This Part also makes consequential amendments to certain Acts.

TABLE OF PROVISIONS

15.‍1 (1) If the Governor in Council believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, the Governor in Council may, by order and after consultation with the persons the Governor in Council considers appropriate,

(1.‍1) The provisions of the order must, in scope and substance, be reasonable to the gravity of the threat of interference, manipulation, disruption or degradation.

(2) The order may also include a provision prohibiting the disclosure of its existence, or some or all of its contents, by any person.

(2.‍1) Before making the order, the Governor in Council must consider

(3) The Governor in Council may cause a draft order to be published in the Canada Gazette.

(4) Any order made under subsection (1) must be published in the Canada Gazette within 90 days after the day on which it is made, unless the Governor in Council directs otherwise in the order.

(5) In the event of any inconsistency between an order made under subsection (1) and a decision of the Commission made under this Act or an order made or an authorization issued by the Minister under this Act or the Radiocommunication Act, the order made under subsection (1) prevails to the extent of the inconsistency.

(6) No one is entitled to any compensation from Her Majesty in right of Canada for any financial losses resulting from the making of an order under subsection (1).

15.‍2 (1) If there are reasonable grounds to believe that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, the Minister may, by order and after consultation with the Minister of Public Safety and Emergency Preparedness and with the persons the Minister considers appropriate,

(2) If the Minister believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, the Minister may, by order,

(2.‍1) The provisions of an order made under subsection (1) or (2) must, in scope and substance, be reasonable to the gravity of the threat of interference, manipulation, disruption or degradation.

(2.‍2) For greater certainty, despite subsection (2), the Minister is not permitted to order a telecommunications service provider to intercept a private communication or a radio-based telephone communication, as those terms are defined in section 183 of the Criminal Code.

(3) An order made under subsection (1) or (2) may also include a provision prohibiting the disclosure of its existence, or some or all of its contents, by any person.

(3.‍1) Before making an order under subsection (1) or (2), the Minister must consider

(4) The Minister may cause a draft order to be published in the Canada Gazette.

(5) Any order made under subsection (1) or (2) must be published in the Canada Gazette within 90 days after the day on which it is made, unless the Minister directs otherwise in the order.

(6) In the event of any inconsistency between an order made under subsection (1) or (2) and a decision of the Commission made under this Act or another order made, or any authorization issued, by the Minister under this Act or the Radiocommunication Act, the order made under subsection (1) or (2), as the case may be, prevails to the extent of the inconsistency.

(7) No one is entitled to any compensation from Her Majesty in right of Canada for any financial losses resulting from the making of an order under subsection (1) or (2).

15.‍21 (1) The Minister shall cause to be tabled in each House of Parliament, within three months after the end of each fiscal year or, if either House is not then sitting, on any of the first 15 days of the next sitting of that House, a report on the orders made under subsection 15.‍1(1) and subsections 15.‍2(1) and (2).

(2) The Minister shall include in the report, for the fiscal year covered by the report, the following information:

(3) The report shall state the number of times that an order prevailed over a decision of the Commission made under this Act during previous fiscal year.

15.‍22 The Minister must, within 90 days after an order that includes a provision prohibiting the disclosure of its existence, or some or all of its contents, is made under section 15.‍1 or 15.‍2, notify the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency of the making of the order.

15.‍3 (1) No person shall be convicted of an offence consisting of a contravention of an order made under section 15.‍1 or 15.‍2 unless it is proved that, at the time of the alleged contravention, the person had been notified of the order.

(2) A certificate appearing to have been signed by the Minister and stating that a notice containing the order made under section 15.‍1 or 15.‍2 was given to persons likely to be affected by it is, in the absence of evidence to the contrary, proof that notice was given to those persons.

(3) The Statutory Instruments Act does not apply to an order made under section 15.‍1 or 15.‍2.

(4) An order made under section 15.‍1 or 15.‍2 may incorporate any document by reference, in whole or in part, regardless of its source and as it exists on a particular date or as it is amended from time to time.

