This House of Commons committee meeting on Bill C-8, an act respecting cybersecurity, heard from eight witnesses. The committee also debated motions on scheduling for Bill C-12 and Bill C-8 before hearing testimony.
Jennifer Quaid, Executive Director of the Canadian Cyber Threat Exchange, supported Bill C-8 as a major step in modernizing Canada's cybersecurity framework but argued that safe harbour legislation is missing. She explained that safe harbour protections would allow organizations to share information about cyber-attacks that fall below the breach threshold, enabling prevention rather than just mandatory reporting after the fact, and noted that such protections exist in the U.S.
Philip Stupak, Senior Director of Advocacy at ISC2, Inc., expressed strong support for Bill C-8, calling it essential for defending against adversaries actively working to undermine critical infrastructure. He recommended adding federally regulated water systems to the list of critical sectors and encouraged federal-provincial coordination on infrastructure cybersecurity, and he disagreed with Intelligence Commissioner Simon Noël's assertion that cyber-attack response often requires accessing content, arguing that technical information is usually sufficient.
Hon. Simon Noël, Intelligence Commissioner, supported the bill's intent but recommended adding independent oversight for information shared with the Communications Security Establishment (CSE) during cyber-incidents. He argued that, based on his experience with 12 Canadian cyber-incidents, content is sometimes necessary for analysis, and proposed that ministerial authorizations for CSE activities be subject to review and approval by the Intelligence Commissioner, disagreeing with Philip Stupak on this point.
Philippe Dufresne, Privacy Commissioner of Canada, supported the bill's cybersecurity objectives but identified three areas of concern: the need for a uniform necessity-and-proportionality standard for personal information collection, minimum privacy safeguards in information-sharing agreements with foreign governments, and a requirement that CSE notify his office of material privacy breaches. He noted that proposed section 15.2 of the Telecommunications Act already incorporates a reasonableness test, but other sections use only a relevance test.
Josh Dehaas, Counsel for the Canadian Constitution Foundation, raised serious concerns about proposed section 15.2, arguing it could allow unconstitutional limits on freedom of expression by letting the minister cut individuals off from Internet or phone services based on "any threat" without proper due process. He proposed five amendments, including requiring serious systemic risks, explicit judicial review, publication of orders within 90 days unless a Federal Court judge orders secrecy, and appointment of an amicus curiae for affected individuals.
Aaron Shull, Managing Director and General Counsel for the Centre for International Governance Innovation, supported the bill but recommended several amendments, including adding statutory criteria for non-disclosure orders, creating a secure disclosure channel for publicly traded companies to avoid securities law breaches, and adding an explicit immunity-use clause for compelled information to avoid charter challenges. He also noted a potential drafting error with duplicate reporting requirements and differing liability standards for companies under the Telecommunications Act and the Critical Cyber Systems Protection Act.
Luc Lefebvre, Chairman and Co-founder of Crypto Québec, argued that Bill C-8 could weaken Quebec's existing privacy regime under Bill 25 by creating a parallel system with less stringent protections. He recommended that the bill explicitly recognize Quebec's standards, include a ban on undermining encryption, require a proportionality test for orders, and mandate reporting to Quebec authorities when sensitive data is collected or shared.
Sharon Polsky, President of the Privacy and Access Council of Canada, criticized the bill for lacking adequate safeguards against abuse, arguing that broad ministerial powers to order telecommunications providers to do anything could be used for ideological attacks or to silence dissent. She recommended clear language to prevent encryption-busting back doors, personal liability for executives to ensure accountability, and specific definitions of what risks must be mitigated, warning that the bill could allow individuals to be cut off from Internet and phone services unjustly.
After the testimony, the committee debated and amended a motion on Bill C-8 scheduling, with the Bloc Québécois successfully moving an amendment to add the Minister of Industry as a witness alongside the Minister of Public Safety. The committee also amended a motion on Bill C-12 to require the minister to appear separately for each bill, and agreed to complete clause-by-clause consideration of Bill C-12 after the fourth meeting of witness testimony.
AI-generated summary — may contain errors; verify against the official evidence.