C-81453Charles III2025An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other ActsAn Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other ActsAn Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts20256
18
MINISTER OF PUBLIC SAFETY91126RECOMMENDATIONHer Excellency the Governor General recommends to the House of Commons the appropriation of public revenue under the circumstances, in the manner and for the purposes set out in a measure entitled “An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts”.SUMMARYPart 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the Governor in Council and the Minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system. It also establishes an administrative monetary penalty scheme to promote compliance with orders and regulations made by the Governor in Council and the Minister of Industry to secure the Canadian telecommunications system as well as rules for judicial review of those orders and regulations.Part 2 enacts the Critical Cyber Systems Protection Act to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. It also, among other things,authorizes the Governor in Council to designate any service or system as a vital service or vital system;authorizes the Governor in Council to establish classes of operators in respect of a vital service or vital system;requires designated operators to, among other things, establish and implement cyber security programs, mitigate supply-chain and third-party risks, report cyber security incidents and comply with cyber security directions;provides for the exchange of information between relevant parties; andauthorizes the enforcement of the obligations under the Act and imposes consequences for non-compliance.This Part also makes consequential amendments to certain Acts.TABLE OF PROVISIONSAn Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other ActsTelecommunications ActCritical Cyber Systems Protection ActEnactment of ActEnactmentAn Act respecting the protection of critical cyber systems in the federally regulated sectorShort TitleCritical Cyber Systems Protection ActDefinitionsDefinitionsApplicationBinding on His MajestyDesignation of MinisterPurposePurposeVital Services and Vital SystemsAddition to Schedule 1Designated Operators of Critical Cyber SystemsClass of operators and corresponding regulatorCritical cyber system — obligation of designated operatorCyber Security ProgramEstablishing cyber security programProviding program to appropriate regulatorExtension of 90-day periodImplementation and maintenance of programReview of cyber security program — commencementNotification — other changesMitigation of Supply-Chain and Third-Party RisksMitigation — supply-chain or third-partyGuidance from Communications Security EstablishmentReporting of Cyber Security IncidentsReport — cyber security incidentNotifyCommunications Security Establishment — provision of incident reportCyber Security DirectionsDirectionContents of directionExemption from Statutory Instruments ActExchange of informationProhibition against disclosureDisclosure — when allowedDisclosure and Use of InformationProhibitionAgreements and arrangements — exchange of informationExchange of information by appropriate regulatorRequest for informationRecord KeepingRecordsAdministration and EnforcementLimitation on LiabilityNo liabilityPowersSuperintendent of Financial InstitutionsGeneral ProvisionsAuthority to enter place — SuperintendentDwelling-houseInternal AuditInternal audit orderReportCompliance OrderPower to order termination of contraventionCompliance with orderRequest for reviewDecision on completion of reviewMinister of IndustryGeneral ProvisionsDesignation of inspectorsAuthority to enter place — inspectorDwelling-houseInternal AuditInternal audit orderReportCompliance OrderPower to order termination of contraventionCompliance with orderRequest for reviewDecision on completion of reviewBank of CanadaGeneral ProvisionsDesignationAuthority to enter place — designated personDwelling-houseInternal AuditInternal audit orderReportCompliance OrderPower to order termination of contraventionCompliance with orderRequest for reviewDecision on completion of reviewCanadian Nuclear Safety CommissionGeneral ProvisionsDesignationAuthority to enter place — designated personDwelling-houseInternal AuditInternal audit orderReportCompliance OrderPower to order termination of contraventionCompliance with orderRequest for reviewDecision on completion of reviewCanadian Energy RegulatorGeneral ProvisionsDesignation of inspection officersAuthority to enter place — inspection officerDwelling-houseInternal AuditInternal audit orderReportNotice of Non-ComplianceNotice of non-complianceCompliance OrderPower to order termination of contraventionCompliance with orderPowers of CommissionDecision on completion of reviewMinister of TransportGeneral ProvisionsDelegationAuthority to enter place — Minister of TransportDwelling-houseInternal AuditInternal audit orderReportCompliance OrderPower to order termination of contraventionCompliance with orderRequest for reviewDecision on completion of reviewGeneral ProvisionsObstructionProviding false or misleading informationAdministrative Monetary PenaltiesGeneral ProvisionsDefinition of penaltyPurpose of penaltyViolationPenaltyDue diligence availableLiability of directors or officersContinuing violationViolation or offenceLimitation period or prescriptionDebts to His MajestyCertificate of defaultSuperintendent of Financial InstitutionsGeneral ProvisionsNotice of violation — SuperintendentPenaltyPaymentRepresentation to SuperintendentCompliance AgreementsEntering into compliance agreementsMinister of IndustryGeneral ProvisionsDesignationNotice of violation — designated personPenaltyPaymentRepresentationCompliance AgreementsEntering into compliance agreementsBank of CanadaGeneral ProvisionsNotice of violation — BankPenaltyPaymentRepresentation to GovernorCompliance AgreementsEntering into compliance agreementsCanadian Nuclear Safety CommissionGeneral ProvisionsDesignationNotice of violation — designated personPenaltyPaymentRepresentationCompliance AgreementsEntering into compliance agreementsCanadian Energy RegulatorGeneral ProvisionsDesignationNotice of violation — designated personPenaltyPaymentPowers of CommissionCompliance AgreementsEntering into compliance agreementsMinister of TransportGeneral ProvisionsNotice of violation — Minister of TransportPenaltyPaymentTime and place of reviewDetermination by Tribunal memberRight of appealCertificateCompliance AgreementsEntering into compliance agreementsRegulationsRegulationsOffencesSummary offencesOffence and punishmentLiability of directors or officersContinuing offenceLimitation period or prescriptionDue diligence defenceOffence by employee or agent or mandataryProof of documentsDocument entries as proofJudicial review — rulesProtection of information on appealGeneralReport to ParliamentConsequential AmendmentsOffice of the Superintendent of Financial Institutions ActNuclear Safety and Control ActTransportation Appeal Tribunal of Canada ActComing into ForceOrder in councilHis Majesty, by and with the advice and consent of the Senate and House of Commons of Canada, enacts as follows:1993, c. 38Telecommunications ActSection 7 of the Telecommunications Act is amended by striking out “and” at the end of paragraph (h), by adding “and” at the end of paragraph (i) and by adding the following after paragraph (i):to promote the security of the Canadian telecommunications system.Telecommunications ActRelevant portion of section 7:It is hereby affirmed that telecommunications performs an essential role in the maintenance of Canada’s identity and sovereignty and that the Canadian telecommunications policy has as its objectivesThe Act is amended by adding the following after section 15:Security of Canadian telecommunications system — Order in CouncilIf the Governor in Council believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, the Governor in Council may, by order and after consultation with the persons the Governor in Council considers appropriate,prohibit a telecommunications service provider from using all products and services provided by a specified person in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities; ordirect a telecommunications service provider to remove all products provided by a specified person from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities.Scope and substanceThe provisions of the order must, in scope and substance, be reasonable in relation to the gravity of the threat, including that of interference, manipulation, disruption or degradation.Non-disclosureThe order may also include a provision prohibiting the disclosure of its existence, or some or all of its contents, by any person.FactorsBefore making the order, the Governor in Council must considerits operational impact on the affected telecommunications service providers;its financial impact on the affected telecommunications service providers;its effect on the provision of telecommunications services in Canada; andany other factor that the Governor in Council considers relevant.PrepublicationThe Governor in Council may cause a draft order to be published in the Canada Gazette.PublicationAny order made under subsection (1) must be published in the Canada Gazette within 90 days after the day on which it is made, unless the Governor in Council directs otherwise in the order.ConflictIn the event of any inconsistency between an order made under subsection (1) and a decision of the Commission made under this Act or an order made or an authorization issued by the Minister under this Act or the Radiocommunication Act, the order made under subsection (1) prevails to the extent of the inconsistency.No compensationNo one is entitled to any compensation from His Majesty in right of Canada for any financial losses resulting from the making of an order under subsection (1).Security of Canadian telecommunications system — Minister’s orderIf there are reasonable grounds to believe that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, the Minister may, by order and after consultation with the Minister of Public Safety and Emergency Preparedness and with the persons the Minister considers appropriate,prohibit a telecommunications service provider from providing any service to any specified person, including a telecommunications service provider; anddirect a telecommunications service provider to suspend providing for a specified period any service to any specified person, including a telecommunications service provider.OrderIf the Minister believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, the Minister may, by order,prohibit a telecommunications service provider from using any specified product or service in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities;direct a telecommunications service provider to remove any specified product from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities;impose conditions on a telecommunications service provider’s use of any product or service, or any product or service provided by a specified person, including a telecommunications service provider;impose conditions on a telecommunications service provider’s provision of services to a specified person, including a telecommunications service provider;prohibit a telecommunications service provider from entering into a service agreement for any product or service used in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities;require that a telecommunications service provider terminate a service agreement referred to in paragraph (e);prohibit a telecommunications service provider from upgrading any specified product or service;require that a telecommunications service provider’s telecommunications networks or telecommunications facilities, as well as its procurement plans for those networks or facilities, be subject to specified review processes;require that a telecommunications service provider develop a security plan in relation to its telecommunications services, telecommunications networks or telecommunications facilities;require that assessments be conducted to identify any vulnerability in a telecommunications service provider’s telecommunications services, telecommunications networks or telecommunications facilities or its security plan referred to in paragraph (i);require that a telecommunications service provider take steps to mitigate any vulnerability in its telecommunications services, telecommunications networks or telecommunications facilities or its security plan referred to in paragraph (i);require that a telecommunications service provider implement specified standards in relation to its telecommunications services, telecommunications networks or telecommunications facilities;direct a telecommunications service provider to do a specified thing or refrain from doing a specified thing, other than a thing specified in subsection (1) or 15.1(1); orrequire that a telecommunications service provider use a backup system for telecommunications facilities.Scope and substanceThe provisions of an order made under subsection (1) or (2) must, in scope and substance, be reasonable in relation to the gravity of the threat, including that of interference, manipulation, disruption or degradation.For greater certaintyFor greater certainty, despite subsection (2), the Minister is not permitted to order a telecommunications service provider to intercept a private communication or a radio-based telephone communication, as those terms are defined in section 183 of the Criminal Code.Non-disclosureAn order made under subsection (1) or (2) may also include a provision prohibiting the disclosure of its existence, or some or all of its contents, by any person.FactorsBefore making an order under subsection (1) or (2), the Minister must considerits operational impact on the affected telecommunications service providers;its financial impact on the affected telecommunications service providers;its effect on the provision of telecommunications services in Canada; andany other factor that the Minister considers relevant.PrepublicationThe Minister may cause a draft order to be published in the Canada Gazette.PublicationAny order made under subsection (1) or (2) must be published in the Canada Gazette within 90 days after the day on which it is made, unless the Minister directs otherwise in the order.ConflictIn the event of any inconsistency between an order made under subsection (1) or (2) and a decision of the Commission made under this Act or another order made, or any authorization issued, by the Minister under this Act or the Radiocommunication Act, the order made under subsection (1) or (2), as the case may be, prevails to the extent of the inconsistency.No compensationNo one is entitled to any compensation from His Majesty in right of Canada for any financial losses resulting from the making of an order under subsection (1) or (2).Report on ordersThe Minister shall cause to be tabled in each House of Parliament, within three months after the end of each fiscal year or, if either House is not then sitting, on any of the first 15 days of the next sitting of that House, a report on the orders made under subsection 15.1(1) and subsections 15.2(1) and (2).Contents of reportThe Minister shall include in the report, for the fiscal year covered by the report, the following information:the number of orders made and the nature of the orders;the number of orders that were revoked;the number of telecommunications service providers affected by an order;a description of compliance of telecommunications service providers that partially complied with an order;a description of compliance of telecommunications service providers that fully complied with an order; andan explanation of the necessity, reasonableness and utility of the orders.Contents of report — conflictsThe report shall state the number of times that an order prevailed over a decision of the Commission made under this Act during previous fiscal year.Obligation to notifyThe Minister must, within 90 days after an order that includes a provision prohibiting the disclosure of its existence, or some or all of its contents, is made under section 15.1 or 15.2, notify the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency of the making of the order.Contravention of unpublished orderNo person shall be convicted of an offence consisting of a contravention of an order made under section 15.1 or 15.2 unless it is proved that, at the time of the alleged contravention, the person had been notified of the order.CertificateA certificate appearing to have been signed by the Minister and stating that a notice containing the order made under section 15.1 or 15.2 was given to persons likely to be affected by it is, in the absence of evidence to the contrary, proof that notice was given to those persons.Statutory Instruments ActThe Statutory Instruments Act does not apply to an order made under section 15.1 or 15.2.Incorporation by referenceAn order made under section 15.1 or 15.2 may incorporate any document by reference, in whole or in part, regardless of its source and as it exists on a particular date or as it is amended from time to time.Provision of informationThe Minister may require any person to provide to the Minister or any person designated by the Minister, within any time and subject to any conditions that the Minister may specify, any information that the Minister believes on reasonable grounds is relevant for the purpose of making, amending or revoking an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or of verifying compliance or preventing non-compliance with such an order or regulation.Confidential information — designationA person who provides any of the