15.‍4 The Minister may require any person to provide to the Minister or any person designated by the Minister, within any time and subject to any conditions that the Minister may specify, any information that the Minister believes on reasonable grounds is relevant for the purpose of making, amending or revoking an order under section 15.‍1 or 15.‍2 or a regulation under paragraph 15.‍8(1)‍(a), or of verifying compliance or preventing non-compliance with such an order or regulation.

15.‍5 (1) A person who provides any of the following information under section 15.‍4 may designate it as confidential:

(1.‍1) The following definitions apply in paragraph (1)‍(d).

(2) Subject to subsection (3), no person shall knowingly disclose or knowingly permit to be disclosed any information that is designated as confidential.

(3) Information that is designated as confidential may be disclosed, or be permitted to be disclosed, if

15.‍6 (1) Despite section 15.‍5, to the extent that is necessary for any purpose related to the making, amending or revoking of an order under section 15.‍1 or 15.‍2 or a regulation under paragraph 15.‍8(1)‍(a) — or to verifying compliance or preventing non-compliance with such an order or regulation — the following persons and entities may collect information from and disclose information to each other, including confidential information:

(2) Any confidential information that is collected under subsection (1) must be treated as confidential.

15.‍7 (1) Any information collected or obtained under this Act, other than information designated as confidential under subsection 15.‍5(1), may be disclosed by the Minister under an agreement, a memorandum of understanding or an arrangement in writing between the Government of Canada and the government of a province or of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, if the Minister believes that the information may be relevant to securing the Canadian telecommunications system or the telecommunications system of a foreign state, including against the threat of interference, manipulation or disruption.

(2) If the agreement, memorandum of understanding or arrangement allows for the sharing of information that may be relevant to an investigation or proceeding in respect of a contravention of this Act, an order made under section 15.‍1 or 15.‍2 or a regulation made under paragraph 15.‍8(1)‍(a) — or a law of a foreign state that addresses conduct that is substantially similar to conduct that would be in contravention of this Act, of an order made under section 15.‍1 or 15.‍2 or of a regulation made under paragraph 15.‍8(1)‍(a) — the agreement, memorandum of understanding or arrangement must restrict the use of that information to purposes relevant to contraventions of the laws of a foreign state that have consequences that would not be considered penal under Canadian law.

15.‍71 For greater certainty, nothing in sections 15.‍1, 15.‍2 and 15.‍4 to 15.‍7 affects the provisions of the Privacy Act.

15.‍8 (1) The Governor in Council may make regulations

(2) In the event of any inconsistency between a regulation made under paragraph (1)‍(a) and a decision of the Commission made under this Act or an order made or an authorization issued by the Minister under this Act or the Radiocommunication Act, the regulation prevails to the extent of the inconsistency.

15.‍81 (1) The Minister must, within three months after the end of each fiscal year, prepare a report respecting any orders referred to in sections 15.‍1 and 15.‍2 that were made during that fiscal year and must cause the report to be laid before each House of Parliament within the first 15 days on which that House is sitting after the report is completed.

(2) The report must include the number of orders that were made in that fiscal year.

(3) The report must also state the number of times that an order prevailed over a decision of the Commission made under this Act during the previous fiscal year.

15.‍9 (1) The following rules apply to judicial review proceedings in respect of an order made under section 15.‍1 or 15.‍2 or a regulation made under paragraph 15.‍8(1)‍(a):

(2) Subsection (1) applies to any appeal of a decision made by a judge in relation to the judicial review proceedings referred to in this section and to any further appeal, with any necessary modifications.

(3) In this section, judge means the Chief Justice of the Federal Court or a judge of that Court designated by the Chief Justice.

72.‍131 Every contravention of a provision of an order made under section 15.‍1 or 15.‍2 or a regulation made under paragraph 15.‍8(1)‍(a) constitutes a violation and the person who commits the violation is liable to an administrative monetary penalty of an amount

72.‍132 A violation that is continued on more than one day constitutes a separate violation in respect of each day during which it is continued.

