Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11)

Marginal note:Certificate

133 The Minister of Transport may obtain from the Tribunal or the member, as the case may be, a certificate in the form established by the Governor in Council setting out the penalty required to be paid by the designated operator or other person that fails, within the time required,

• The following provision is not in force.

  (a) to pay the penalty set out in the notice of violation or to file a request for a review under paragraph 129(2)(a); or

• The following provision is not in force.

  (b) to pay the amount determined under paragraph 131(b).

Marginal note:Entering into compliance agreements

• The following provision is not in force.

  134 (1) If the Minister of Transport offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Minister of Transport considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

• The following provision is not in force.

  Marginal note:Filing request

  (2) If a compliance agreement is entered into, the designated operator or other person cannot file a request for a review under paragraph 129(2)(a).

• The following provision is not in force.

  Marginal note:Deeming

  (3) A designated operator or other person that enters into a compliance agreement with the Minister of Transport is deemed to have committed the violation in respect of which the compliance agreement was entered into.

• The following provision is not in force.

  Marginal note:Notice of compliance

  (4) If the Minister of Transport is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Minister of Transport must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

• The following provision is not in force.

  Marginal note:Notice of default

  (5) If the Minister of Transport is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Minister of Transport must cause the designated operator to be served with a notice of default informing them that

  • The following provision is not in force.

    (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

  • The following provision is not in force.

    (b) the Minister of Transport may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

• The following provision is not in force.

  Marginal note:Effect of payment

  (6) If a designated operator or other person pays the penalty set out in the notice of default within the time and in the manner set out in that notice, the Minister of Transport must accept the amount as complete satisfaction of the penalty owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

Marginal note:Regulations

• The following provision is not in force.

  135 (1) The Governor in Council may make regulations for carrying out the purposes and provisions of this Act, including regulations

  • The following provision is not in force.

    (a) respecting cyber security programs;

  • The following provision is not in force.

    (b) respecting any condition and criteria respecting internal audits;

  • The following provision is not in force.

    (c) respecting the form, manner and period for reporting any cyber security incidents referred to in section 17 and the types of incidents that must be reported;

  • The following provision is not in force.

    (d) respecting the period within which a notification referred to under subsection 14(1) is to be provided;

  • The following provision is not in force.

    (e) respecting the management of records referred to in section 30, including the collection, use, retention, disclosure and disposal of those records;

  • The following provision is not in force.

    (f) designating any provision of this Act or of the regulations made under this Act for the purposes of section 90;

  • The following provision is not in force.

    (g) classifying each violation as a minor violation, a serious violation or a very serious violation;

  • The following provision is not in force.

    (h) fixing the maximum penalty in respect of each violation;

  • The following provision is not in force.

    (i) defining, for the purposes of this Act, any word or expression that is used in this Act but is not defined; and

  • The following provision is not in force.

    (j) prescribing anything that is to be prescribed under this Act.

• The following provision is not in force.

  Marginal note:Consistency with regulatory and standards regimes

  (2) In making regulations under subsection (1), the Governor in Council must, to the extent possible, ensure consistency with existing regulatory and standards regimes, such as those established by provincial regulatory agencies or recognized industry standards development organizations.

• The following provision is not in force.

  Marginal note:Other regulatory or standards regimes

  (3) In making regulations under subsection (1), the Governor in Council may provide that compliance with a requirement under a regulatory or standards regime referred to in subsection (2) is deemed to be compliance with any corresponding requirement under this Act.

Marginal note:Summary offences

• The following provision is not in force.

  136 (1) Every person who contravenes section 10, subsection 13(1) or 14(1), section 17 or 18, subsection 30(1) or (2) or 32(4), section 35, subsection 37(1) or 41(4), section 44, subsection 46(1) or 50(4), section 53, subsection 55(1) or 59(4), section 62, subsection 64(1) or 68(4), section 71, subsection 74(1) or 78(4), section 81 or subsection 83(1) is guilty of an offence punishable on summary conviction.

• The following provision is not in force.

  Marginal note:Offence and punishment — section 29

  (2) Every person, partnership or unincorporated organization that contravenes section 29 is guilty of an offence punishable on summary conviction.

Marginal note:Offence and punishment

137 Every person who contravenes subsection 9(1), section 12 or 15, subsection 20(4), section 24, subsection 25(2), section 26 or 86 or paragraph 87(a) or (b) is guilty of an offence and liable

• The following provision is not in force.

  (a) on summary conviction

  • (i) in the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than two years less a day, or to both, and

  • (ii) in the case of a corporation, to a fine in an amount that is in the discretion of the court; or

• The following provision is not in force.

  (b) on conviction on indictment

  • (i) in the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than five years, or to both, and

  • (ii) in the case of a corporation, to a fine in an amount that is in the discretion of the court.