following information under section 15.4 may designate it as confidential:information that is a trade secret;financial, commercial, scientific or technical information that is confidential and that is treated consistently in a confidential manner by the person who provided it;information the disclosure of which could reasonably be expected toresult in material financial loss or gain to any person,prejudice the competitive position of any person, oraffect contractual or other negotiations of any person; orpersonal information and de-identified information.DefinitionsThe following definitions apply in paragraph (1)(d).de-identify means to modify personal information so that an individual cannot be directly identified from it, though a risk of the individual being identified remains. (dépersonnaliser)personal information has the same meaning as in section 3 of the Privacy Act. (renseignements personnels)ProhibitionSubject to subsection (4), no person shall knowingly disclose or knowingly permit to be disclosed any information that is designated as confidential.ExceptionInformation that is designated as confidential may be disclosed, or be permitted to be disclosed, ifthe disclosure is authorized or required by law;the person who designated the information as confidential consents to its disclosure; orthe disclosure is necessary, in the Minister’s opinion, to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.Exchange of informationDespite section 15.5, to the extent that is necessary for any purpose related to the making, amending or revoking of an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a) — or to verifying compliance or preventing non-compliance with such an order or regulation — the following persons and entities may collect information from and disclose information to each other, including confidential information:the Minister;the Minister of Public Safety and Emergency Preparedness;the Minister of Foreign Affairs;the Minister of National Defence;the Chief of the Defence Staff;the Chief or an employee of the Communications Security Establishment;the Director or an employee of the Canadian Security Intelligence Service;the Chairperson or an employee of the Commission;a person designated under section 15.4; andany other prescribed person or entity.Confidential informationAny confidential information that is collected under subsection (1) must be treated as confidential.Disclosure of informationAny information collected or obtained under this Act, other than information designated as confidential under subsection 15.5(1), may be disclosed by the Minister under an agreement, a memorandum of understanding or an arrangement in writing between the Government of Canada and the government of a province or of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, if the Minister believes that the information may be relevant to securing the Canadian telecommunications system or the telecommunications system of a foreign state, including against the threat of interference, manipulation or disruption.Restriction — useIf the agreement, memorandum of understanding or arrangement allows for the sharing of information that may be relevant to an investigation or proceeding in respect of a contravention of this Act, an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a) — or a law of a foreign state that addresses conduct that is substantially similar to conduct that would be in contravention of this Act, of an order made under section 15.1 or 15.2 or of a regulation made under paragraph 15.8(1)(a) — the agreement, memorandum of understanding or arrangement must restrict the use of that information to purposes relevant to contraventions of the laws of a foreign state that have consequences that would not be considered penal under Canadian law.Privacy Act not affectedFor greater certainty, nothing in sections 15.1, 15.2 and 15.4 to 15.7 affects the provisions of the Privacy Act.RegulationsThe Governor in Council may make regulationscontaining any provision that may be contained in an order made under section 15.2; andprescribing persons and entities for the purposes of paragraph 15.6(1)(j).ConflictIn the event of any inconsistency between a regulation made under paragraph (1)(a) and a decision of the Commission made under this Act or an order made or an authorization issued by the Minister under this Act or the Radiocommunication Act, the regulation prevails to the extent of the inconsistency.Annual reportThe Minister must, within three months after the end of each fiscal year, prepare a report respecting any orders referred to in sections 15.1 and 15.2 that were made during that fiscal year and must cause the report to be laid before each House of Parliament within the first 15 days on which that House is sitting after the report is completed.ContentsThe report must include the number of orders that were made in that fiscal year.Contents of report — conflictsThe report must also state the number of times that an order prevailed over a decision of the Commission made under this Act during the previous fiscal year.Judicial ReviewRulesThe following rules apply to judicial review proceedings in respect of an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a):if the judge determines that evidence or other information provided by the Minister is not relevant or if the Minister withdraws the evidence or other information, the decision of the judge must not be based on that evidence or other information and the judge must return it to the Minister; andthe judge must ensure the confidentiality of all evidence and other information that the Minister withdraws.Definition of judgeIn this section, judge means the Chief Justice of the Federal Court or a judge of that Court designated by the Chief Justice.Protection of information on appealSection 15.9 applies to any appeal of a decision made by the judge in relation to the judicial review proceedings referred to in that section and to any further appeal, with any necessary modifications.New.Section 47 of the Act is replaced by the following:Commission subject to orders and standardsThe Commission must exercise its powers and perform its duties under this Act and any special Act — in accordance with any orders made by the Governor in Council under section 8 or any standards prescribed by the Minister under section 15, and taking into account any orders made under section 15.1 or 15.2 and any regulation made under paragraph 15.8(1)(a) — with a view to implementing the Canadian telecommunications policy objectives and ensuring that Canadian carriers provide telecommunications services and charge rates in accordance with section 27.Existing text of section 47:The Commission shall exercise its powers and perform its duties under this Act and any special Actwith a view to implementing the Canadian telecommunications policy objectives and ensuring that Canadian carriers provide telecommunications services and charge rates in accordance with section 27; andin accordance with any orders made by the Governor in Council under section 8 or any standards prescribed by the Minister under section 15.2014, c. 39, s. 200(1)Subsection 71(2) of the Act is replaced by the following:Designation of inspectorsThe Minister may designate any qualified person as an inspector for the purpose of verifying compliance or preventing non-compliance with the provisions of this Act for which the Minister is responsible or with orders made under sections 15.1 and 15.2 or regulations made under paragraph 15.8(1)(a).Existing text of subsection 71(2):The Minister may designate any qualified person as an inspector for the purpose of verifying compliance or preventing non-compliance with the provisions of this Act for which the Minister is responsible.2019, c. 10, s. 164(2)Paragraph 71(4)(a) of the Act is replaced by the following:enter, at any reasonable time, any place in which they believe on reasonable grounds there is any document, information or thing relevant to the purpose of verifying compliance or preventing non-compliance with this Act, an order made under section 15.1 or 15.2, a regulation made under paragraph 15.8(1)(a), any special Act, Division 1.1 of Part 16.1 of the Canada Elections Act or sections 51 to 53 of the Accessible Canada Act, and examine the document, information or thing or remove it for examination or reproduction;Relevant portion of subsection 71(4):An inspector may, subject to subsection (5), for the purposes for which the inspector was designated an inspector,enter, at any reasonable time, any place in which they believe on reasonable grounds there is any document, information or thing relevant to the purpose of verifying compliance or preventing non-compliance with this Act, any special Act, Division 1.1 of Part 16.1 of the Canada Elections Act or sections 51 to 53 of the Accessible Canada Act, and examine the document, information or thing or remove it for examination or reproduction;2014, c. 39, s. 209(6)Paragraph 71(6)(b) of the Act is replaced by the following:entry to the dwelling-house is necessary for the purpose of verifying compliance or preventing non-compliance with this Act, an order made under section 15.1 or 15.2, a regulation made under paragraph 15.8(1)(a), any special Act, or Division 1.1 of Part 16.1 of the Canada Elections Act; andRelevant portion of subsection 71(6):On an ex parte application, a justice of the peace may issue a warrant authorizing an inspector who is named in the warrant to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath thatentry to the dwelling-house is necessary for the purpose of verifying compliance or preventing non-compliance with this Act, any special Act, or Division 1.1 of Part 16.1 of the Canada Elections Act; and2019, c. 10, s. 164(3)Subsection 71(9) of the Act is replaced by the following:Information requirementAn inspector who believes that a person is in possession of information that the inspector considers necessary for the purpose of verifying compliance or preventing non-compliance with this Act, an order made under section 15.1 or 15.2, a regulation made under paragraph 15.8(1)(a), any special Act, Division 1.1 of Part 16.1 of the Canada Elections Act or sections 51 to 53 of the Accessible Canada Act may, by notice, require that person to submit the information to the inspector in the form and manner and within the reasonable time that is stipulated in the notice.Existing text of subsection 71(9):An inspector who believes that a person is in possession of information that the inspector considers necessary for the purpose of verifying compliance or preventing non-compliance with this Act, any special Act, Division 1.1 of Part 16.1 of the Canada Elections Act or sections 51 to 53 of the Accessible Canada Act may, by notice, require that person to submit the information to the inspector in the form and manner and within the reasonable time that is stipulated in the notice.Subsection 72(3) of the Act is replaced by the following:ExceptionNothing in subsection (1) or (2) applies to an act or omission that is contrary to an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a), to any action for breach of a contract to provide telecommunications services or to any action for damages in relation to a rate charged by a Canadian carrier.Existing text of subsection 72(3):Nothing in subsection (1) or (2) applies to any action for breach of a contract to provide telecommunications services or any action for damages in relation to a rate charged by a Canadian carrier.2019, c. 10, s. 165The portion of section 72.001 of the Act before paragraph (a) is replaced by the following:Commission of violationEvery contravention of a provision of this Act, other than section 17 or 69.2, or the regulations, other than a provision of an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a), every contravention of a decision made by the Commission under this Act, other than a prohibition or a requirement of the Commission made under section 41, and every contravention of any of subsections 51(1) to (4) and (7), 52(1) to (3) and 53(1) to (3) and (6) of the Accessible Canada Act constitutes a violation and the person who commits the violation is liableRelevant portion of section 72.001:Every contravention of a provision of this Act, other than section 17 or 69.2, every contravention of a regulation or decision made by the Commission under this Act, other than a prohibition or a requirement of the Commission made under section 41, and every contravention of any of subsections 51(1) to (4) and (7), 52(1) to (3) and 53(1) to (3) and (6) of the Accessible Canada Act constitutes a violation and the person who commits the violation is liableThe Act is amended by adding the following after section 72.13:Administrative Monetary Penalties — Security of the Canadian Telecommunications SystemCommission of violationEvery contravention of a provision of an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a) constitutes a violation and the person who commits the violation is liable to an administrative monetary penalty of an amountin the case of an individual, not exceeding $25,000 and, for a subsequent contravention, not exceeding $50,000; orin any other case, not exceeding $10,000,000 and, for a subsequent contravention, not exceeding $15,000,000.Continuing violationA violation that is continued on more than one day constitutes a separate violation in respect of each day during which it is continued.Determination of penalty amountThe amount of the administrative monetary penalty is to be determined by taking into account the following factors:the nature and scope of the violation;the history of compliance with orders made under section 15.1 or 15.2 or regulations made under paragraph 15.8(1)(a) by the person who committed the violation;any benefit that the person obtained from the commission of the violation;the person’s ability to pay the penalty;any factors established by any regulations; andany other relevant factor.Purpose of penaltyThe purpose of the penalty is to promote compliance with orders made under section 15.1 and 15.2 and regulations made under paragraph 15.8(1)(a), and not to punish.Power of Minister — violationThe Minister maydesignate a person, or class of persons, that is authorized to issue notices of violation or enter into a compliance agreement; andestablish, in respect of each violation, a short-form description to be used in notices of violation.Issuance and serviceA person who is designated to issue notices of violation and who believes, on reasonable grounds, that a person has committed a violation may issue and cause to be served on the person, a notice of violation.Contents of noticeThe notice of violation must name the person believed to have committed the violation, identify the violation and includethe amount of the penalty for which the person is liable;a statement as to the right of the person, within 30 days after the day on which the notice is served, or within any longer period that the Minister specifies, to pay the penalty or to make representations to the Minister with respect to the violation and the penalty, and the manner for doing so; anda statement indicating that if the person does not pay the penalty or make representations in accordance with the notice, the person will be deemed to have committed the violation and the penalty may be imposed.Correction or cancellation of notice of violationAt any time before a request to make representations in respect of the notice of violation is received by the Minister, the designated person may cancel the notice or correct an error in it.PaymentIf a person who is served with a notice of violation pays the penalty set out in the notice, the person is deemed to have committed the violation and the proceedings in respect of it are ended.RepresentationsIf a person who is served with a notice of violation makes representations in accordance with the notice, the Minister must decide, on a balance of probabilities, after considering those representations, whether the person committed the violation and, if the Minister so decides, the Minister may impose the penalty set out in the notice, a lesser penalty or no penalty.Failure to pay or make representationsIf a person who is served with a notice of violation neither pays the penalty nor makes representations in accordance with the notice, the person is deemed to have committed the violation and the Minister may impose the penalty set out in the notice.Copy of decisionThe Minister must cause a copy of any decision made under subsection (2) or (3) to be issued and served on the person.Compliance agreementsIf a person designated under paragraph 72.134(a) offers to enter into a compliance agreement with the person believed to have committed the violation, the agreement is subject to any terms that the designated person considers appropriate, including the reduction, in whole or in part, of the penalty set out in the notice of violation.RepresentationsIf a compliance agreement is entered into, the person who entered into it cannot make any representations under paragraph 72.135(2)(b).DeemingA person who enters into a compliance agreement with a designated person is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the designated person is of the opinion that a person who has entered into a compliance agreement has complied with it, the designated person must serve a notice to that effect on the person and, on the service of that notice, the proceedings in respect of the violation are ended.Notice of defaultIf the designated person is of the opinion that a person who has entered into a compliance agreement has not complied with it, the designated person must cause the person to be served with a notice of default