An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts

How it changed on the way

14% of the text as introduced was changed or removed by the time it became law (29,232 words introduced, 29,762 passed). A committee amended it.

moderate changeintent mostly kept

The bill kept its core structure for protecting critical cyber systems and amending the Telecommunications Act but added rules on disposing of personal information and a five-year review. Several clarifying clauses on risk guidelines, certainty, and information handling were inserted during passage.

• Expanded clause (d) to require disposal of personal information when exchanging data.

  Before: “(d) provides for the exchange of information between relevant parties;”

  After: “(d) provides for the exchange of information between relevant parties and the disposal of personal information;”

• Added Part 3 requiring a five-year review of the Act.

  After: “Part 3 provides for a five-year review of the provisions enacted or amended by this Act.”

• Inserted new section 15.1 on guidelines for mitigating supply-chain risks.

  After: “15.1 Guidelines on mitigation of risks”

• Added sections 29.1 and 29.2 on disposal of personal information and related certainty.

  After: “29.1 Disposal of personal information 29.2 For greater certainty”

How precisely it is written

vagueChallenging the law: EasyDisputing a charge: Hard

The provisions rely heavily on ministerial beliefs about necessity and reasonableness tied to undefined threats, leaving wide room for argument. Multiple opinion-based tests and non-disclosure clauses make coverage hard to predict in advance.

Open to argument

• “If the Governor in Council believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat”

  Subjective belief standard tied to an open-ended concept of threat invites prolonged disputes over when the power applies.

• “the extent to which the disclosure could, in the Governor in Council’s opinion, compromise the objective of the order”

  Reliance on the decision-maker’s own opinion about compromise creates a subjective test rather than an objective one.

• “the Minister believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat”

  Same belief-and-necessity formulation repeats across ministerial orders, broadening discretion without clear limits.

• “or (b) in the Minister's opinion, the disclosure is necessary to secure the Canadian telecommunications system”

  Opinion-based necessity test for information sharing again substitutes subjective judgment for defined criteria.

Clear-cut

• “Despite paragraph (1)(b), no order may be made directing the suspension of service to an individual, unless the order is necessary to secure the Canadian telecommunications system against any speci”

  Explicit carve-out with a technical-nature qualifier narrows one category of power in objective terms.

Discretion. Ministers and the Governor in Council retain broad discretion to decide what constitutes a threat, whether action is necessary and reasonable relative to its gravity, and whether disclosure would compromise objectives, with many details left to orders and regulations.

Challenging the law itself. The repeated use of belief, opinion, and open-ended necessity tests engages vagueness and overbreadth doctrines under section 7 of the Charter, making facial challenges relatively straightforward.

Disputing a charge under it. Because the orders themselves can be unpublished and rest on the issuer’s assessment of threats and necessity, an accused faces difficulty proving they were not properly notified or that the order exceeded its scope.

Read by a language model from the royal assent text; every quoted phrase appears in the bill. A reading of the drafting, not legal advice.