MINISTER OF PUBLIC SAFETY

This Part also makes consequential amendments to certain Acts.

TABLE OF PROVISIONS

5 A judge of the Federal Court, for the purposes of section 15.‍9 of the Telecommunications Act

An Act respecting the protection of critical cyber systems in the federally regulated private sector

Short Title

1 This Act may be cited as the Critical Cyber Systems Protection Act.

Definitions

2 The following definitions apply in this Act.

appropriate regulator means, in respect of a designated operator, the regulator set out in column 2 of Schedule 2 that corresponds to the class of operators to which the designated operator belongs. (organisme réglementaire compétent)

Bank means the Bank of Canada established by subsection 3(1) of the Bank of Canada Act. (Banque)

Canadian Energy Regulator means the Canadian Energy Regulator established by subsection 10(1) of the Canadian Energy Regulator Act. (Régie canadienne de l’énergie)

Canadian Nuclear Safety Commission means the Commission established by subsection 8(1) of the Nuclear Safety and Control Act. (Commission canadienne de sûreté nucléaire).

Chief Executive Officer has the same meaning as in section 2 of the Canadian Energy Regulator Act. (président-directeur général)

Commission means the Commission referred to in subsection 26(1) of the Canadian Energy Regulator Act. (Commission)

confidential information means any information obtained under this Act in respect of a critical cyber system that

• (a) concerns a vulnerability of any designated operator’s critical cyber system or the methods used to protect that system and that is consistently treated as confidential by the designated operator;

• (b) if disclosed could reasonably be expected to result in material financial loss or gain to, or could reasonably be expected to prejudice the competitive position of, a designated operator; or

• (c) if disclosed could reasonably be expected to interfere with contractual or other negotiations of a designated operator. (renseignements confidentiels)

critical cyber system means a cyber system that, if its confidentiality, integrity or availability were compromised, could affect the continuity or security of a vital service or vital system. (cybersystème essentiel)

cyber security incident, in respect of a critical cyber system, means an incident, including an act, omission or circumstance, that interferes or may interfere with

• (a) the continuity or security of a vital service or vital system; or

• (b) the confidentiality, integrity or availability of the critical cyber system. (incident de cybersécurité)

cyber system means a system of interdependent digital services, technologies, assets or facilities that form the infrastructure for the reception, transmission, processing or storing of information. (cybersystème)

designated operator means a person, partnership or unincorporated organization that belongs to any class of operators referred to in Schedule 2. (exploitant désigné)

Governor has the same meaning as in section 2 of the Bank of Canada Act. (gouverneur)

Minister means the Minister of Public Safety and Emergency Preparedness or, if another federal minister is designated under section 4, that minister. (ministre)

regulator means

• (a) the Minister of Industry;

• (b) the Minister of Transport;

• (c) the Superintendent;

• (d) the Bank;

• (e) the Canadian Energy Regulator; or

• (f) the Canadian Nuclear Safety Commission. (organisme réglementaire)

responsible minister means the minister responsible for an Act that is ordinarily administered by an appropriate regulator with respect to any class of operators set out in Schedule 2. (ministre compétent)

Superintendent means the Superintendent of Financial Institutions appointed under subsection 5(1) of the Office of the Superintendent of Financial Institutions Act. (surintendant)

Tribunal means the Transportation Appeal Tribunal of Canada that is established under subsection 2(1) of the Transportation Appeal Tribunal of Canada Act. (Tribunal)

vital service means a service that is referred to in Schedule 1. (service critique)

vital system means a system that is referred to in Schedule 1. (système critique)

Application

3 This Act is binding on Her Majesty in right of Canada.

4 The Governor in Council may, by order, designate any federal minister to be the Minister referred to in this Act.

Purpose

5 The purpose of this Act is to help to protect critical cyber systems in order to support the continuity and security of vital services and vital systems by ensuring that, among other things,

• (a) any cyber security risks in respect of critical cyber systems are identified and managed, including risks associated with supply chains and the use of third-party products and services;

• (b) critical cyber systems are protected from being compromised;

• (c) any cyber security incidents affecting, or having the potential to affect, critical cyber systems are detected; and

• (d) the impacts of cyber security incidents affecting critical cyber systems are minimized.