informing them that they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement.PaymentIf a person pays the penalty in accordance with the notice of default, the proceedings in respect of the violation are ended.Officer, director or agent or mandatary of corporationsAn officer, director or agent or mandatary of a corporation that commits a violation is liable for the violation if they directed, authorized, assented to, acquiesced in or participated in the commission of the violation, whether or not the corporation is proceeded against.Debt due to His MajestyA penalty and any interest due in respect of the penalty constitute a debt due to His Majesty in right of Canada and may be recovered in the Federal Court or any other court of competent jurisdiction.Limitation period or prescriptionA proceeding to recover such a debt may not be commenced later than five years after the day on which the debt becomes payable.Receiver GeneralA penalty paid or recovered in relation to a violation is payable to the Receiver General.Certificate of defaultThe Minister may issue a certificate for the unpaid amount of any debt referred to in subsection (1).Registration in Federal CourtRegistration in the Federal Court of a certificate issued under subsection (4) has the same effect as a judgment of that Court for a debt of the amount specified in the certificate and all related registration costs.Limitation period or prescriptionA proceeding in respect of a violation may not be commenced later than three years after the day on which the subject-matter of the proceeding becomes known to the Minister.Minister — certificateA document appearing to have been issued by the Minister, certifying the day on which the subject-matter became known to the Minister, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it.PublicationThe Minister may make publicthe name of a person who enters into a compliance agreement, the nature of the agreement, the conditions included in that agreement and, if applicable, the scope of any non-compliance with the compliance agreement and the amount of the penalty; andthe name of a person who committed a violation, the nature of the violation, including the acts or omissions and provisions or decisions at issue, and the amount of the penalty.RegulationsThe Governor in Council may make regulationsexempting from the application of section 72.131 any provision of an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a);for the purpose of paragraph 72.133(1)(e), establishing other factors to be considered in determining the amount of the penalty; andrespecting compliance agreements entered into under subsection 72.137(1).New.2014, c. 39, s. 207The heading before section 72.14 of the English version of the Act is replaced by the following:Provisions Common to Administrative Monetary Penalties SchemesExisting text of the heading:Provisions Applicable to Both Administrative Monetary Penalties Schemes2014, c. 39, s. 207Section 72.14 of the Act is replaced by the following:EvidenceIn a proceeding in respect of a violation, a notice appearing to be served under subsection 72.005(1), 72.07(1) or 72.135(1) or a copy of a decision appearing to be served under subsection 72.007(4), 72.08(4) or 72.136(4) is admissible in evidence without proof of the signature or official character of the person appearing to have signed it.Existing text of section 72.14:In a proceeding in respect of a violation, a notice purporting to be served under subsection 72.005(1) or 72.07(1) or a copy of a decision purporting to be served under subsection 72.007(4) or 72.08(4) is admissible in evidence without proof of the signature or official character of the person appearing to have signed it.Paragraph 73(3)(a) of the Act is replaced by the following:contravenes any other provision of this Act or any special Act or any regulation or decision made under this Act, other than a regulation made under paragraph 15.8(1)(a), orRelevant portion of subsection 73(3):Every person whocontravenes any other provision of this Act or any special Act or any regulation or decision made under this Act, orSection 73 of the Act is amended by adding the following after subsection (3):IdemEvery person who contravenes an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a) is guilty of an offence punishable on summary conviction and liable,in the case of an individual, to a fine in an amount that is at the discretion of the court or to imprisonment for a term of not more than two years less a day or to both; andin the case of a corporation, to a fine in an amount that is at the discretion of the court.Officer, director or agent or mandataryAn officer, director or agent or mandatary of a person who commits an offence under subsection (3.1) is a party to and guilty of the offence and is liable to the punishment provided for that offence in respect of an individual if they directed, authorized, assented to, acquiesced in or participated in the commission of the offence, whether or not the person has been prosecuted or convicted.Offence by employee or agent or mandataryIn a prosecution for an offence under subsection (3.1), it is sufficient proof of the offence to establish that it was committed by an employee, acting within the scope of their employment, or by an agent or a mandatary of the accused, acting within the scope of their authority, whether or not the employee or agent or mandatary is identified or proceeded against.Defence of due diligenceNo person shall be convicted of an offence under any of subsections (1) to (3.1), other than for a contravention of paragraph (2)(d), if the person establishes that they exercised all due diligence to prevent the commission of the offence.Consent not requiredNo consent is required to prosecute an offence under subsection (3.1).New.1998, c. 8, s. 9(4)Subsection 73(7) of the Act is replaced by the following:InjunctionsIf a court of competent jurisdiction is satisfied, on application by the Minister, that a contravention of an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a) or a contravention of section 69.2 is being or is likely to be committed, the court may grant an injunction, subject to any conditions that the court considers appropriate, ordering any person to cease or refrain from any activity related to that offence.Existing text of subsection 73(7):If a court of competent jurisdiction is satisfied, on application by the Minister, that a contravention of section 69.2 is being or is likely to be committed, the court may grant an injunction, subject to any conditions that the court considers appropriate, ordering any person to cease or refrain from any activity related to that offence.Critical Cyber Systems Protection ActEnactment of ActEnactmentThe Critical Cyber Systems Protection Act, whose text is as follows and whose Schedules 1 and 2 are set out in the schedule to this Act, is enacted as follows:An Act respecting the protection of critical cyber systems in the federally regulated sectorPreambleWhereas the Government of Canada has a fundamental responsibility to protect Canada’s national security and the safety of Canadians;Whereas the Government of Canada acknowledges that because some cyber systems are critically important to vital services and vital systems their disruption could have serious consequences for national security or public safety;Whereas the Government of Canada, through its national cyber security strategy, is committed to enhancing the security and resilience of the critical cyber systems of the federally regulated sector and to exercising leadership in cyber security to foster collaboration across Canada, with the provinces and territories and around the world;Whereas the Government of Canada is committed to working with various stakeholders, including the federally regulated sector, to help protect those systems and to encourage information sharing among the stakeholders;And whereas the Government of Canada acknowledges the necessity to protect the privacy of Canadians with respect to their personal information in accordance with the Privacy Act;His Majesty, by and with the advice and consent of the Senate and House of Commons of Canada, enacts as follows:Short TitleShort titleThis Act may be cited as the Critical Cyber Systems Protection Act.DefinitionsDefinitionsThe following definitions apply in this Act.appropriate regulator means, in respect of a designated operator, the regulator set out in column 2 of Schedule 2 that corresponds to the class of operators to which the designated operator belongs. (organisme réglementaire compétent)Bank means the Bank of Canada established by subsection 3(1) of the Bank of Canada Act. (Banque)Canadian Energy Regulator means the Canadian Energy Regulator established by subsection 10(1) of the Canadian Energy Regulator Act. (Régie canadienne de l’énergie)Canadian Nuclear Safety Commission means the Commission established by subsection 8(1) of the Nuclear Safety and Control Act. (Commission canadienne de sûreté nucléaire).Chief Executive Officer has the same meaning as in section 2 of the Canadian Energy Regulator Act. (président-directeur général)Commission means the Commission referred to in subsection 26(1) of the Canadian Energy Regulator Act. (Commission)confidential information means any information obtained under this Act in respect of a critical cyber system thatconcerns a vulnerability of any designated operator’s critical cyber system or the methods used to protect that system and that is consistently treated as confidential by the designated operator;if disclosed could reasonably be expected to result in material financial loss or gain to, or could reasonably be expected to prejudice the competitive position of, a designated operator; orif disclosed could reasonably be expected to interfere with contractual or other negotiations of a designated operator. (renseignements confidentiels)critical cyber system means a cyber system that, if its confidentiality, integrity or availability were compromised, could affect the continuity or security of a vital service or vital system. (cybersystème essentiel)cyber security incident, in respect of a critical cyber system, means an incident, including an act, omission or circumstance, that interferes or may interfere withthe continuity or security of a vital service or vital system; orthe confidentiality, integrity or availability of the critical cyber system. (incident de cybersécurité)cyber system means a system of interdependent digital services, technologies, assets or facilities that form the infrastructure for the reception, transmission, processing or storing of information. (cybersystème)designated operator means a person, partnership or unincorporated organization that belongs to any class of operators referred to in Schedule 2. (exploitant désigné)Governor has the same meaning as in section 2 of the Bank of Canada Act. (gouverneur)Minister means the Minister of Public Safety and Emergency Preparedness or, if another federal minister is designated under section 4, that minister. (ministre)regulator meansthe Minister of Industry;the Minister of Transport;the Superintendent;the Bank;the Canadian Energy Regulator; orthe Canadian Nuclear Safety Commission. (organisme réglementaire)responsible minister means the minister responsible for an Act that is ordinarily administered by an appropriate regulator with respect to any class of operators set out in Schedule 2. (ministre compétent)Superintendent means the Superintendent of Financial Institutions appointed under subsection 5(1) of the Office of the Superintendent of Financial Institutions Act. (surintendant)Tribunal means the Transportation Appeal Tribunal of Canada that is established under subsection 2(1) of the Transportation Appeal Tribunal of Canada Act. (Tribunal)vital service means a service that is referred to in Schedule 1. (service critique)vital system means a system that is referred to in Schedule 1. (système critique)ApplicationBinding on His MajestyThis Act is binding on His Majesty in right of Canada.Designation of MinisterThe Governor in Council may, by order, designate any federal minister to be the Minister referred to in this Act.PurposePurposeThe purpose of this Act is to help to protect critical cyber systems in order to support the continuity and security of vital services and vital systems by ensuring that, among other things,any cyber security risks in respect of critical cyber systems are identified and managed, including risks associated with supply chains and the use of third-party products and services;critical cyber systems are protected from being compromised;any cyber security incidents affecting, or having the potential to affect, critical cyber systems are detected; andthe impacts of cyber security incidents affecting critical cyber systems are minimized.Vital Services and Vital SystemsAddition to Schedule 1The Governor in Council may, by order, add to Schedule 1 a service that is delivered, or a system that is operated, as part of a work, undertaking or business that is within the legislative authority of Parliament, if the Governor in Council is satisfied that the service or system is vital to national security or public safety.Amendment to Schedule 1The Governor in Council may, by order, amend or delete any service or system set out in Schedule 1.Designated Operators of Critical Cyber SystemsClass of operators and corresponding regulatorThe Governor in Council may, by order, amend Schedule 2 byaddinga class of operators — consisting of persons, partnerships or unincorporated organizations that operate a work or carry on an undertaking or business that is within the legislative authority of Parliament — in respect of a vital service or vital system, andthe regulator for that class; oramending or deleting a class of operators or the regulator for that class.Critical cyber system — obligation of designated operatorA designated operator that owns, controls or operates a critical cyber system must comply with the requirements of this Act and the regulations with respect to that critical cyber system.Cyber Security ProgramEstablishing cyber security programAfter an order that is made under section 7 is published in the Canada Gazette, Part II, a designated operator that belongs to a class of operators set out in Schedule 2 must, within 90 days after the day on which the designated operator becomes a member of that class, establish a cyber security program in respect of its critical cyber systems and include in the program steps to, in accordance with any regulations,identify and manage any organizational cyber security risks, including risks associated with the designated operator’s supply chain and its use of third-party products and services;protect its critical cyber systems from being compromised;detect any cyber security incidents affecting, or having the potential to affect, its critical cyber systems;minimize the impact of cyber security incidents affecting critical cyber systems; anddo anything that is prescribed by the regulations.NoticeImmediately after the program has been established, the designated operator must notify the appropriate regulator in writing that the program has been established.Providing program to appropriate regulatorThe designated operator must, within 90 days after the day on which the designated operator becomes a member of a class of operators that is set out in Schedule 2, provide the cyber security program or make it available to the appropriate regulator in the manner prescribed by the regulations or, if no manner is so prescribed, in the manner that the appropriate regulator considers appropriate.Extension of 90-day periodThe appropriate regulator may, at the designated operator’s written request, extend the 90-day period for complying with either subsection 9(1) or section 10, or both. The 90-day period may be extended more than once at the discretion of the appropriate regulator.Implementation and maintenance of programAfter a cyber security program is established, the designated operator must implement that program by taking the steps that are included in the program under section 9 and maintain the program.Review of cyber security program — commencementA designated operator must commence a review of its cyber security program on each date that is prescribed by the regulations or, if no dates are prescribed, on every anniversary of the day on which its cyber security program was established under section 9.Completion of reviewThe designated operator must complete the review within 60 days after the day on which the review was commenced under subsection (1), unless another period is prescribed by the regulations, and amend the program as a result of the review if needed.Notification — changes to programThe designated operator must, within 30 days after the day on which the review is completed, unless another period is prescribed by the regulations, notify the appropriate regulator of whether or not any changes were made to the program after the previous review.Notification — other changesA designated operator must, within a period prescribed by the regulations, notify the appropriate regulator ofany material change in the designated operator’s ownership or control;any material change in the designated operator’s supply chain or in its use of third-party products and services; andany circumstances that are prescribed by the regulations.Further notification — changes to programThe designated operator must, within 90 days after the day on which a notification was provided under subsection (1), also notify the appropriate regulator whether or not any changes were made to the program as a result of any material changes or any circumstances described in paragraph (1)(a), (b) or (c) and, if changes were made, the nature of those changes.Extension of 90-day periodThe appropriate regulator may, at the designated operator’s written request, extend the 90-day period for complying with subsection (2). The 90-day period may be extended more than once at the discretion of the appropriate regulator.Mitigation of Supply-Chain and Third-Party RisksMitigation — supply-chain or third-partyAs soon as any cyber security risk associated with the designated operator’s supply chain or its use of third-party products and services has been identified under paragraph 9(1)(a), the designated operator must mitigate those risks.Guidance from Communications Security EstablishmentAn appropriate regulator may provide to the Communications Security Establishment any information, including any confidential information, respecting a designated operator’s cyber security program or any steps taken under section 15, for the purpose of requesting advice, guidance or services from the Communications Security Establishment in accordance with the mandate of the Communications Security Establishment, in respect of the exercise of the appropriate regulator’s powers or the performance of its duties and functions under this Act.Reporting of Cyber Security IncidentsReport — cyber security incidentA designated operator must, within a period prescribed by the regulations, not to exceed 72 hours, report a cyber security incident in respect of any of its critical cyber systems to the Communications Security Establishment in accordance with the regulations, for the purpose of enabling the Communications Security Establishment to exercise its powers or perform its duties and functions.NotifyImmediately after reporting a cyber security incident, the designated operator mustnotify the appropriate regulator, in the form and manner prescribed by the regulations that the report was made; andgive a copy of the report to the appropriate regulator.Communications Security Establishment — provision of incident reportThe Communications Security Establishment must, without delay, at the request of a regulator, give that regulator a copy of any incident report or any portion of it that relates to a designated operator in respect of which that regulator is the appropriate regulator, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.Cyber Security DirectionsDirectionThe Governor in Council may, by order, direct any designated operator or class of operators to comply with any measure set out in the direction for the purpose of protecting a critical cyber system, if the Governor in Council believes on reasonable grounds that it is necessary to make the order for that purpose.Amend or revokeThe Governor in Council may, by order, amend or revoke a direction in whole or in part.FactorsBefore making an order under subsection (1), the Governor in Council must considerits operational impacts on affected designated operators;its impact on public safety of Canadians;its financial impacts on affected designated operators;its impact on the delivery of vital services and vital systems to consumers; andany other factor that the Governor in Council considers to be relevant.Compliance with directionEvery designated operator that is subject to a direction must comply with it.Notification by MinisterThe Minister must, within 90 days after an order is made under subsection (1), notify the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency of the making of the order.For greater certaintyFor greater certainty, despite subsection (1), the Governor in Council is not permitted to order any designated operator or class of operators to intercept a private communication or a radio-based telephone communication, as those terms are defined in section 183 of the Criminal Code.Contents of directionA direction made under section 20 must set outthe name of the designated operator or the class of operators in respect of which the direction applies;the measures to be taken by the designated operator along with any conditions; andthe period within which those measures are to be taken.ConditionIn addition to any conditions referred to in paragraph (1)(b), the Governor in Council may impose other conditions in a direction.Exemption from Statutory Instruments ActAn order made under section 20 is exempt from the application of sections 3, 5 and 11 of the Statutory Instruments Act.Precondition for contraventionA designated operator must not be found to have contravened a direction made under section 20 unless it is proved that, at the time of the alleged contravention, the designated operator had been notified of the direction or reasonable steps had been taken to bring the purport of the notice to those designated operators likely to be affected by it.CertificateA certificate purporting to be signed by the Minister or responsible minister and stating that a notice containing the order was given to designated operators likely to be affected by it is, in the absence of evidence to the contrary, proof that notice was given to those designated operators.Exchange of informationTo the extent necessary, for any purpose related to the making, amending or revoking of a cyber security direction in respect of a designated operator, the following persons or entities may collect information from and disclose information, including confidential information, to each other:the Minister;the responsible minister;the appropriate regulator;the Minister of Foreign Affairs;the Minister of National Defence;the Chief of the Defence Staff;the Chief or an employee of the Communications Security Establishment;the Director or an employee of the Canadian Security Intelligence Service; andany other person or entity that is prescribed by the regulations.Confidential informationAny confidential information, within the meaning of this Act or any other Act of Parliament that applies to or is administered by a person or entity referred to in subsection (1), that is collected or disclosed under that subsection must be treated as confidential.Prohibition against disclosureEvery designated operator that is subject to a cyber security direction is prohibited from disclosing, or allowing to be disclosed, the fact that a cyber security direction was issued and the content of that direction, except in accordance with section 25.Disclosure — when allowedA designated operator that is subject to a cyber security direction may disclose the fact that the direction was issued and its content only to the extent necessary to comply with the direction.Prohibition — further disclosureA person must not, without the authorization of the designated operator, disclose or allow the disclosure of any information obtained by them under subsection (1).Disclosure and Use of InformationProhibitionSubject to subsection (2), a person must not knowingly disclose confidential information or allow it to be disclosed to any agency, body or other person or allow any other agency, body or other person to have access to the information, except ifthe disclosure is required by law;the information to be disclosed is publicly available;the designated operator to which the information relates consents to its disclosure;the disclosure is necessary for the protection of vital services, vital systems or critical cyber systems;the disclosure is made in accordance with any provision of this Act; orthe disclosure is made in accordance with the Security of Canada Information Disclosure Act.Right to disclose information preservedNothing in this section precludes a person from disclosing confidential information to a law enforcement agency or the Canadian Security Intelligence Service if the disclosure of the information is otherwise lawful.Confidential informationAny confidential information that is disclosed or allowed to be accessed under subsection (1) must be treated as confidential.Agreements and arrangements — exchange of informationSubject to subsection (2), the Minister, a responsible minister or a regulator may enter into an agreement or arrangement, in writing, with the government of a province or of a foreign state, or with an international organization established by the governments of foreign states, for the exchange of information, other than confidential information, relating to the protection of critical cyber systemsbetween the Minister, the responsible minister or the regulator, as the case may be, and any institution or agency of that government; orbetween the Minister, the responsible minister or the regulator, as the case may be, and the international organization.Confidential information — government of provinceConfidential information may be disclosed to any institution or agency of the government of the province only ifit is disclosed under the agreement or arrangement; andthe Minister, the responsible minister or the regulator, as the case may be, is satisfied that the information will be treated in a confidential manner and not be further disclosed without their express consent.Exchange of information by appropriate regulatorIf it is necessary for the protection of vital services, vital systems or critical cyber systems, the appropriate regulator for a class of operators may provide the Minister or the responsible minister with any information, including any confidential information, that is related to the exercise of the appropriate regulator’s powers or the performance of its duties and functions under this Act or the regulations. However, if for the same reason the Minister or the responsible minister makes a request for the information, the appropriate regulator must provide the information so requested.Confidential informationAny confidential information, within the meaning of this Act or any other Act of Parliament that applies to or is administered by the appropriate regulator, that is provided under subsection (1) must be treated as confidential.Request for informationFor the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, a regulator may request that a person, partnership or unincorporated organization provide it with any information, and the person, partnership or unincorporated organization, as the case may be, must provide the requested information within the time and in the manner set out in the request.Record KeepingRecordsEvery designated operator must keep records respectingany steps taken to implement the designated operator’s cyber security program;every cyber security incident that the designated operator reported under section 17;any steps taken by the designated operator under section 15 to mitigate any supply-chain or third-party risks;any measures taken by the designated operator to implement a cyber security direction; andany matter prescribed by the regulations.PlaceThe records must be kept in Canada by the designated operator at any place that is prescribed by the regulations — or, if no place is prescribed, at the designated operator’s place of business — and in the manner and for the period determined by the appropriate regulator unless another manner or period is prescribed by the regulations.Administration and EnforcementLimitation on LiabilityNo liabilityA person who exercises powers or performs duties or functions under this Act is not liable in respect of anything done or omitted to be done in good faith in the exercise of those powers or the performance of those duties or functions.Immunity — accompanying personsA person referred to in subsection 32(5), 41(5), 50(5), 59(5), 68(5) or 78(5) is not liable for anything done or omitted to be done in good faith while helping any other person in the exercise of their powers or the performance of their duties and functions under this Act.PowersSuperintendent of Financial InstitutionsGeneral ProvisionsAuthority to enter place — SuperintendentSubject to section 33, the Superintendent may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which the Superintendent has reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.Powers of entryFor the purpose referred to in subsection (1), the Superintendent mayexamine anything in the place;use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;prepare a document, or cause one to be prepared, based on the information;examine any record, report, data or other document and make copies of it or take extracts from it;use any copying equipment in the place or cause it to be used; andremove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.Return of document, record or cyber systemIf the Superintendent removes any document, record or cyber system under paragraph (2)(f), the Superintendent must return it to its owner or the person in charge of it, on completion of the examination or copying.Duty to assistEvery owner or person in charge of a place that is entered by the Superintendent and every person found in the place must give the Superintendent all reasonable assistance to enable the Superintendent to exercise the Superintendent’s powers or perform the Superintendent’s duties and functions under this Act and provide the Superintendent with any document or information, or access to any data, that the Superintendent may reasonably require.Persons accompanyingThe Superintendent may be accompanied by any other person that the Superintendent believes is necessary to help the Superintendent exercise the Superintendent’s powers or perform the Superintendent’s duties and functions under this section.Entering private propertyThe Superintendent and any person accompanying the Superintendent may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).Dwelling-houseIn the case of a dwelling-house, the Superintendent is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).Authority to issue warrantA justice of the peace may, on ex parte application, issue a warrant authorizing the Superintendent to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath thatthe dwelling-house is a place referred to in subsection 32(1);entry to the dwelling-house is necessary for a purpose referred to in subsection 32(1); andentry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.Use of forceIn executing the warrant, the Superintendent is not entitled to use force unless the use of force has been specifically authorized in the warrant and the Superintendent is accompanied by a peace officer.Internal AuditInternal audit orderSubject to any regulations, the Superintendent may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReportThe designated operator must comply with the order and provide to the Superintendent, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.Compliance OrderPower to order termination of contraventionIf the Superintendent believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the Superintendent may order a designated operator tostop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; ortake any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.Time and mannerThe order must specify the time within which and the manner in which the designated operator may request a review of the order by the Superintendent.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.Compliance with orderA designated operator that is subject to an order made under section 36 must comply with it.Notification of complianceOnce the designated operator complies with the order, it must notify the Superintendent, without delay, of its compliance.Request for reviewAn order that is made under section 36 must be reviewed by the Superintendent at the written request of the designated operator that is subject to the order.Contents and time for making requestThe request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.Order in effectThe order continues to apply during a review unless the Superintendent decides otherwise.Decision on completion of reviewOn completion of a review, the Superintendent must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.Deemed decisionIf the Superintendent does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Superintendent and the designated operator, the Superintendent is deemed to have confirmed the order.Minister of IndustryGeneral ProvisionsDesignation of inspectorsThe Minister of Industry may designate persons or classes of persons as inspectors for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.Certificate of designationEach inspector must be provided with a certificate of designation in a form established by the Minister of Industry and, when entering any place under subsection 41(1), must, on request, produce the certificate to the person in charge of the place.Authority to enter place — inspectorSubject to subsection 42(1), the inspector may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.Powers of entryFor the purpose referred to in subsection (1), the inspector mayexamine anything in the place;use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;prepare a document, or cause one to be prepared, based on the information;examine any record, report, data or other document and make copies of it or take extracts from it;use any copying equipment in the place or cause it to be used; andremove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.Return of document, record or cyber systemIf the inspector removes any document, record or cyber system referred to in paragraph (2)(f), the inspector must return it to its owner or the person in charge of it, on completion of the examination or copying.Duty to assistEvery owner or person in charge of a place that is entered by the inspector and every person found in the place must give the inspector all reasonable assistance to enable the inspector to exercise the inspector’s powers or perform the inspector’s duties and functions under this Act and provide that inspector with any document or information, or access to any data, that the inspector may reasonably require.Persons accompanyingThe inspector may be accompanied by any other person that the inspector believes is necessary to help the inspector exercise the inspector’s powers or perform the inspector’s duties and functions under this section.Entering private propertyThe inspector and any person accompanying the inspector may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).Dwelling-houseIn the case of a dwelling-house, the inspector is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).Authority to issue warrantA justice of the peace may, on ex parte application, issue a warrant authorizing the inspector named in it to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath thatthe dwelling-house is a place referred to in subsection 41(1);entry to the dwelling-house is necessary for a purpose referred to in subsection 41(1); andentry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.Use of forceIn executing the warrant, the inspector is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.Internal AuditInternal audit orderSubject to any regulations, the Minister of Industry or a person designated by that Minister may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReportThe designated operator must comply with the order and provide to the Minister of Industry or the person designated by that Minister, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.Compliance OrderPower to order termination of contraventionIf the Minister of Industry or a person designated by that Minister believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, they may order a designated operator tostop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; ortake any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.Time and mannerThe order must specify the time within which and the manner in which the designated operator may request a review of the order by the Minister of Industry.