SECU Committee Report

Clause 6

That Bill C-22, in Clause 6, be amended by replacing lines 21 to 24 on page 7 with the following:

“produce a document containing the subscriber information referred to in any of paragraphs (a) to (c) of the definition subscriber information in section 487.011

(a) that is specified by the justice or judge in the order;

(b) that relates to any information, including transmission data, that is specified in the order; and

(c) that is in the person’s possession or control when they receive the order.”

Clause 31

That Bill C-22, in Clause 31, be amended by replacing line 24 on page 28 with the following:

“whether or not they provide or have provided telecommunications services to”

Clause 34

That Bill C-22, in Clause 34, be amended by replacing lines 21 to 24 on page 32 with the following:

“cations under sections 20.23 and 20.5 and the hearing of such applications; and”

Clause 41

That Bill C-22, in Clause 41, be amended by replacing line 25 on page 37 with the following:

“a credible risk, based on recognized international technical standards, that secure information could be ac‐”

That Bill C-22, in Clause 41, be amended by replacing line 27 on page 37 with the following:

“thority to do so, other than a risk that relates only to information related to persons with respect to whom a warrant, order or other authority to access information conferred under the Criminal Code or the Canadian Security Intelligence Service Act — or any similar authority conferred under another Act of Parliament — applies. (“vulnérabilité systémique”)”

That Bill C-22, in Clause 41, be amended by adding after line 4 on page 38 the following:

“(4) No obligations under this Act are to be construed as compelling an electronic service provider to decrypt, or to ensure that an authorized person is able to decrypt, any information that is encrypted by a person to whom the electronic service provider provides services, unless the encryption was provided by the electronic service provider and the provider possesses the information necessary to decrypt the information.”

That Bill C-22, in Clause 41, be amended by replacing lines 15 and 16 on page 38 with the following:

“lating to the obligations of core providers, respecting”

That Bill C-22, in Clause 41, be amended by replacing line 25 on page 38 with the following:

“equipment or other thing by core providers that may enable an autho‐”

That Bill C-22, in Clause 41, be amended by replacing line 34 on page 38 with the following:

“not exceeding six months.”

That Bill C-22, in Clause 41, be amended by adding after line 26 on page 39 the following:

“(4.1) The Governor in Council may make a regulation requiring the retention of a category of metadata under paragraph (2)(d) only if the Governor in Council is satisfied that the category and all its elements are essential for facilitating effective and timely investigations under the Criminal Code or for facilitating the effective and timely exercise of powers or performance of duties and functions under the Canadian Security Intelligence Service Act.”

That Bill C-22, in Clause 41, be amended

(a) by replacing lines 30 and 31 on page 39 with the following:

“provision would have the effect of requiring the provider to introduce a systemic vulnerability related to that service or of preventing the”

(b) by replacing lines 33 and 34 on page 41 with the following:

“would have the effect of requiring the provider to introduce a systemic vulnerability related to that service or of preventing the provider”

That Bill C-22, in Clause 41, be amended by adding after line 32 on page 39 the following:

“(6) For greater certainty, subsection (2) does not authorize the making of regulations that confer an authority to access personal information about the persons to whom the core provider provides services.”

That Bill C-22, in Clause 41, be amended by adding after line 2 on page 40 the following:

“(1.1) The order may contain provisions respecting the disclosure of information contained in it and the disclosure of the fact that the core provider is subject to it.”

That Bill C-22, in Clause 41, be amended by replacing line 17 on page 40 with the following:

“(4) Within 90 days after the day on which the application is submitted, or within any other period that may be agreed on by the Minister and the core provider,”

That Bill C-22, in Clause 41, be amended by replacing line 31 on page 40 with the following:

“fy a period, not exceeding two years, during which it is valid.”

That Bill C-22, in Clause 41, be amended by adding after line 31 on page 40 the following:

“(1.1) The order may also contain provisions respecting the disclosure of information contained in it and the disclosure of the fact that the electronic service provider is subject to it.”

