Statement by the Privacy Commissioner of Canada to the Standing Committee on Public Safety and National Security (SECU) on Bill C-8

October 30, 2025
Ottawa, ON

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Thank you for the invitation to appear before you today to offer my views on the privacy implications of Bill C-8, An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts. I am accompanied by Marc Chénier, Deputy Commissioner and Senior General Counsel.

There is no doubt that we continue to face a challenging cyber-threat landscape in which the consequences of cyber incidents are increasingly disruptive and widespread.

Breaches of critical infrastructure, such as the one that affected Nova Scotia Power in May of this year, are particularly concerning in that they can compromise systems and services that are essential to the health, safety, security, and economic prosperity of Canadians. Such incidents may result in unauthorized access to, or disclosure of personal information, potentially leading to major privacy implications and a real risk of significant harm to affected individuals.

For these reasons, I support the objective of Bill C-8 to protect systems and services that are vital to national security or public safety from cybersecurity threats and vulnerabilities.

Like its predecessor Bill C-26, Bill C-8 recognizes that steps must be taken to protect critical infrastructure against cyber threats, which are continuing to evolve in sophistication and complexity. This is necessary from a security standpoint and from a privacy standpoint.

While stronger cybersecurity protections can help to reduce the likelihood and impact of privacy breaches, it is also essential to ensure that new powers, authorities, and obligations that are created to improve cybersecurity contain the necessary limits and that they do not have unintended impacts on privacy.

I am pleased to see that Bill C-8 incorporates the improvements made to its predecessor C-26, including additional guardrails on the proposed order-making powers and new notification and reporting obligations. This will help to achieve a better balance between the Bill’s cybersecurity objectives and privacy rights and interests.

However, some privacy risks remain, including lower thresholds for the exercise of certain powers and authorities with potential privacy implications, the absence of a mechanism to ensure that my Office is notified of major cybersecurity breaches that impact the privacy of Canadians, and insufficient minimum privacy requirements for the sharing of information with foreign governments.

To address these risks and achieve the necessary balance between security and privacy, I would recommend:

• That the legislation impose a uniform standard requiring that any collection, use, or disclosure of personal information be both necessary in the circumstances to achieve the stated purpose and proportional to the benefits to be gained;
• That information-sharing agreements entered into under the legislation provide for minimum privacy safeguards in order to strengthen governance and accountability and ensure a consistent standard of privacy protection when information is exchanged outside of Canada;
• That the relevant government institutions, including the Communications Security Establishment, be required to notify my Office when they are made aware of cybersecurity incidents involving a material privacy breach so that we can collaborate and coordinate our efforts in protecting Canadians’ privacy.

While this is not specific to Bill C-8, I would also reiterate my overarching recommendation that government institutions be legally required to conduct privacy impact assessments and to consult my Office when developing any new programs or initiatives with privacy implications for Canadians.

Thank you for the opportunity to present my views on this Bill. I would now be pleased to answer your questions.