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.Compliance with orderA designated operator that is subject to an order made under section 45 must comply with it.Notification of complianceOnce the designated operator complies with the order, it must notify the Minister of Industry or the person designated by that Minister, without delay, of its compliance.Request for reviewAn order that is made under section 45 must be reviewed by the Minister of Industry at the written request of the designated operator that is subject to the order.Contents and time for making requestThe request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.Order in effectThe order continues to apply during a review unless the Minister of Industry decides otherwise.Decision on completion of reviewOn completion of a review, the Minister of Industry must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.Deemed decisionIf the Minister of Industry does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Minister of Industry and the designated operator, the Minister of Industry is deemed to have confirmed the order.Bank of CanadaGeneral ProvisionsDesignationThe Bank may designate persons or classes of persons for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.Certificate of designationEach person designated under subsection (1) must be provided with a certificate of designation in a form established by the Bank and, when entering any place under subsection 50(1), must, on request, produce the certificate to the person in charge of the place.Authority to enter place — designated personSubject to section 51, the person designated under subsection 49(1) may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.Powers of entryFor the purpose referred to in subsection (1), the person designated under subsection 49(1) mayexamine anything in the place;use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;prepare a document, or cause one to be prepared, based on the information;examine any record, report, data or other document and make copies of it or take extracts from it;use any copying equipment in the place or cause it to be used; andremove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.Return of document, record or cyber systemIf the person designated under subsection 49(1) removes any document, record or cyber system referred to in paragraph (2)(f), the person so designated must return it to its owner or the person in charge of it, on completion of the examination or copying.Duty to assistEvery owner or person in charge of a place that is entered by the person designated under subsection 49(1) and every person found in the place must give the person designated under subsection 49(1) all reasonable assistance to enable them to exercise their powers or perform their duties and functions under this Act and provide that person designated under subsection 49(1) with any document or information, or access to any data, that they may reasonably require.Persons accompanyingThe person designated under subsection 49(1) may be accompanied by any other person that they believe is necessary to help them exercise their powers or perform their duties and functions under this section.Entering private propertyThe person designated under subsection 49(1) and any person accompanying the person so designated may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).Dwelling-houseIn the case of a dwelling-house, the person designated under subsection 49(1) is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).Authority to issue warrantA justice of the peace may, on ex parte application, issue a warrant authorizing the person designated under subsection 49(1) and named in the warrant to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath thatthe dwelling-house is a place referred to in subsection 50(1);entry to the dwelling-house is necessary for a purpose referred to in subsection 50(1); andentry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.Use of forceIn executing the warrant, the person designated under subsection 49(1) is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.Internal AuditInternal audit orderSubject to any regulations, the Bank may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReportThe designated operator must comply with the order and provide to the Bank, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.Compliance OrderPower to order termination of contraventionIf a person designated by the Bank believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the person so designated may order a designated operator tostop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; ortake any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.Time and mannerThe order must specify the time within which and manner in which the designated operator may request a review of the order by the person designated by the Bank.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.Compliance with orderA designated operator that is subject to an order made under section 54 must comply with it.Notification of complianceOnce the designated operator complies with the order, it must notify the person designated by the Bank referred to in subsection 54(1), without delay, of its compliance.Request for reviewAn order that is made under section 54 must be reviewed by the Governor at the written request of the designated operator that is subject to the order.Contents and time for making requestThe request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.Order in effectThe order continues to apply during a review unless the Governor decides otherwise.Decision on completion of reviewOn completion of a review, the Governor must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.Deemed decisionIf the Governor does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Governor and the designated operator, the Governor is deemed to have confirmed the order.Canadian Nuclear Safety CommissionGeneral ProvisionsDesignationThe Canadian Nuclear Safety Commission may designate persons or classes of persons for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.Certificate of designationEach person designated under subsection (1) must be provided with a certificate of designation in a form established by the Canadian Nuclear Safety Commission and, when entering any place under subsection 59(1), must, on request, produce the certificate to the person in charge of the place.Authority to enter place — designated personSubject to subsection 60(1), the person designated under subsection 58(1) may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.Powers of entryFor the purpose referred to in subsection (1), the person designated under subsection 58(1) mayexamine anything in the place;use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;prepare a document, or cause one to be prepared, based on the information;examine any record, report, data or other document and make copies of it or take extracts from it;use any copying equipment in the place or cause it to be used; andremove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.Return of document, record or cyber systemIf the person designated under subsection 58(1) removes any document, record or cyber system referred to in paragraph (2)(f), the person so designated must return it to its owner or the person in charge of it, on completion of the examination or copying.Duty to assistEvery owner or person in charge of a place that is entered by the person designated under subsection 58(1) and every person found in the place must give the person designated under subsection 58(1) all reasonable assistance to enable them to exercise their powers or perform their duties and functions under this Act and provide them with any document or information, or access to any data, that they may reasonably require.Persons accompanyingThe person designated under subsection 58(1) may be accompanied by any other person that they believe is necessary to help them exercise their powers or perform their duties and functions under this section.Entering private propertyThe person designated under subsection 58(1) and any person accompanying the person so designated may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).Dwelling-houseIn the case of a dwelling-house, the person designated under subsection 58(1) is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).Authority to issue warrantA justice of the peace may, on ex parte application, issue a warrant authorizing the person designated under subsection 58(1) and named in the warrant to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath thatthe dwelling-house is a place referred to in subsection 59(1);entry to the dwelling-house is necessary for a purpose referred to in subsection 59(1); andentry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.Use of forceIn executing the warrant, the person designated under subsection 58(1) is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.Internal AuditInternal audit orderSubject to any regulations, the person designated under subsection 58(1) may, by order in writing, require a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReviewA person designated under subsection 58(1) must refer any order made under this section to the Canadian Nuclear Safety Commission for review and the Canadian Nuclear Safety Commission must confirm, amend or revoke the order.ReportThe designated operator must comply with the order and provide to the person designated under subsection 58(1), within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.Compliance OrderPower to order termination of contraventionIf the person designated under subsection 58(1) believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the person so designated may, by order, require a designated operator tostop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; ortake any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.Time and mannerThe order must specify the time within which and manner in which the designated operator may request a review of the order by the Canadian Nuclear Safety Commission.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReviewA person designated under subsection 58(1) must refer any order made under this section to the Canadian Nuclear Safety Commission for review and the Canadian Nuclear Safety Commission must confirm, amend or revoke the order.Compliance with orderA designated operator that is subject to an order made under section 63 must comply with it.Notification of complianceOnce the designated operator complies with the order, it must notify the person designated under subsection 58(1), without delay, of its compliance.Request for reviewAn order that is made under section 63 must be reviewed by the Canadian Nuclear Safety Commission at the written request of the designated operator that is subject to the order.Contents and time for making requestThe request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.Order in effectThe order continues to apply during a review unless the Canadian Nuclear Safety Commission decides otherwise.Decision on completion of reviewOn completion of a review under subsection 65(1), the Canadian Nuclear Safety Commission must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.Deemed decisionIf the Canadian Nuclear Safety Commission does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Canadian Nuclear Safety Commission and the designated operator, the Canadian Nuclear Safety Commission is deemed to have confirmed the order.Canadian Energy RegulatorGeneral ProvisionsDesignation of inspection officersThe Chief Executive Officer may designate persons or classes of persons as inspection officers for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.Certificate of designationEach inspection officer must be provided with a certificate of designation in a form established by the Canadian Energy Regulator and, when entering any place under subsection 68(1), must, on request, produce the certificate to the person in charge of the place.Authority to enter place — inspection officerSubject to subsection 69(1), the inspection officer may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.Powers of entryFor the purpose referred to in subsection (1), the inspection officer mayexamine anything in the place;use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;prepare a document, or cause one to be prepared, based on the information;examine any record, report, data or other document and make copies of it or take extracts from it;use any copying equipment in the place or cause it to be used; andremove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.Return of document, record or cyber systemIf the inspection officer removes any document, record or cyber system referred to in paragraph (2)(f), the inspection officer must return it to its owner or the person in charge of it, on completion of the examination or copying.Duty to assistEvery owner or person in charge of a place that is entered by the inspection officer and every person found in the place must give the officer all reasonable assistance to enable the officer to exercise the officer’s powers or perform the officer’s duties and functions under this Act and provide that officer with any document or information, or access to any data, that the officer may reasonably require.Persons accompanyingThe inspection officer may be accompanied by any other person that the inspection officer believes is necessary to help the inspection officer exercise the inspection officer’s powers or perform the inspection officer’s duties and functions under this section.Entering private propertyThe inspection officer and any person accompanying the inspection officer may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).Dwelling-houseIn the case of a dwelling-house, the inspection officer is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).Authority to issue warrantA justice of the peace may, on ex parte application, issue a warrant authorizing the inspection officer named in it to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath thatthe dwelling-house is a place referred to in subsection 68(1);entry to the dwelling-house is necessary for a purpose referred to in subsection 68(1); andentry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.Use of forceIn executing the warrant, the inspection officer is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.Internal AuditInternal audit orderSubject to any regulations, an inspection officer who is expressly authorized by the Chief Executive Officer to make orders under this section may, by order in writing, require a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.Notice and reportThe inspection officer who makes an order under this section must, as soon as possible, report the circumstances and terms of the order to the Commission.