72.‍133 (1) The amount of the administrative monetary penalty is to be determined by taking into account the following factors:

(2) The purpose of the penalty is to promote compliance with orders made under section 15.‍1 and 15.‍2 and regulations made under paragraph 15.‍8(1)‍(a), and not to punish.

72.‍134 The Minister may

72.‍135 (1) A person who is designated to issue notices of violation and who believes, on reasonable grounds, that a person has committed a violation may issue and cause to be served on the person, a notice of violation.

(2) The notice of violation must name the person believed to have committed the violation, identify the violation and include

(3) At any time before a request to make representations in respect of the notice of violation is received by the Minister, the designated person may cancel the notice or correct an error in it.

72.‍136 (1) If a person who is served with a notice of violation pays the penalty set out in the notice, the person is deemed to have committed the violation and the proceedings in respect of it are ended.

(2) If a person who is served with a notice of violation makes representations in accordance with the notice, the Minister must decide, on a balance of probabilities, after considering those representations, whether the person committed the violation and, if the Minister so decides, the Minister may impose the penalty set out in the notice, a lesser penalty or no penalty.

(3) If a person who is served with a notice of violation neither pays the penalty nor makes representations in accordance with the notice, the person is deemed to have committed the violation and the Minister may impose the penalty set out in the notice.

(4) The Minister must cause a copy of any decision made under subsection (2) or (3) to be issued and served on the person.

72.‍137 (1) If a person designated under paragraph 72.‍134(a) offers to enter into a compliance agreement with the person believed to have committed the violation, the agreement is subject to any terms that the designated person considers appropriate, including the reduction, in whole or in part, of the penalty set out in the notice of violation.

(2) If a compliance agreement is entered into, the person who entered into it cannot make any representations under paragraph 72.‍135(2)‍(b).

(3) A person who enters into a compliance agreement with a designated person is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the designated person is of the opinion that a person who has entered into a compliance agreement has complied with it, the designated person must serve a notice to that effect on the person and, on the service of that notice, the proceedings in respect of the violation are ended.

(5) If the designated person is of the opinion that a person who has entered into a compliance agreement has not complied with it, the designated person must cause the person to be served with a notice of default informing them that they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement.

(6) If a person pays the penalty in accordance with the notice of default, the proceedings in respect of the violation are ended.

72.‍138 An officer, director or agent or mandatary of a corporation that commits a violation is liable for the violation if they directed, authorized, assented to, acquiesced in or participated in the commission of the violation, whether or not the corporation is proceeded against.

72.‍139 (1) A penalty and any interest due in respect of the penalty constitute a debt due to Her Majesty in right of Canada and may be recovered in the Federal Court or any other court of competent jurisdiction.

(2) A proceeding to recover such a debt may not be commenced later than five years after the day on which the debt becomes payable.

(3) A penalty paid or recovered in relation to a violation is payable to the Receiver General.

(4) The Minister may issue a certificate for the unpaid amount of any debt referred to in subsection (1).

(5) Registration in the Federal Court of a certificate issued under subsection (4) has the same effect as a judgment of that Court for a debt of the amount specified in the certificate and all related registration costs.

72.‍1391 (1) A proceeding in respect of a violation may not be commenced later than three years after the day on which the subject-matter of the proceeding becomes known to the Minister.

(2) A document appearing to have been issued by the Minister, certifying the day on which the subject-matter became known to the Minister, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it.

72.‍1392 The Minister may make public

72.‍1393 The Governor in Council may make regulations

5 A judge of the Federal Court, for the purposes of section 15.‍9 of the Telecommunications Act

An Act respecting the protection of critical cyber systems in the federally regulated sector

Short Title

Definitions

appropriate regulator means, in respect of a designated operator, the regulator set out in column 2 of Schedule 2 that corresponds to the class of operators to which the designated operator belongs.‍ (organisme réglementaire compétent)

Bank means the Bank of Canada established by subsection 3(1) of the Bank of Canada Act.‍ (Banque)

Canadian Energy Regulator means the Canadian Energy Regulator established by subsection 10(1) of the Canadian Energy Regulator Act.‍ (Régie canadienne de l’énergie)

Canadian Nuclear Safety Commission means the Commission established by subsection 8(1) of the Nuclear Safety and Control Act.‍ (Commission canadienne de sûreté nucléaire).