Vital Services and Vital Systems

6 (1) The Governor in Council may, by order, add to Schedule 1 a service that is delivered, or a system that is operated, as part of a work, undertaking or business that is within the legislative authority of Parliament, if the Governor in Council is satisfied that the service or system is vital to national security or public safety.

(2) The Governor in Council may, by order, amend or delete any service or system set out in Schedule 1.

Designated Operators of Critical Cyber Systems

7 The Governor in Council may, by order, amend Schedule 2 by

• (a) adding

  • (i) a class of operators — consisting of persons, partnerships or unincorporated organizations that operate a work or carry on an undertaking or business that is within the legislative authority of Parliament — in respect of a vital service or vital system, and

  • (ii) the regulator for that class; or

• (b) amending or deleting a class of operators or the regulator for that class.

8 A designated operator that owns, controls or operates a critical cyber system must comply with the requirements of this Act and the regulations with respect to that critical cyber system.

Cyber Security Program

9 (1) After an order that is made under section 7 is published in the Canada Gazette, Part II, a designated operator that belongs to a class of operators set out in Schedule 2 must, within 90 days after the day on which the designated operator becomes a member of that class, establish a cyber security program in respect of its critical cyber systems and include in the program reasonable steps to, in accordance with any regulations,

• (a) identify and manage any organizational cyber security risks, including risks associated with the designated operator’s supply chain and its use of third-party products and services;

• (b) protect its critical cyber systems from being compromised;

• (c) detect any cyber security incidents affecting, or having the potential to affect, its critical cyber systems;

• (d) minimize the impact of cyber security incidents affecting critical cyber systems; and

• (e) do anything that is prescribed by the regulations.

(2) Immediately after the program has been established, the designated operator must notify the appropriate regulator in writing that the program has been established.

10 The designated operator referred to in subsection 9(1) must, within 90 days after the day on which the designated operator becomes a member of a class of operators that is set out in Schedule 2, provide the cyber security program or make it available to the appropriate regulator in the manner prescribed by the regulations or, if no manner is so prescribed, in the manner that the appropriate regulator considers appropriate.

11 The appropriate regulator may, at the designated operator’s written request, extend the 90-day period for complying with either subsection 9(1) or section 10, or both. The 90-day period may be extended more than once at the discretion of the appropriate regulator.

12 After a cyber security program is established, the designated operator must implement that program by taking the reasonable steps that are included in the program under section 9 and maintain the program.

13 (1) A designated operator must commence a review of its cyber security program on each date that is prescribed by the regulations or, if no dates are prescribed, on every anniversary of the day on which its cyber security program was established under section 9.

(2) The designated operator must complete the review within 60 days after the day on which the review was commenced under subsection (1), unless another period is prescribed by the regulations, and amend the program as a result of the review if needed.

(3) The designated operator must, within 30 days after the day on which the review is completed, unless another period is prescribed by the regulations, notify the appropriate regulator of whether or not any changes were made to the program after the previous review.

14 (1) A designated operator must, without delay, notify the appropriate regulator of

• (a) any material change in the designated operator’s ownership or control;

• (b) any material change in the designated operator’s supply chain or in its use of third-party products and services; and

• (c) any circumstances that are prescribed by the regulations.

(2) The designated operator must, within 90 days after the day on which a notification was provided under subsection (1), also notify the appropriate regulator whether or not any changes were made to the program as a result of any material changes or any circumstances described in paragraph (1)‍(a), (b) or (c) and, if changes were made, the nature of those changes.

(3) The appropriate regulator may, at the designated operator’s written request, extend the 90-day period for complying with subsection (2). The 90-day period may be extended more than once at the discretion of the appropriate regulator.