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReportThe designated operator must comply with the order and provide to the inspection officer within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.Notice of Non-ComplianceNotice of non-complianceIf an inspection officer has reasonable grounds to believe that a designated operator or other person has contravened any provision of this Act or the regulations made under this Act, the inspection officer may issue a notice of non-compliance to the designated operator or other person.Contents of noticeThe notice of non-compliance must be made in writing and must set outthe name of the designated operator or other person to which the notice is directed;the provision of this Act or of the regulations made under it that is alleged to have been contravened or the order or decision that is alleged to have been contravened;the relevant facts surrounding the alleged contravention; andthe period within which the designated operator or other person may provide comments in response to the notice.Compliance OrderPower to order termination of contraventionIf the inspection officer who is expressly authorized by the Chief Executive Officer to make orders under this section believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the inspection officer may order a designated operator tostop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; ortake any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.Time and mannerThe order may specify the time within which and the manner in which the designated operator may request a review of the order by the Commission.Notice and reportAn inspection officer who makes an order under this section must, as soon as possible,notify, in writing, the designated operator of the terms of the order and the reasons for the order; andreport the circumstances and terms of the order to the Commission.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.Compliance with orderA designated operator that is subject to an order made under section 73 must comply with it.Notification of complianceOnce the designated operator complies with the order, it must notify the inspection officer, without delay, of its compliance.Powers of CommissionThe Commission may designate persons or classes of persons to conduct reviews under this section.Request for reviewAn order that is made under section 73 must be reviewed by the Commission or the person designated under subsection (1) at the written request of the designated operator that is subject to the order.Contents and time for making requestThe request must be made within the time and in the manner specified in the order, if any, and state the grounds for review and set out the evidence that supports those grounds.Order in effectThe order continues to apply during a review unless the Commission or the person designated under subsection (1) decides otherwise.Decision on completion of reviewOn completion of a review, the Commission or the person designated under subsection 75(1) must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.Deemed decisionIf the Commission or the person designated under subsection 75(1) does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Commission or the person designated under subsection 75(1) and the designated operator, the Commission or the person designated under subsection 75(1) is deemed to have confirmed the order.Minister of TransportGeneral ProvisionsDelegationThe Minister of Transport may delegate, subject to any restrictions or limitations that the Minister of Transport may specify, any of the Minister of Transport’s powers, duties and functions under this Act — other than the power to delegate under this section — to any person or class of persons.Authority to enter place — Minister of TransportSubject to section 79, the Minister of Transport may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which the Minister of Transport has reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.Powers of entryFor the purpose referred to in subsection (1), the Minister of Transport mayexamine anything in the place;use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;prepare a document, or cause one to be prepared, based on the information;examine any record, report, data or other document and make copies of it or take extracts from it;use any copying equipment in the place or cause it to be used; andremove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.Return of document, record or cyber systemIf the Minister of Transport removes any document, record or cyber system referred to in paragraph (2)(f), the Minister of Transport must return it to its owner or the person in charge of it, on completion of the examination or copying.Duty to assistEvery owner or person in charge of a place that is entered by the Minister of Transport and every person found in the place must give the Minister of Transport all reasonable assistance to enable the Minister of Transport to exercise the Minister of Transport’s powers or perform the Minister of Transport’s duties and functions under this Act and provide that Minister with any document or information, or access to any data, that the Minister of Transport may reasonably require.Persons accompanyingThe Minister of Transport may be accompanied by any other person that the Minister of Transport believes is necessary to help the Minister of Transport exercise the Minister of Transport’s powers or perform the Minister of Transport’s duties and functions under this section.Entering private propertyThe Minister of Transport and any person accompanying the Minister of Transport may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).Dwelling-houseIn the case of a dwelling-house, the Minister of Transport is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).Authority to issue warrantA justice of the peace may, on ex parte application, issue a warrant authorizing the Minister of Transport to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath thatthe dwelling-house is a place referred to in subsection 78(1);entry to the dwelling-house is necessary for a purpose referred to in subsection 78(1); andentry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.Use of forceIn executing the warrant, the Minister of Transport is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.Internal AuditInternal audit orderSubject to any regulations, the Minister of Transport may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.ReportThe designated operator must comply with an order and provide to the Minister of Transport, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.Compliance OrderPower to order termination of contraventionIf the Minister of Transport believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the Minister of Transport may order a designated operator tostop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; ortake any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.Time and mannerThe order must specify the time within which and the manner in which the designated operator may request a review of the order by the Minister of Transport.Exemption from Statutory Instruments ActAn order made under subsection (1) is exempt from the application of the Statutory Instruments Act.Compliance with orderA designated operator that is subject to an order made under section 82 must comply with it.Notification of complianceOnce the designated operator complies with the order, it must notify the Minister of Transport, without delay, of its compliance.Request for reviewAn order that is made under section 82 must be reviewed by the Minister of Transport at the written request of the designated operator that is subject to the order.Contents and time for making requestThe request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.Order in effectThe order continues to apply during a review unless the Minister of Transport decides otherwise.Decision on completion of reviewOn completion of a review, the Minister of Transport must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.Deemed decisionIf the Minister of Transport does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Minister of Transport and the designated operator, the Minister of Transport is deemed to have confirmed the order.General ProvisionsObstructionA person must not obstruct or hinder the Superintendent, inspector, person designated under subsection 49(1) or 58(1), inspection officer or Minister of Transport, as the case may be, in exercising their powers or performing their duties and functions under this Act.Providing false or misleading informationA person must not, with respect to any matter related to this Act, knowinglyprovide any person with false or misleading information; orprovide any incident report that contains false or misleading information.Administrative Monetary PenaltiesGeneral ProvisionsDefinition of penaltyIn sections 89 to 135, penalty means an administrative monetary penalty imposed under those sections for a violation.Purpose of penaltyThe purpose of a penalty is to promote compliance with this Act and not to punish.ViolationEvery designated operator or other person that contravenes or fails to comply with a provision of this Act or of the regulations made under this Act — designated by regulations made under paragraph 135(1)(f) — commits a violation and is liable to a penalty of an amount to be determined in accordance with this Act and the regulations.PenaltyThe amount that may be fixed under any regulations made under paragraph 135(1)(h) as the penalty for a violation must not be more than$1,000,000, in the case of an individual; and$15,000,000, in any other case.Due diligence availableDue diligence is a defence in a proceeding in relation to a violation.Common law principlesEvery rule and principle of the common law that renders any circumstance a justification or excuse in relation to a charge for an offence under this Act applies in respect of a violation to the extent that it is not inconsistent with this Act.Liability of directors or officersIf a designated operator commits a violation, any director or officer of the designated operator that directed, authorized, assented to, acquiesced in or participated in the commission of the violation is a party to the violation and is liable to a penalty of an amount to be determined in accordance with this Act and the regulations, whether or not the designated operator has been proceeded against in accordance with this Act.Continuing violationA violation that is committed or continued on more than one day constitutes a separate violation in respect of each day on which it is committed or continued.Violation or offenceProceeding with any act or omission as a violation under this Act precludes proceeding with it as an offence under this Act, and proceeding with it as an offence under this Act precludes proceeding with it as a violation under this Act.Violations not offencesFor greater certainty, a violation is not an offence and, accordingly, section 126 of the Criminal Code does not apply in respect of a violation.Limitation period or prescriptionProceedings in respect of a violation must not be commenced later than three years after the subject-matter of the proceedings became known to the appropriate regulator.Debts to His MajestyA penalty and any interest due in respect of the penalty constitute a debt due to His Majesty in right of Canada and may be recovered in the Federal Court or any other court of competent jurisdiction.Limitation period or prescriptionProceedings to recover the debt must not be commenced after the period of five years that begins on the day on which the debt became payable.Proceeds payable to Receiver GeneralA penalty paid or recovered under this Act is payable to and must be remitted to the Receiver General.Certificate of defaultThe unpaid amount of any debt referred to in subsection 97(1) may be certified bythe appropriate regulator; orif the appropriate regulator is the Minister of Transport, by the Tribunal.RegistrationRegistration in the Federal Court or in any other court of competent jurisdiction of a certificate issued under subsection (1) has the same force and effect as a judgment of that court for a debt of the amount specified in the certificate and all related registration costs.Superintendent of Financial InstitutionsGeneral ProvisionsNotice of violation — SuperintendentIf the Superintendent has reasonable grounds to believe that a designated operator or other person has committed a violation, the Superintendent may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the Superintendent must cause it to be served on the designated operator or other person.Contents of notice of violationThe notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set outthe penalty for the violation that the designated operator or other person is liable to pay;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Superintendent specifies, to pay the penalty or to make representations to the Superintendent with respect to the violation or the proposed penalty, or both, and the manner for doing so; andthe fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.Correction or cancellation of notice of violationAt any time before the designated operator or other person makes representations in respect of a notice of violation to the Superintendent or enters into a compliance agreement with the Superintendent, the Superintendent may cancel the notice of violation or correct an error in it.PenaltyThe penalty for a violation is to be determined by taking into accountthe designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;the nature and scope of the violation;whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;whether the designated operator or other person derived any competitive or economic benefit from the violation;any other factors prescribed by the regulations; andany other factors that the Superintendent considers relevant.PaymentIf the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.AlternativesInstead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,make representations to the Superintendent in respect of the alleged violation or of the penalty; orif the Superintendent offers a compliance agreement, enter into the compliance agreement with the Superintendent to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.Representation to SuperintendentThe Superintendent must decide, on a balance of probabilities, after considering any representations made under paragraph 101(2)(a), whether the designated operator or other person committed the violation and, if the Superintendent so decides, the Superintendent may, subject to the regulations made under paragraph 135(1)(h), impose the penalty set out in the notice, a lesser penalty or no penalty.DecisionThe Superintendent must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.Responsibility to pay penaltyIf the Superintendent decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.Effect of paymentIf the designated operator or other person pays the penalty set out in the decision, the Superintendent must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.Violation not committed — effectIf the Superintendent decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of the violation are ended.Compliance AgreementsEntering into compliance agreementsIf the Superintendent offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Superintendent considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.RepresentationsIf a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 101(2)(a).DeemingA designated operator or other person that enters into a compliance agreement with the Superintendent is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the Superintendent is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Superintendent must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.Notice of defaultIf the Superintendent is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Superintendent must cause the designated operator or other person to be served with a notice of default informing them thatthey are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; andthe Superintendent may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.Effect of paymentIf a designated operator or other person pays the penalty set out in the notice of default within the time and in the manner set out in that notice, the Superintendent must accept the amount as complete satisfaction of the penalty owing in respect of the violation and the proceedings commenced in respect of the violation are ended.Minister of IndustryGeneral ProvisionsDesignationThe Minister of Industry may designate persons or classes of persons who are authorized to issue notices of violation and to enter into a compliance agreement with a designated operator.Notice of violation — designated personIf a person designated under section 104 has reasonable grounds to believe that a designated operator or other person has committed a violation, the person so designated may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the person designated under section 104 must cause it to be served on the designated operator or other person.Contents of notice of violationThe notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set outthe penalty for the violation that the designated operator or other person is liable to pay;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 104 specifies, to pay the penalty or to make representations to the Minister of Industry with respect to the violation or the proposed penalty, or both, and the manner for doing so; andthe fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.Correction or cancellation of notice of violationAt any time before the designated operator or other person makes representations in respect of a notice of violation to the Minister of Industry or enters into a compliance agreement with the person designated under section 104, the person so designated may cancel the notice of violation or correct an error in it.PenaltyThe penalty for a violation is to be determined by taking into accountthe designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;the nature and scope of the violation;whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;whether the designated operator or other person derived any competitive or economic benefit from the violation;any other factors prescribed by the regulations; andany other factors that the person designated under section 104 who issued the notice of violation considers relevant.PaymentIf the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.AlternativesInstead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,make