Chief Executive Officer has the same meaning as in section 2 of the Canadian Energy Regulator Act.‍ (président-directeur général)

Commission means the Commission referred to in subsection 26(1) of the Canadian Energy Regulator Act.‍ (Commission)

confidential information means any information obtained under this Act in respect of a critical cyber system that

• (a) concerns a vulnerability of any designated operator’s critical cyber system or the methods used to protect that system and that is consistently treated as confidential by the designated operator;

• (b) if disclosed could reasonably be expected to result in material financial loss or gain to, or could reasonably be expected to prejudice the competitive position of, a designated operator; or

• (c) if disclosed could reasonably be expected to interfere with contractual or other negotiations of a designated operator.‍ (renseignements confidentiels)

critical cyber system means a cyber system that, if its confidentiality, integrity or availability were compromised, could affect the continuity or security of a vital service or vital system.‍ (cybersystème essentiel)

cyber security incident, in respect of a critical cyber system, means an incident, including an act, omission or circumstance, that interferes or may interfere with

• (a) the continuity or security of a vital service or vital system; or

• (b) the confidentiality, integrity or availability of the critical cyber system.‍ (incident de cybersécurité)

cyber system means a system of interdependent digital services, technologies, assets or facilities that form the infrastructure for the reception, transmission, processing or storing of information.‍ (cybersystème)

designated operator means a person, partnership or unincorporated organization that belongs to any class of operators referred to in Schedule 2.‍ (exploitant désigné)

Governor has the same meaning as in section 2 of the Bank of Canada Act.‍ (gouverneur)

Minister means the Minister of Public Safety and Emergency Preparedness or, if another federal minister is designated under section 4, that minister.‍ (ministre)

regulator means

• (a) the Minister of Industry;

• (b) the Minister of Transport;

• (c) the Superintendent;

• (d) the Bank;

• (e) the Canadian Energy Regulator; or

• (f) the Canadian Nuclear Safety Commission.‍ (organisme réglementaire)

responsible minister means the minister responsible for an Act that is ordinarily administered by an appropriate regulator with respect to any class of operators set out in Schedule 2.‍ (ministre compétent)

Superintendent means the Superintendent of Financial Institutions appointed under subsection 5(1) of the Office of the Superintendent of Financial Institutions Act.‍ (surintendant)

Tribunal means the Transportation Appeal Tribunal of Canada that is established under subsection 2(1) of the Transportation Appeal Tribunal of Canada Act.‍ (Tribunal)

vital service means a service that is referred to in Schedule 1.‍ (service critique)

vital system means a system that is referred to in Schedule 1.‍ (système critique)

Application

Purpose

• (a) any cyber security risks in respect of critical cyber systems are identified and managed, including risks associated with supply chains and the use of third-party products and services;

• (b) critical cyber systems are protected from being compromised;

• (c) any cyber security incidents affecting, or having the potential to affect, critical cyber systems are detected; and

• (d) the impacts of cyber security incidents affecting critical cyber systems are minimized.

Vital Services and Vital Systems

Designated Operators of Critical Cyber Systems

• (a) adding

  • (i) a class of operators — consisting of persons, partnerships or unincorporated organizations that operate a work or carry on an undertaking or business that is within the legislative authority of Parliament — in respect of a vital service or vital system, and

  • (ii) the regulator for that class; or

• (b) amending or deleting a class of operators or the regulator for that class.

Cyber Security Program

• (a) identify and manage any organizational cyber security risks, including risks associated with the designated operator’s supply chain and its use of third-party products and services;

• (b) protect its critical cyber systems from being compromised;

• (c) detect any cyber security incidents affecting, or having the potential to affect, its critical cyber systems;

• (d) minimize the impact of cyber security incidents affecting critical cyber systems; and

• (e) do anything that is prescribed by the regulations.