That Bill C-22, in Clause 41, be amended by

(a) replacing line 1 on page 41 with the following:

“(2) The order is not valid unless it is approved by the In-”

(b) replacing line 3 on page 41 with the following:

“Intelligence Commissioner Act and the Intelligence Com-”

That Bill C-22, in Clause 41, be amended by replacing line 6 on page 41 with the following:

“(3) In deciding whether to make the order, the Minister must take into ac‐”

That Bill C-22, in Clause 41, be amended by adding after line 12 on page 42 the following:

“(3) Within 30 days after the day on which a decision of the Intelligence Commissioner under paragraph 20(1)(a) of the Intelligence Commissioner Act is received, the Minister must provide the National Security and Intelligence Review Agency with a copy of the order, along with all the information that was provided to the Intelligence Commissioner under subsection 23(1) of the Intelligence Commissioner Act, for the purpose of assisting the Agency in fulfilling its mandate under paragraphs 8(1)(a) to (c) of the National Security and Intelligence Review Agency Act.

(4) For greater certainty, the disclosure under subsection (3) of any information that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege does not constitute a waiver of those privileges or that secrecy.”

That Bill C-22, in Clause 41, be amended by replacing, in the English version, line 14 on page 42 with the following:

“7(1) is valid for the period specified in the order.”

That Bill C-22, in Clause 41, be amended by replacing lines 17 and 18 on page 42 with the following:

“under subsection 7(1).”

That Bill C-22, in Clause 41, be amended by deleting lines 19 to 25 on page 42.

That Bill C-22, in Clause 41, be amended by replacing line 26 on page 42 with the following:

“12 Subject to subsection 7(5), an electronic service provider that is subject to an or-”

That Bill C-22, in Clause 41, be amended by replacing line 1 on page 44 with the following:

“(c) the fact that the electronic service provider is or was sub-”

That Bill C-22, in Clause 41, be amended by deleting lines 10 to 12 on page 44.

That Bill C-22, in Clause 41, be amended by adding after line 13 on page 44 the following:

“15.1 (1) At an electronic service provider’s request, the Minister may issue a written authorization permitting, on any terms that the Minister considers reasonable, the electronic service provider to disclose any information referred to in section 15.

(2) However, if the information that is the subject of a request made under subsection (1) is relevant to the exercise of a regulatory authority’s powers or to the performance of its duties or functions, the Minister must issue a written authorization permitting, on any terms that the Minister considers reasonable, the electronic service provider to disclose that information to that authority.

(3) The Statutory Instruments Act does not apply to an authorization issued under this section.

(4) In this section, “regulatory authority” means a person that has powers, duties or functions relating to the administration or enforcement of an Act of Parliament or of the legislature of a province and includes a person that is prescribed to be a regulatory authority.”

That Bill C-22, in Clause 41, be amended by adding after line 20 on page 48 the following:

“(2.1) The electronic service provider is not required to comply with a provision of the order, with respect to an electronic service, if compliance with that provision would require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability.”

That Bill C-22, in Clause 41, be amended by replacing line 23 on page 48 with the following:

“25 (1) Subject to subsection 24(2.1), an electronic service provider that is subject to”

That Bill C-22, in Clause 41, be amended by adding after line 16 on page 49 the following:

“(3) Within 30 days after the day on which the time period referred to in subsection 26(2) ends, the Minister must, for the purpose of assisting the National Security and Intelligence Review Agency in fulfilling its mandate under paragraphs 8(1)(a) to (c) of the National Security and Intelligence Review Agency Act, notify the Agency of the following:

(a) the fact that an order was made under subsection 24(1) and the identity of the electronic service provider that is subject to the order;

(b) the provisions that were contravened, according to the order; and

(c) any notification of compliance the electronic service provider gave under subsection 25(2).

(4) The notice must also include a statement indicating whether the electronic service provider made a request for review to the Minister under subsection 26(1) and setting out the grounds for review.

(5) If an electronic service provider makes a request for review under subsection 26(1), the Minister must, for the purpose of assisting the National Security and Intelligence Review Agency in fulfilling its mandate under paragraphs 8(1)(a) to (c) of the National Security and Intelligence Review Agency Act, notify the Agency of the decision and the reasons for it within 30 days after the day on which the review is completed.”

That Bill C-22, in Clause 41, be amended by replacing line 29 on page 56 with the following:

“for the purposes of this Act, other than the terms and expressions defined in it;”