A Status Update On Bill C-8

Bill C-8 Overview

The bill completed its journey through the House of Commons on March 26^th, and was introduced in the Senate on the same day. Second Reading was completed on April 23^rd, and the bill was referred to the Standing Senate Committee on National Security, Defence and Veterans Affairs.

Thus far, the bill has had one committee hearing, held on May 4, 2026, and heard from a plethora of witnesses, including Public Safety Minister Gary Anandasangaree. Others included senior departmental officials, plus Communications Security Establishment Canada (CSE), the Canada Energy Regulator, Bruce Power, and the Canadian Telecommunications Association.

CSE noted the following in relation to privacy considerations:

CSE recognizes the importance of protecting privacy and takes this responsibility seriously. The specific requirements for incident reporting have not yet been finalized. The design of the reporting framework—including the structure and types of data collected—will be developed through a regulatory process that includes consultation and engagement with industry stakeholders. This process will help ensure that only necessary and appropriate technical information is collected. Potential data elements may include indicators of compromise, exploited vulnerabilities, tactics, techniques, and procedures used by threat actors, and other technical details relevant to incident analysis. This data can include information that has a Canadian privacy interest, such as suspected malicious IP addresses or a username, but it does not include information like the content of emails, credit card numbers, relationships, or birth dates. All information collected will be handled in accordance with the CSE Act and other applicable legislation, including the Privacy Act. Protecting the privacy of Canadians is a legal requirement that underpins all of CSE’s activities. In accordance with the CSE Act, it is important to note that CSE’s operations are not directed at Canadians or persons in Canada and are conducted in full compliance with the Canadian Charter of Rights and Freedoms.

I am including a follow-up written statement from the Office of the Intelligence Commissioner, that arose from questions during the meeting. In the document, the Intelligence Commissioner calls for additional oversight.

Conclusion

In previous testimony during the House of Commons’ deliberations on this bill, Todd Warnell of Bruce Power had noted the following:

Bill C-8 aims to secure essential systems, encourage proactive risk management and enable responsible government intervention in cases of significant cyber-threat.
The critical cyber systems protection act will introduce a broad framework from which all critical sectors, in collaboration with government and the regulators, can develop and implement risk-informed and performance-based regulations to enhance the reliability and resilience of critical services.
The Security and Defence Committee has no meetings currently scheduled, but CHG can follow up with individual Senators who serve on that committee, to seek additional information on projected timelines, etc.