Cyber Security & Surveillance Act
Forces banks, telecoms, and hospitals to open permanent government access points. Encryption carve-outs added but core surveillance powers remain. Now law.
"We're Going to Spy on All of Your Shit Bill"
What This Means for You
This is already law. Your bank, doctor, and phone company must build permanent government access points into their systems. The law explicitly bars ordering decryption of private communications, but metadata, location data, and financial records remain one ministerial order away from being accessed. Penalties for non-compliant organizations reach $15M/day, with personal liability for officers and directors.
Introduced
June 18, 2025
Sponsor
Gary Anandasangaree, Minister of Public Safety
Parliament
45th Parliament, 1st Session
Key Vote
Passed House Third Reading March 26, 2026; passed Senate and received Royal Assent June 16, 2026
Official Title
An Act respecting cyber security, amending the Telecommunications Act
What It Does
Bill C-8 enacts the Critical Cyber Systems Protection Act, requiring operators of "vital services", such as banks, telecoms, energy, and healthcare, to comply with government cybersecurity directives. After significant pushback, the bill was amended to explicitly prohibit ministerial orders that would require decoding encrypted private communications (s. 15.2(2.1) of the Telecom Act and s. 20(1.1) of the CCSPA). It also clarifies that "interference with a system" excludes lawful expression and political debate. The Minister retains broad authority to issue directives, compel technical compliance measures, and access metadata, location data, and financial records. It passed the House on March 26, 2026, after five months and ten committee meetings, cleared the Senate, and received Royal Assent on June 16, 2026. Telecommunications Act amendments took immediate effect; the Critical Cyber Systems Protection Act provisions will be phased in.
Primary Concerns
- Encryption protections were added reactively under pressure. "For greater certainty" provisions are a political concession, not a structural limit on ministerial power
- The Minister retains broad authority to compel technical compliance across banking, healthcare, and telecom. The surveillance infrastructure mandate is unchanged
- No meaningful warrant requirement for collection of metadata, location data, and financial records across vital services
- Ministerial directives can still be issued with minimal public transparency, and affected companies may be restricted from disclosing them
- Creates a permanent government access framework across the most sensitive sectors of Canadian life, outlasting any single government
- "For greater certainty" is a legislative term that acknowledges a power was already contested. It signals the government knew this needed justifying
Who's Opposing It
Canadian privacy commissioners, intelligence oversight bodies, cybersecurity researchers, and civil society organizations raised alarms during the bill's five-month committee study.
Spread the Word