• (a) any material change in the designated operator’s ownership or control;

• (b) any material change in the designated operator’s supply chain or in its use of third-party products and services; and

• (c) any circumstances that are prescribed by the regulations.

Mitigation of Supply-chain and Third-party Risks

Reporting of Cyber Security Incidents

• (a) notify the appropriate regulator, in the form and manner prescribed by the regulations that the report was made; and

• (b) give a copy of the report to the appropriate regulator.

Cyber Security Directions

• (a) its operational impacts on affected designated operators;

• (b) its impact on public safety of Canadians;

• (c) its financial impacts on affected designated operators;

• (d) its impact on the delivery of vital services and vital systems to consumers; and

• (e) any other factor that the Governor in Council considers to be relevant.

• (a) the name of the designated operator or the class of operators in respect of which the direction applies;

• (b) the measures to be taken by the designated operator along with any conditions; and

• (c) the period within which those measures are to be taken.

• (a) the Minister;

• (b) the responsible minister;

• (c) the appropriate regulator;

• (d) the Minister of Foreign Affairs;

• (e) the Minister of National Defence;

• (f) the Chief of the Defence Staff;

• (g) the Chief or an employee of the Communications Security Establishment;

• (h) the Director or an employee of the Canadian Security Intelligence Service; and

• (i) any other person or entity that is prescribed by the regulations.

Disclosure and Use of Information

• (a) the disclosure is required by law;

• (b) the information to be disclosed is publicly available;

• (c) the designated operator to which the information relates consents to its disclosure;

• (d) the disclosure is necessary for the protection of vital services, vital systems or critical cyber systems;

• (e) the disclosure is made in accordance with any provision of this Act; or

• (f) the disclosure is made in accordance with the Security of Canada Information Disclosure Act.

• (a) between the Minister, the responsible minister or the regulator, as the case may be, and any institution or agency of that government; or

• (b) between the Minister, the responsible minister or the regulator, as the case may be, and the international organization.

• (a) it is disclosed under the agreement or arrangement; and

• (b) the Minister, the responsible minister or the regulator, as the case may be, is satisfied that the information will be treated in a confidential manner and not be further disclosed without their express consent.

Record Keeping

• (a) any steps taken to implement the designated operator’s cyber security program;

• (b) every cyber security incident that the designated operator reported under section 17;

• (c) any steps taken by the designated operator under section 15 to mitigate any supply-chain or third-party risks;

• (d) any measures taken by the designated operator to implement a cyber security direction; and

• (e) any matter prescribed by the regulations.

Administration and Enforcement

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• (a) the dwelling-house is a place referred to in subsection 32(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 32(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• (a) the dwelling-house is a place referred to in subsection 41(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 41(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• (a) the dwelling-house is a place referred to in subsection 50(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 50(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• (a) the dwelling-house is a place referred to in subsection 59(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 59(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• (a) the dwelling-house is a place referred to in subsection 68(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 68(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• (a) the name of the designated operator or other person to which the notice is directed;

• (b) the provision of this Act or of the regulations made under it that is alleged to have been contravened or the order or decision that is alleged to have been contravened;

• (c) the relevant facts surrounding the alleged contravention; and

• (d) the period within which the designated operator or other person may provide comments in response to the notice.

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

• (a) notify, in writing, the designated operator of the terms of the order and the reasons for the order; and

• (b) report the circumstances and terms of the order to the Commission.

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• (a) the dwelling-house is a place referred to in subsection 78(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 78(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

General Provisions

• (a) provide any person with false or misleading information; or

• (b) provide any incident report that contains false or misleading information.

Administrative Monetary Penalties

• (a) $1,000,000, in the case of an individual; and

• (b) $15,000,000, in any other case.

• (a) the appropriate regulator; or

• (b) if the appropriate regulator is the Minister of Transport, by the Tribunal.

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Superintendent specifies, to pay the penalty or to make representations to the Superintendent with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factors prescribed by the regulations; and

• (f) any other factors that the Superintendent considers relevant.