representations to the Minister of Industry in respect of the alleged violation or of the penalty; orif the person designated under section 104 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.RepresentationThe Minister of Industry must decide, on a balance of probabilities, after considering any representations made under paragraph 107(2)(a), whether the designated operator or other person committed the violation and, if that Minister so decides, that Minister may, subject to the regulations made under paragraph 135(1)(h), impose the penalty set out in the notice, a lesser penalty or no penalty.DecisionThe Minister of Industry must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.Responsibility to pay penaltyIf the Minister of Industry determines that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.Effect of paymentIf the designated operator or other person pays the penalty set out in the decision, the Minister of Industry must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.Violation not committed — effectIf the Minister of Industry determines that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.Compliance AgreementsEntering into compliance agreementsIf the person designated under section 104 offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the person so designated considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.RepresentationsIf a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 107(2)(a).DeemingA designated operator or other person that enters into a compliance agreement with the person designated under section 104 is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the person designated under section 104 is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the person so designated must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.Notice of defaultIf the person designated under section 104 is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the person so designated must cause the designated operator or other person to be served with a notice of default informing them thatthey are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; andthe Minister of Industry may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.Effect of paymentIf a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Minister of Industry must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.Bank of CanadaGeneral ProvisionsNotice of violation — BankIf the Bank has reasonable grounds to believe that a designated operator or other person has committed a violation, the Bank may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the Bank must cause it to be served on the designated operator or other person.Contents of notice of violationThe notice of violation must name the designated operator or other person, identify the alleged violation and set outthe penalty for the violation that the designated operator or other person is liable to pay;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation or the proposed penalty, or both, and the manner for doing so; andthe fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.Correction or cancellation of notice of violationAt any time before the designated operator or other person makes representations in respect of a notice of violation to the Governor or enters into a compliance agreement with the Bank, the Bank may cancel the notice of violation or correct an error in it.PenaltyThe penalty for a violation is to be determined by taking into accountthe designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;the nature and scope of the violation;whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;whether the designated operator or other person derived any competitive or economic benefit from the violation;any other factor prescribed by the regulations; andany other factors that the Bank considers relevant.PaymentIf the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.AlternativesInstead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,make representations to the Governor in respect of the alleged violation or of the penalty; orif the Bank offers a compliance agreement, enter into the compliance agreement with the Bank to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.Representation to GovernorThe Governor must decide, on a balance of probabilities, after considering any representations made under paragraph 112(2)(a), whether the designated operator or other person committed the violation and, if the Governor so decides, the Governor may, subject to the regulations made under paragraph 135(1)(h), impose the penalty set out in the notice, a lesser penalty or no penalty.DecisionThe Governor must render a decision in writing, including reasons for it and the Bank must serve a copy of the decision on the designated operator or other person.Responsibility to pay penaltyIf the Governor decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.Effect of paymentIf the designated operator or other person pays the penalty set out in the decision, the Bank must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.Violation not committed — effectIf the Governor decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.Compliance AgreementsEntering into compliance agreementsIf the Bank offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Bank considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.RepresentationsIf a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 112(2)(a).DeemingA designated operator or other person that enters into a compliance agreement with the Bank is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the Bank is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Bank must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.Notice of defaultIf the Bank is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Bank must cause the designated operator or other person to be served with a notice of default informing them thatthey are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; andthe Bank may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.Effect of paymentIf a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Bank must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.Canadian Nuclear Safety CommissionGeneral ProvisionsDesignationThe Canadian Nuclear Safety Commission may designate persons or classes of persons who are authorized to issue notices of violation and to enter into a compliance agreement with a designated operator.Notice of violation — designated personIf a person designated under section 115 has reasonable grounds to believe that a designated operator or other person has committed a violation, the person so designated may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the person so designated must cause it to be served on the designated operator or other person.Contents of notice of violationThe notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set outthe penalty for the violation that the designated operator or other person is liable to pay;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 115 specifies, to pay the penalty or to make representations to the Canadian Nuclear Safety Commission with respect to the violation or the proposed penalty, or both, and the manner for doing so; andthe fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.Correction or cancellation of notice of violationAt any time before the designated operator or other person makes representations in respect of a notice of violation to the Canadian Nuclear Safety Commission or enters into a compliance agreement with the person designated under section 115, the person so designated may cancel the notice of violation or correct an error in it.PenaltyThe penalty for a violation is to be determined by taking into accountthe designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;the nature and scope of the violation;whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;whether the designated operator or other person derived any competitive or economic benefit from the violation;any other factor prescribed by the regulations; andany other factors that the person designated under section 115 who issued the notice of violation considers relevant.PaymentIf the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.AlternativesInstead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,make representations to the Canadian Nuclear Safety Commission in respect of the alleged violation or of the penalty; orif the person designated under section 115 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.RepresentationThe Canadian Nuclear Safety Commission must decide, on a balance of probabilities, after considering any representations made under paragraph 118(2)(a), whether the designated operator or other person committed the violation and, if it so decides, it may, subject to the regulations made under paragraph 135(1)(h), impose the penalty set out in the notice, a lesser penalty or no penalty.DecisionThe Canadian Nuclear Safety Commission must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.Responsibility to pay penaltyIf the Canadian Nuclear Safety Commission decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.Effect of paymentIf the designated operator or other person pays the penalty set out in the decision, the Canadian Nuclear Safety Commission must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.Violation not committed — effectIf the Canadian Nuclear Safety Commission decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.Compliance AgreementsEntering into compliance agreementsIf the person designated under section 115 offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the person so designated considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.RepresentationsIf a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 118(2)(a).DeemingA designated operator or other person that enters into a compliance agreement with the person designated under section 115 is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the person designated under section 115 is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the person so designated must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.Notice of defaultIf the person designated under section 115 is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the person so designated must cause the designated operator or other person to be served with a notice of default informing them thatthey are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; andthe Canadian Nuclear Safety Commission may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.Effect of paymentIf a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Canadian Nuclear Safety Commission must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.Canadian Energy RegulatorGeneral ProvisionsDesignationThe Chief Executive Officer may designate persons or classes of persons who are authorized to issue notices of violation and to enter into a compliance agreement with a designated operator.Notice of violation — designated personIf a person designated under section 121 has reasonable grounds to believe that a designated operator or other person has committed a violation, the person so designated may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the person so designated must cause it to be served on the designated operator or other person.Contents of notice of violationThe notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set outthe penalty for the violation that the designated operator or other person is liable to pay;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 121 specifies, to pay the penalty or to make representations to the Commission with respect to the violation or the proposed penalty, or both, and the manner for doing so; andthe fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.Correction or cancellation of notice of violationAt any time before the designated operator or other person makes representations in respect of a notice of violation to the Commission or enters into a compliance agreement with the person designated under section 121, the person so designated may cancel the notice of violation or correct an error in it.PenaltyThe penalty for a violation is to be determined by taking into accountthe designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;the nature and scope of the violation;whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;whether the designated operator or other person derived any competitive or economic benefit from the violation;any other factor prescribed by the regulations; andany other factors that the person designated under section 121 who issued the notice of violation considers relevant.PaymentIf the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.AlternativesInstead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,make representations to the Commission in respect of the alleged violation or of the penalty; orif the person designated under section 121 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.Powers of CommissionThe Commission may designate persons or classes of persons to consider the representations made under paragraph 124(2)(a).Representation to CommissionThe Commission or the person designated under subsection (1) must decide, on a balance of probabilities, after considering any representations made under paragraph 124(2)(a), whether the designated operator or other person committed the violation and, if it so decides, it may, subject to the regulations made under paragraph 135(1)(h), impose the penalty set out in the notice, a lesser penalty or no penalty.DecisionThe Commission or the person designated under subsection (1) must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.Responsibility to pay penaltyIf the Commission or the person designated under subsection (1) decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.Effect of paymentIf the designated operator or other person pays the penalty set out in the decision, the Commission or the person designated under subsection (1) must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.Violation not committed — effectIf the Commission or the person designated under subsection (1) decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.Federal CourtDespite section 28 of the Federal Courts Act, the Federal Court has exclusive original jurisdiction to hear and determine an application for judicial review of a decision made under this section by the Commission or the person designated under subsection (1).Compliance AgreementsEntering into compliance agreementsIf the person designated under section 121 offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the person so designated considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.RepresentationsIf a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 124(2)(a).DeemingA designated operator or other person that enters into a compliance agreement with the person designated under section 121 is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the person designated under section 121 is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the person so designated must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.Notice of defaultIf the person designated under section 121 is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the person designated under section 121 must cause the designated operator or other person to be served with a notice of default informing them thatthey are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; andthe Canadian Energy Regulator may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.Effect of paymentIf a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Canadian Energy Regulator must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.Minister of TransportGeneral ProvisionsNotice of violation — Minister of TransportIf the Minister of Transport has reasonable grounds to believe that a designated operator or other person has committed a violation, the Minister of Transport may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the Minister of Transport must cause it to be served on the designated operator or other person.Contents of notice of violationThe notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set outthe penalty for the violation that the designated operator or other person is liable to pay;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Minister of Transport specifies, to pay the penalty and the manner for doing so;the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Tribunal on application may allow, to file a request to review under paragraph 129(2)(a) with respect to the violation or the proposed penalty, or both; andthe fact that, if the designated operator or other person does not pay the penalty or file a request to review with the Tribunal in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.Correction or cancellation of notice of violationAt any time before the designated operator or other person files a request to review with the Tribunal under paragraph 129(2)(a) or enters into a compliance agreement with the Minister of Transport, the notice of violation may be canceled by the Minister of Transport or an error in it may be corrected.PenaltyThe penalty for a violation is to be determined by taking into accountthe designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;the nature and scope of the violation;whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;whether the designated operator or other person derived any competitive or economic benefit from the violation;any other factor prescribed by the regulations; andany other factors that the Minister of Transport