🍁 civid v1

Status and source

• The supplied text identifies the measure as assented to on June 15, 2026, although the source label says “third reading.”
• The text is truncated during Part 2. The Part 2 schedules, detailed penalty provisions, consequential amendments and Part 3’s review provisions are not included in the excerpt.

Part 1 — Telecommunications Act

• Adds promoting the security of Canada’s telecommunications system to Canadian telecommunications policy.
• Gives the federal cabinet and Industry Minister powers to order telecommunications providers to take security measures. These include restricting or removing products and services, terminating agreements, assessing and mitigating vulnerabilities, and using backup systems. The cabinet can also make related regulations.
• Orders must be necessary and reasonable in relation to the threat. Decision-makers must consider effects on providers, telecommunications services and Canadians’ privacy. Providers are not entitled to federal compensation for financial losses caused by an order.
• The Minister can restrict or suspend service to specified persons. Suspension of service to an individual is permitted only when necessary to address a specified technical threat. The Minister cannot order the interception or decoding of specified private communications.
• Orders generally must be published within 90 days, unless the issuing authority directs otherwise. They may prohibit disclosure of their existence or contents. Orders with such prohibitions must be reported within 90 days to the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency. Annual reports to Parliament are also required.
• The Minister can require information, and inspectors receive compliance powers. The text provides for information sharing and confidentiality, limits on disclosure, and disposal of personal and de-identified information when no longer needed.
• Breaching security orders or regulations can lead to administrative penalties of up to $25,000 for an individual or $10 million otherwise, rising to $50,000 and $15 million for subsequent contraventions. Each day of a continuing violation can count separately. Summary offences, court injunctions and judicial review are also provided for.

Part 2 — Critical Cyber Systems Protection Act

• Creates a framework for federally regulated operators of cyber systems whose compromise could affect services or systems vital to national security or public safety. Cabinet may add or change the listed vital services, systems, operator classes and corresponding regulators. The supplied excerpt does not include the schedules identifying them.
• Designated operators must generally establish and provide their regulator with a cybersecurity program within 90 days of joining a designated class; regulators may grant extensions. Operators must implement and maintain the program, review it periodically, mitigate identified supply-chain and third-party risks, and keep records in Canada.
• Operators must report cybersecurity incidents to the Communications Security Establishment within a period set by regulation, not exceeding 72 hours, and immediately notify and provide a copy to their regulator.
• Cabinet may direct designated operators to take measures to protect critical cyber systems. It must consider operational, financial, public-safety, privacy and service-delivery effects. It cannot order interception or decoding of specified private communications. Operators are generally prohibited from disclosing directions except as necessary to comply; oversight bodies must be notified within 90 days.
• The Act provides for information requests and sharing, confidentiality protections and disposal of personal information when no longer needed. The excerpt also begins setting out regulators’ inspection powers. The summary and table of provisions indicate further enforcement measures and consequences for non-compliance, but their details are cut off.
• Part 2 also makes consequential amendments to other Acts. Its coming-into-force provision is listed as an order in council, but the operative text is not included in the excerpt.

Part 3 — Five-year review

• Provides for a five-year review of the provisions enacted or amended by the Act. The detailed review provision is not included in the supplied text.