2) is deemed to be compliance with any corresponding requirement under this Act.” |
| That Bill C-8, in Clause 11, be amended by adding after line 17 on page 87 the following: “148 Nothing in this Act may be construed as affecting solicitor-client privilege or, in Quebec, the professional secrecy of advocates and notaries.” |
| New Clause 17 |
| That Bill C-8 be amended by adding after line 3 on page 89 the following new clause: “Five-year Review 17 (1) Within five years after the day on which this Act receives royal assent, the Minister must complete a review of the provisions enacted or amended by this Act. (2) Within 90 days after the conclusion of the review, the Minister must complete a report on the review that sets out the Minister’s findings on the effectiveness of the measures provided by this Act respecting offences that are more easily committed using cyber technology, among other matters, and the Minister’s recommendations, including any changes to any Act, such as the Criminal Code. (3) The Minister must cause the report to be tabled before each House of Parliament on any of the first 15 days on which that House is sitting after the report is completed.” |
| Your committee has ordered a reprint of Bill C-8, as amended, as a working copy for the use of the House of Commons at the report stage. |
| A copy of the relevant Minutes of Proceedings (Meetings Nos. 9, 10, 12, 18, 20 to 23, 25 and 26) is tabled. |