Bill C-26 Amends And Securitizes The Telecommunications Act

An Overview

Since the beginning of 2023, the LCBO, SickKids, Indigo, Cineplex and the National Art Gallery were all hit by cyberattacks. Are these types of attacks on the rise? Absolutely, and the Government of Canada has a plan to establish cyber security legislation. This plan is Bill C-26, and it isn’t without its faults.

First, let’s look at what the bill does. Bill C-26 does two things: it amends and securitizes the Telecommunications Act, and it gives the governor-in-council (Governor General) new powers to direct critical finance, telecommunications, energy and transportation companies to comply with cyber system protection measures.

In Other Words...

cyber systems of industries that are essential to national security and public safety will have to streamline and report their cyberattacks and establish cyber security programs to the governor-in-council. These cyber systems include those in:

Telecommunications services
Interprovincial or international pipeline and power line systems
Nuclear energy systems
Transportation systems that are within the legislative authority of Parliament
Banking systems
Clearing and settlement systems

The operators of these systems have yet to be defined. Importantly, the governor-in-council can amend this list at any time for reasons related to national security and public safety. Not to mention, the legislation also gives more audit powers to regulators, and if companies don’t comply with the bill, they’ll face hefty fines of $1 million to $15 million and possibly other convictions.

Turning to its controversies, these can be summarized in an open letter Public Safety Minister Marco Mendicino received from civil rights groups leading up to the second House of Commons debate on the bill in March 2023. The groups mainly take issue with the bill’s risk of undermining privacy and digital rights, government accountability and judicial due process.

To get into more detail, the letter takes issue with the bill’s lack of privacy safeguards and guardrails to constrain the new powers given to the government. In fact, the bill grants the government the ability to order telecom providers “to do anything or refrain from doing anything” to secure telecom systems and to prohibit a provider from using products or services. In response Mendicino stated in January 2023 that he is “prepared” to work with the House and respond to these concerns, which were echoed in the bill’s second reading in the House by all parties.

Currently...

Bill C-26 is awaiting discussion in the Committee on Public Safety and National Security. That said, Bill C-26 may not reach committee by the time the house rises on June 23 because it has been actively discussing Bill C-21, the gun control legislation, and has now moved on to Bill C-20. You’ll likely see further discussions on Bill C-26 this fall.