• (a) make representations to the Superintendent in respect of the alleged violation or of the penalty; or

• (b) if the Superintendent offers a compliance agreement, enter into the compliance agreement with the Superintendent to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Superintendent may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 104 specifies, to pay the penalty or to make representations to the Minister of Industry with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factors prescribed by the regulations; and

• (f) any other factors that the person designated under section 104 who issued the notice of violation considers relevant.

• (a) make representations to the Minister of Industry in respect of the alleged violation or of the penalty; or

• (b) if the person designated under section 104 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Minister of Industry may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the Bank considers relevant.

• (a) make representations to the Governor in respect of the alleged violation or of the penalty; or

• (b) if the Bank offers a compliance agreement, enter into the compliance agreement with the Bank to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Bank may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 115 specifies, to pay the penalty or to make representations to the Canadian Nuclear Safety Commission with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the person designated under section 115 who issued the notice of violation considers relevant.

• (a) make representations to the Canadian Nuclear Safety Commission in respect of the alleged violation or of the penalty; or

• (b) if the person designated under section 115 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Canadian Nuclear Safety Commission may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 121 specifies, to pay the penalty or to make representations to the Commission with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the person designated under section 121 who issued the notice of violation considers relevant.

• (a) make representations to the Commission in respect of the alleged violation or of the penalty; or

• (b) if the person designated under section 121 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Canadian Energy Regulator may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Minister of Transport specifies, to pay the penalty and the manner for doing so;

• (c) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Tribunal on application may allow, to file a request to review under paragraph 129(2)‍(a) with respect to the violation or the proposed penalty, or both; and

• (d) the fact that, if the designated operator or other person does not pay the penalty or file a request to review with the Tribunal in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the Minister of Transport considers relevant.

• (a) file a request for a review with the Tribunal in respect of the alleged violation or of the penalty; or

• (b) if the Minister of Transport offers a compliance agreement, enter into the compliance agreement with the Minister of Transport to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

• (a) that the designated operator or other person has not committed a violation, in which case no further proceedings under this Act are to be taken against the designated operator or other person in respect of the alleged violation; or

• (b) that the designated operator or other person has committed a violation, in which case the member must also inform the Minister of Transport and the designated operator or other person of the amount determined by the member, subject to section 128 and the regulations made under paragraph 135(g), to be payable to the Tribunal by or on behalf of the designated operator or other person and the period within which it must be paid.

• (a) to pay the penalty set out in the notice of violation or to file a request for a review under paragraph 129(2)‍(a); or

• (b) to pay the amount determined under paragraph 131(b).

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Minister of Transport may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

Regulations

• (a) respecting cyber security programs;

• (b) respecting any condition and criteria respecting internal audits;

• (c) respecting the form, manner and period for reporting any cyber security incidents referred to in section 17 and the types of incidents that must be reported;

• (c.‍1) respecting the period within which a notification referred to under subsection 14(1) is to be provided;

• (d) respecting the management of records referred to in section 30, including the collection, use, retention, disclosure and disposal of those records;

• (e) designating any provision of this Act or of the regulations made under this Act for the purposes of section 90;

• (f) classifying each violation as a minor violation, a serious violation or a very serious violation;

• (g) fixing the maximum penalty in respect of each violation;

• (h) defining, for the purposes of this Act, any word or expression that is used in this Act but is not defined; and

• (i) prescribing anything that is to be prescribed under this Act.

Offences

• (a) on summary conviction

  • (i) in the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than two years less a day, or to both, and

  • (ii) in the case of a corporation, to a fine in an amount that is in the discretion of the court; or

• (b) on conviction on indictment

  • (i) in the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than five years, or to both, and

  • (ii) in the case of a corporation, to a fine in an amount that is in the discretion of the court.

• (a) evidence of the original document of which it purports to be a copy;

• (b) evidence of the fact that the original document was made, given or issued by or by the authority of or deposited with the person named in it and was made, given or issued at the time stated in the certified copy, if a time is stated in it; and

• (c) evidence of the fact that the original document was signed, certified, attested or executed by the persons and in the manner shown in the certified copy.