Mitigation of Supply-chain and Third-party Risks

15 As soon as any cyber security risk associated with the designated operator’s supply chain or its use of third-party products and services has been identified under paragraph 9(1)‍(a), the designated operator must take reasonable steps, including any steps that are prescribed by the regulations, to mitigate those risks.

16 An appropriate regulator may provide to the Communications Security Establishment any information, including any confidential information, respecting a designated operator’s cyber security program or any steps taken under section 15, for the purpose of requesting advice, guidance or services from the Communications Security Establishment in accordance with the mandate of the Communications Security Establishment, in respect of the exercise of the appropriate regulator’s powers or the performance of its duties and functions under this Act.

Reporting of Cyber Security Incidents

17 A designated operator must immediately report a cyber security incident in respect of any of its critical cyber systems to the Communications Security Establishment in accordance with the regulations, for the purpose of enabling the Communications Security Establishment to exercise its powers or perform its duties and functions.

18 Immediately after reporting a cyber security incident, the designated operator must

• (a) notify the appropriate regulator, in the form and manner prescribed by the regulations that the report was made; and

• (b) on request, give a copy of the report to the appropriate regulator.

19 The Communications Security Establishment must, without delay, at the request of a regulator, give that regulator a copy of any incident report or any portion of it that relates to a designated operator in respect of which that regulator is the appropriate regulator, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

Cyber Security Directions

20 (1) The Governor in Council may, by order, direct any designated operator or class of operators to comply with any measure set out in the direction for the purpose of protecting a critical cyber system.

(2) The Governor in Council may, by order, amend or revoke a direction in whole or in part.

(3) Every designated operator that is subject to a direction must comply with it.

21 (1) A direction made under section 20 must set out

• (a) the name of the designated operator or the class of operators in respect of which the direction applies;

• (b) the measures to be taken by the designated operator along with any conditions; and

• (c) the period within which those measures are to be taken.

(2) In addition to any conditions referred to in paragraph (1)‍(b), the Governor in Council may impose other conditions in a direction.

22 (1) An order made under section 20 is exempt from the application of sections 3, 5 and 11 of the Statutory Instruments Act.

(2) A designated operator must not be found to have contravened a direction made under section 20 unless it is proved that, at the time of the alleged contravention, the designated operator had been notified of the direction or reasonable steps had been taken to bring the purport of the notice to those designated operators likely to be affected by it.

(3) A certificate purporting to be signed by the Minister or responsible minister and stating that a notice containing the order was given to designated operators likely to be affected by it is, in the absence of evidence to the contrary, proof that notice was given to those designated operators.

23 To the extent necessary, for any purpose related to the making, amending or revoking of a cyber security direction in respect of a designated operator, the following persons or entities may collect information from and disclose information, including confidential information, to each other:

• (a) the Minister;

• (b) the responsible minister;

• (c) the appropriate regulator;

• (d) the Minister of Foreign Affairs;

• (e) the Minister of National Defence;

• (f) the Chief of the Defence Staff;

• (g) the Chief or an employee of the Communications Security Establishment;

• (h) the Director or an employee of the Canadian Security Intelligence Service; and

• (i) any other person or entity that is prescribed by the regulations.

24 Every designated operator that is subject to a cyber security direction is prohibited from disclosing, or allowing to be disclosed, the fact that a cyber security direction was issued and the content of that direction, except in accordance with section 25.

25 (1) A designated operator that is subject to a cyber security direction may disclose the fact that the direction was issued and its content only to the extent necessary to comply with the direction.

(2) A person must not, without the authorization of the designated operator, disclose or allow the disclosure of any information obtained by them under subsection (1).

Disclosure and Use of Information

26 (1) Subject to subsection (2), a person must not knowingly disclose confidential information or allow it to be disclosed to any agency, body or other person or allow any other agency, body or other person to have access to the information, except if

• (a) the disclosure is required by law;

• (b) the information to be disclosed is publicly available;

• (c) the designated operator to which the information relates consents to its disclosure;

• (d) the disclosure is necessary for any purpose related to the protection of vital services, vital systems or critical cyber systems;

• (e) the disclosure is made in accordance with any provision of this Act; or

• (f) the disclosure is made in accordance with the Security of Canada Information Disclosure Act.