considers relevant.PaymentIf the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.AlternativesInstead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,file a request for a review with the Tribunal in respect of the alleged violation or of the penalty; orif the Minister of Transport offers a compliance agreement, enter into the compliance agreement with the Minister of Transport to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.Time and place of reviewOn receipt of the request referred to in paragraph 129(2)(a), the Tribunal must appoint a time and place for the review and notify the Minister of Transport and the designated operator or other person who filed the request of the time and place in writing.Review procedureThe member of the Tribunal who is assigned to conduct the review must provide the Minister of Transport and the designated operator or other person that filed the request with an opportunity that is consistent with procedural fairness and natural justice to present evidence and make representations.Burden of proofThe Minister of Transport has the burden of establishing on a balance of probabilities that the designated operator or other person committed a violation.Designated operator or other person not compelled to testifyA designated operator or other person that is alleged to have committed a violation is not required to give any evidence or testimony in the matter.Disclosure of confidential informationFor the purpose of a review requested under paragraph 129(2)(a), the Minister of Transport or the designated operator or other person may disclose confidential information to the Tribunal.Determination by Tribunal memberIn making a determination at the conclusion of a review, the member of the Tribunal who conducts the review must, without delay, inform the Minister of Transport and the designated operator or other personthat the designated operator or other person has not committed a violation, in which case no further proceedings under this Act are to be taken against the designated operator or other person in respect of the alleged violation; orthat the designated operator or other person has committed a violation, in which case the member must also inform the Minister of Transport and the designated operator or other person of the amount determined by the member, subject to section 128 and the regulations made under paragraph 135(1)(h), to be payable to the Tribunal by or on behalf of the designated operator or other person and the period within which it must be paid.Right of appealWithin 30 days after a determination is made under section 131, the Minister of Transport or designated operator or other person affected by the determination may appeal the determination to the Tribunal.Loss of right of appealA party who does not appear at a review hearing is not entitled to appeal the determination, unless the party establishes that there was sufficient reason to justify their absence.Disposition of appealThe appeal panel of the Tribunal that is assigned to hear an appeal may dismiss it or allow it and, in allowing the appeal, may substitute its decision for the determination.Finding of violationIf the appeal panel finds that a designated operator or other person has committed a violation, the panel must immediately inform the designated operator or other person, as the case may be, and the Minister of Transport of the finding and, subject to any regulations made under paragraph 135(1)(h), of the amount determined by the panel to be payable to the Tribunal by or on behalf of the designated operator or other person, as the case may be, in respect of the violation and the time within which it must be paid.Finding of no violationIf the appeal panel finds that a designated operator or other person has not committed a violation, the panel must immediately inform the designated operator or other person, as the case may be, and the Minister of Transport of the finding.CertificateThe Minister of Transport may obtain from the Tribunal or the member, as the case may be, a certificate in the form established by the Governor in Council setting out the penalty required to be paid by the designated operator or other person that fails, within the time required,to pay the penalty set out in the notice of violation or to file a request for a review under paragraph 129(2)(a); orto pay the amount determined under paragraph 131(b).Compliance AgreementsEntering into compliance agreementsIf the Minister of Transport offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Minister of Transport considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.Filing requestIf a compliance agreement is entered into, the designated operator or other person cannot file a request for a review under paragraph 129(2)(a).DeemingA designated operator or other person that enters into a compliance agreement with the Minister of Transport is deemed to have committed the violation in respect of which the compliance agreement was entered into.Notice of complianceIf the Minister of Transport is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Minister of Transport must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.Notice of defaultIf the Minister of Transport is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Minister of Transport must cause the designated operator to be served with a notice of default informing them thatthey are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; andthe Minister of Transport may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.Effect of paymentIf a designated operator or other person pays the penalty set out in the notice of default within the time and in the manner set out in that notice, the Minister of Transport must accept the amount as complete satisfaction of the penalty owing in respect of the violation and the proceedings commenced in respect of the violation are ended.RegulationsRegulationsThe Governor in Council may make regulations for carrying out the purposes and provisions of this Act, including regulationsrespecting cyber security programs;respecting any condition and criteria respecting internal audits;respecting the form, manner and period for reporting any cyber security incidents referred to in section 17 and the types of incidents that must be reported;respecting the period within which a notification referred to under subsection 14(1) is to be provided;respecting the management of records referred to in section 30, including the collection, use, retention, disclosure and disposal of those records;designating any provision of this Act or of the regulations made under this Act for the purposes of section 90;classifying each violation as a minor violation, a serious violation or a very serious violation;fixing the maximum penalty in respect of each violation;defining, for the purposes of this Act, any word or expression that is used in this Act but is not defined; andprescribing anything that is to be prescribed under this Act.Consistency with regulatory regimesIn making regulations under subsection (1), the Governor in Council may seek to ensure consistency with existing regulatory regimes, such as those established by provincial regulatory agencies.OffencesSummary offencesEvery person who contravenes section 10, subsection 13(1) or 14(1), section 17 or 18, subsection 30(1) or (2) or 32(4), section 35, subsection 37(1) or 41(4), section 44, subsection 46(1) or 50(4), section 53, subsection 55(1) or 59(4), section 62, subsection 64(1) or 68(4), section 71, subsection 74(1) or 78(4), section 81 or subsection 83(1) is guilty of an offence punishable on summary conviction.Offence and punishment — section 29Every person, partnership or unincorporated organization that contravenes section 29 is guilty of an offence punishable on summary conviction.Offence and punishmentEvery person who contravenes subsection 9(1), section 12 or 15, subsection 20(4), section 24, subsection 25(2), section 26 or 86 or paragraph 87(a) or (b) is guilty of an offence and liableon summary convictionin the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than two years less a day, or to both, andin the case of a corporation, to a fine in an amount that is in the discretion of the court; oron conviction on indictmentin the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than five years, or to both, andin the case of a corporation, to a fine in an amount that is in the discretion of the court.Liability of directors or officersIf a designated operator commits an offence under this Act, any director or officer of the designated operator that directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to the offence and is liable on conviction to the punishment provided for by this Act, even if the designated operator is not prosecuted for or convicted of the offence.Continuing offenceIf an offence under section 136 or 137 is committed or continued on more than one day, it constitutes a separate offence for each day on which the offence is committed or continued.Limitation period or prescriptionA prosecution must not be commenced in respect of an offence under this Act later than three years after the day on which the subject matter of the prosecution arose.Due diligence defenceA person, partnership or unincorporated organization is not to be found guilty of an offence under this Act — other than an offence under section 137 that is in respect of a contravention of section 26 or paragraph 87(a) or (b) — if they establish that they exercised all due diligence to prevent the commission of the offence.Offence by employee or agent or mandataryIn a prosecution under this Act, it is sufficient proof of an offence to establish that it was committed by an employee or agent or mandatary of the accused whether or not the employee or agent or mandatary is identified or has been prosecuted for the offence.Proof of documentsIn any action or proceeding under this Act, any document purporting to be certified by a regulator as a true copy of a document made, given or issued under this Act is, without proof of the signature or of the official character of the person appearing to have signed the document,evidence of the original document of which it purports to be a copy;evidence of the fact that the original document was made, given or issued by or by the authority of or deposited with the person named in it and was made, given or issued at the time stated in the certified copy, if a time is stated in it; andevidence of the fact that the original document was signed, certified, attested or executed by the persons and in the manner shown in the certified copy.Document entries as proofIn any action or proceeding under this Act, an entry in any record required under this Act to be kept is, in the absence of evidence to the contrary, proof of the matters stated in it as against the person who made the entry or the designated operator that was required to keep the record.Judicial review — rulesThe following rules apply to judicial review proceedings in respect of the issuance of a cyber security direction under section 20:if the judge determines that evidence or other information provided by the Minister is not relevant or if the Minister withdraws the evidence or other information, the decision of the judge must not be based on that evidence or other information and the judge must return it to the Minister; andthe judge must ensure the confidentiality of all evidence and other information that the Minister withdraws.Definition of judgeIn this section, judge means the Chief Justice of the Federal Court or a judge of that Court designated by the Chief Justice.Protection of information on appealSection 145 applies to any appeal of a decision made by the judge in relation to the judicial review proceedings referred to in that section and to any further appeal, with any necessary modifications.GeneralReport to ParliamentThe Minister must, within three months after the end of each fiscal year, prepare a report on the administration of this Act for that fiscal year and cause a copy of the report to be laid before each House of Parliament on any of the first 15 sitting days of that House after the report is completed.ContentsThe report must include, for the fiscal year covered by the report, the following information in relation to orders made under subsection 20(1):the number of orders made under subsection 20(1) and the nature of the directions set out in those orders;the number of directions revoked under subsection 20(2);the number of designated operators that were subject to a direction;description of compliance of designated operators that partially complied with a direction;description of compliance of designated operators that fully complied with a direction; andan explanation of the necessity, proportionality, reasonableness and utility of the directions.ContentsThe report must contain information on, among other things,the number of directions issued under subsection 20(1) in the immediately preceding fiscal year;the number of designated operators that were issued directions under subsection 20(1) in the immediately preceding fiscal year; andany other information relating to the immediately preceding fiscal year that the Minister considers relevant, if that information is not likely to be about an identifiable designated operator or other person.Consequential AmendmentsR.S., c. 18 (3rd Supp.), Part IOffice of the Superintendent of Financial Institutions Act2011, c. 15, s. 25Subsection 23(1) of the Office of the Superintendent of Financial Institutions Act is replaced by the following:Superintendent to ascertain expensesThe Superintendent shall, before December 31 in each year, ascertain the total amount of expenses incurred during the immediately preceding fiscal year for or in connection with the administration of the Bank Act, the Cooperative Credit Associations Act, the Critical Cyber Systems Protection Act, the Green Shield Canada Act, the Insurance Companies Act, the Protection of Residential Mortgage or Hypothecary Insurance Act and the Trust and Loan Companies Act.Office of the Superintendent of Financial Institutions ActExisting text of subsection 23(1):The Superintendent shall, before December 31 in each year, ascertain the total amount of expenses incurred during the immediately preceding fiscal year for or in connection with the administration of the Bank Act, the Cooperative Credit Associations Act, the Green Shield Canada Act, the Insurance Companies Act, the Protection of Residential Mortgage or Hypothecary Insurance Act and the Trust and Loan Companies Act.The schedule to the Act is amended by adding the following in alphabetical order:Critical Cyber Systems Protection ActLoi sur la protection des cybersystèmes essentiels1997, c. 9Nuclear Safety and Control Act2013, c. 33, s. 173Subsections 21(2) and (3) of the Nuclear Safety and Control Act are replaced by the following:Fees recoverable under any other Act of ParliamentThe Commission may charge any fees that may be prescribed for any information, product or service that it provides under any other Act of Parliament.Refund of feesThe Commission may, under the prescribed circumstances, refund all or part of any fee referred to in paragraph (1)(g) or subsection (1.1).Expenditure of revenue from feesThe Commission may spend for its purposes the revenue from the fees it charges in the fiscal year in which the revenues are received or in the next fiscal year.Nuclear Safety and Control ActExisting text of subsections 21(2) and (3):The Commission may, under the prescribed circumstances, refund all or part of any fee referred to in paragraph (1)(g).The Commission may spend for its purposes the revenue from the fees it charges for licences or classes of licences issued under section 24 in the fiscal year in which the revenues are received or in the next fiscal year.2001, c. 29Transportation Appeal Tribunal of Canada Act2019, c. 29, s. 290Subsection 2(3) of the Transportation Appeal Tribunal of Canada Act is replaced by the following:Jurisdiction in respect of other ActsThe Tribunal also has jurisdiction in respect of reviews and appeals in connection with administrative monetary penalties provided for under sections 177 to 181 of the Canada Transportation Act, sections 127 to 133 of the Critical Cyber Systems Protection Act, sections 43 to 55 of the International Bridges and Tunnels Act, sections 129.01 to 129.19 of the Canada Marine Act, sections 16.1 to 16.25 of the Motor Vehicle Safety Act, sections 39.1 to 39.26 of the Canadian Navigable Waters Act and sections 130.01 to 130.19 of the Marine Liability Act.Transportation Appeal Tribunal of Canada ActExisting text of subsection 2(3):The Tribunal also has jurisdiction in respect of reviews and appeals in connection with administrative monetary penalties provided for under sections 177 to 181 of the Canada Transportation Act, sections 43 to 55 of the International Bridges and Tunnels Act, sections 129.01 to 129.19 of the Canada Marine Act, sections 16.1 to 16.25 of the Motor Vehicle Safety Act, sections 39.1 to 39.26 of the Canadian Navigable Waters Act and sections 130.01 to 130.19 of the Marine Liability Act.Coming into ForceOrder in councilThe provisions of this Part come into force on a day or days to be fixed by order of the Governor in Council.(Section 11)(Sections 2 and 6)Vital Services and Vital Systems
ItemVital Services and Vital Systems1Telecommunications services2Interprovincial or international pipeline and power line systems3Nuclear energy systems4Transportation systems that are within the legislative authority of Parliament5Banking systems6Clearing and settlement systems
(Sections 2 and 7, subsection 9(1) and section 10)Classes of Operators and Corresponding Regulators