• (a) at any time during a proceeding, the judge must, at the Minister’s request, hear submissions on evidence or other information in the absence of the public and of the applicant and their counsel if, in the judge’s opinion, the disclosure of the evidence or other information could be injurious to international relations, national defence or national security or endanger the safety of any person;

• (b) the judge must ensure the confidentiality of the evidence and other information provided by the Minister if, in the judge’s opinion, its disclosure would be injurious to international relations, national defence or national security or endanger the safety of any person;

• (c) throughout the proceeding, the judge must ensure that the applicant is provided with a summary of the evidence and other information available to the judge that enables the applicant to be reasonably informed of the Government of Canada’s case but that does not include anything that, in the judge’s opinion, would be injurious to international relations, national defence or national security or endanger the safety of any person if disclosed;

• (d) the judge must provide the applicant and the Minister with an opportunity to be heard;

• (e) the decision of the judge may be based on evidence or other information available to the judge even if a summary of that evidence or other information has not been provided to the applicant;

• (f) if the judge determines that evidence or other information provided by the Minister is not relevant or if the Minister withdraws the evidence or other information, the decision of the judge must not be based on that evidence or other information and the judge must return it to the Minister; and

• (g) the judge must ensure the confidentiality of all evidence and other information that the Minister withdraws.

General

• (a) the number of orders made under subsection 20(1) and the nature of the directions set out in those orders;

• (b) the number of directions revoked under subsection 20(2);

• (c) the number of designated operators that were subject to a direction;

• (d) description of compliance of designated operators that partially complied with a direction;

• (e) description of compliance of designated operators that fully complied with a direction; and

• (f) an explanation of the necessity, proportionality, reasonableness and utility of the directions.

• (a) the number of directions issued under subsection 20(1) in the immediately preceding fiscal year;

• (b) the number of designated operators that were issued directions under subsection 20(1) in the immediately preceding fiscal year; and

• (c) any other information relating to the immediately preceding fiscal year that the Minister considers relevant, if that information is not likely to be about an identifiable designated operator or other person.

6 A judge of the Federal Court, for the purposes of section 145 of the Critical Cyber Systems Protection Act

23 (1) The Superintendent shall, before December 31 in each year, ascertain the total amount of expenses incurred during the immediately preceding fiscal year for or in connection with the administration of the Bank Act, the Cooperative Credit Associations Act, the Critical Cyber Systems Protection Act, the Green Shield Canada Act, the Insurance Companies Act, the Protection of Residential Mortgage or Hypothecary Insurance Act and the Trust and Loan Companies Act.

Critical Cyber Systems Protection Act

Loi sur la protection des cybersystèmes essentiels

(1.‍1) The Commission may charge any fees that may be prescribed for any information, product or service that it provides under any other Act of Parliament.

(2) The Commission may, under the prescribed circumstances, refund all or part of any fee referred to in paragraph (1)‍(g) or subsection (1.‍1).

(3) The Commission may spend for its purposes the revenue from the fees it charges in the fiscal year in which the revenues are received or in the next fiscal year.

(3) The Tribunal also has jurisdiction in respect of reviews and appeals in connection with administrative monetary penalties provided for under sections 177 to 181 of the Canada Transportation Act, sections 127 to 133 of the Critical Cyber Systems Protection Act, sections 43 to 55 of the International Bridges and Tunnels Act, sections 129.‍01 to 129.‍19 of the Canada Marine Act, sections 16.‍1 to 16.‍25 of the Motor Vehicle Safety Act, sections 39.‍1 to 39.‍26 of the Canadian Navigable Waters Act and sections 130.‍01 to 130.‍19 of the Marine Liability Act.

Item	Vital Services and Vital Systems
1	Telecommunications services
2	Interprovincial or international pipeline and power line systems
3	Nuclear energy systems
4	Transportation systems that are within the legislative authority of Parliament
5	Banking systems
6	Clearing and settlement systems

	Column 1	Column 2
Item	Class of Operators	Regulator