Marginal note:Liability of directors or officers

138 If a designated operator commits an offence under this Act, any director or officer of the designated operator that directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to the offence and is liable on conviction to the punishment provided for by this Act, even if the designated operator is not prosecuted for or convicted of the offence.

Marginal note:Continuing offence

139 If an offence under section 136 or 137 is committed or continued on more than one day, it constitutes a separate offence for each day on which the offence is committed or continued.

Marginal note:Limitation period or prescription

140 A prosecution must not be commenced in respect of an offence under this Act later than three years after the day on which the subject matter of the prosecution arose.

Marginal note:Due diligence defence

141 A person, partnership or unincorporated organization is not to be found guilty of an offence under this Act — other than an offence under section 137 that is in respect of a contravention of section 26 or paragraph 87(a) or (b) — if they establish that they exercised all due diligence to prevent the commission of the offence.

Marginal note:Offence by employee or agent or mandatary

142 In a prosecution under this Act, it is sufficient proof of an offence to establish that it was committed by an employee or agent or mandatary of the accused whether or not the employee or agent or mandatary is identified or has been prosecuted for the offence.

Marginal note:Proof of documents

143 In any action or proceeding under this Act, any document purporting to be certified by a regulator as a true copy of a document made, given or issued under this Act is, without proof of the signature or of the official character of the person appearing to have signed the document,

• The following provision is not in force.

  (a) evidence of the original document of which it purports to be a copy;

• The following provision is not in force.

  (b) evidence of the fact that the original document was made, given or issued by or by the authority of or deposited with the person named in it and was made, given or issued at the time stated in the certified copy, if a time is stated in it; and

• The following provision is not in force.

  (c) evidence of the fact that the original document was signed, certified, attested or executed by the persons and in the manner shown in the certified copy.

Marginal note:Document entries as proof

144 In any action or proceeding under this Act, an entry in any record required under this Act to be kept is, in the absence of evidence to the contrary, proof of the matters stated in it as against the person who made the entry or the designated operator that was required to keep the record.

Marginal note:Judicial review — rules

• The following provision is not in force.

  145 (1) The following rules apply to judicial review proceedings in respect of the issuance of a cyber security direction under section 20:

  • The following provision is not in force.

    (a) if the judge determines that evidence or other information provided by the Minister is not relevant or if the Minister withdraws the evidence or other information, the decision of the judge must not be based on that evidence or other information and the judge must return it to the Minister; and

  • The following provision is not in force.

    (b) the judge must ensure the confidentiality of all evidence and other information that the Minister withdraws.

• The following provision is not in force.

  Marginal note:Definition of judge

  (2) In this section, judge means the Chief Justice of the Federal Court or a judge of that Court designated by the Chief Justice.

Marginal note:Protection of information on appeal

146 Section 145 applies to any appeal of a decision made by the judge in relation to the judicial review proceedings referred to in that section and to any further appeal, with any necessary modifications.

Marginal note:Report to Parliament

• The following provision is not in force.

  147 (1) The Minister must, within three months after the end of each fiscal year, prepare a report on the administration of this Act for that fiscal year and cause a copy of the report to be laid before each House of Parliament on any of the first 15 sitting days of that House after the report is completed.

• The following provision is not in force.

  Marginal note:Contents

  (2) The report must include, for the fiscal year covered by the report, the following information in relation to orders made under subsection 20(1):

  • The following provision is not in force.

    (a) the number of orders made under subsection 20(1) and the nature of the directions set out in those orders;

  • The following provision is not in force.

    (b) the number of directions revoked under subsection 20(2);

  • The following provision is not in force.

    (c) the number of designated operators that were subject to a direction;

  • The following provision is not in force.

    (d) description of compliance of designated operators that partially complied with a direction;

  • The following provision is not in force.

    (e) description of compliance of designated operators that fully complied with a direction; and

  • The following provision is not in force.

    (f) an explanation of the necessity, proportionality, reasonableness and utility of the directions.

• The following provision is not in force.

  Marginal note:Contents

  (3) The report must contain information on, among other things,

  • The following provision is not in force.

    (a) the number of directions issued under subsection 20(1) in the immediately preceding fiscal year;

  • The following provision is not in force.

    (b) the number of designated operators that were issued directions under subsection 20(1) in the immediately preceding fiscal year; and

  • The following provision is not in force.

    (c) any other information relating to the immediately preceding fiscal year that the Minister considers relevant, if that information is not likely to be about an identifiable designated operator or other person.

Marginal note:Solicitor-client privilege or professional secrecy

148 Nothing in this Act may be construed as affecting solicitor-client privilege or, in Quebec, the professional secrecy of advocates and notaries.