(2) Nothing in this section precludes a person from disclosing confidential information to a law enforcement agency or the Canadian Security Intelligence Service if the disclosure of the information is otherwise lawful.

27 (1) Subject to subsection (2), the Minister, a responsible minister or a regulator may enter into an agreement or arrangement, in writing, with the government of a province or of a foreign state, or with an international organization established by the governments of foreign states, for the exchange of information, other than confidential information, relating to the protection of critical cyber systems

• (a) between the Minister, the responsible minister or the regulator, as the case may be, and any institution or agency of that government; or

• (b) between the Minister, the responsible minister or the regulator, as the case may be, and the international organization.

(2) Confidential information may be disclosed to any institution or agency of the government of the province only if

• (a) it is disclosed under the agreement or arrangement; and

• (b) the Minister, the responsible minister or the regulator, as the case may be, is satisfied that the information will be treated in a confidential manner and not be further disclosed without their express consent.

28 For any purpose related to this Act, the appropriate regulator for a class of operators may provide the Minister or the responsible minister with any information, including any confidential information, that is related to the exercise of the appropriate regulator’s powers or the performance of its duties and functions under this Act or the regulations. However, if the Minister or the responsible minister makes a request for the information, the appropriate regulator must provide the information so requested.

29 For the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, a regulator may request that a person, partnership or unincorporated organization provide it with any information, and the person, partnership or unincorporated organization, as the case may be, must provide the requested information within the time and in the manner set out in the request.

Record Keeping

30 (1) Every designated operator must keep records respecting

• (a) any steps taken to implement the designated operator’s cyber security program;

• (b) every cyber security incident that the designated operator reported under section 17;

• (c) any steps taken by the designated operator under section 15 to mitigate any supply-chain or third-party risks;

• (d) any measures taken by the designated operator to implement a cyber security direction; and

• (e) any matter prescribed by the regulations.

(2) The records must be kept in Canada by the designated operator at any place that is prescribed by the regulations — or, if no place is prescribed, at the designated operator’s place of business — and in the manner and for the period determined by the appropriate regulator unless another manner or period is prescribed by the regulations.

Administration and Enforcement

31 (1) A person who exercises powers or performs duties or functions under this Act is not liable in respect of anything done or omitted to be done in good faith in the exercise of those powers or the performance of those duties or functions.

(2) A person referred to in subsection 32(5), 41(5), 50(5), 59(5), 68(5) or 78(5) is not liable for anything done or omitted to be done in good faith while helping any other person in the exercise of their powers or the performance of their duties and functions under this Act.

32 (1) Subject to section 33, the Superintendent may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which the Superintendent has reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

(2) For the purpose referred to in subsection (1), the Superintendent may

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

(3) If the Superintendent removes any document, record or cyber system under paragraph (2)‍(f), the Superintendent must return it to its owner or the person in charge of it, on completion of the examination or copying.

(4) Every owner or person in charge of a place that is entered by the Superintendent and every person found in the place must give the Superintendent all reasonable assistance to enable the Superintendent to exercise the Superintendent’s powers or perform the Superintendent’s duties and functions under this Act and provide the Superintendent with any document or information, or access to any data, that the Superintendent may reasonably require.

(5) The Superintendent may be accompanied by any other person that the Superintendent believes is necessary to help the Superintendent exercise the Superintendent’s powers or perform the Superintendent’s duties and functions under this section.

(6) The Superintendent and any person accompanying the Superintendent may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

33 (1) In the case of a dwelling-house, the Superintendent is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

(2) A justice of the peace may, on ex parte application, issue a warrant authorizing the Superintendent to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

• (a) the dwelling-house is a place referred to in subsection 32(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 32(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

(3) In executing the warrant, the Superintendent is not entitled to use force unless the use of force has been specifically authorized in the warrant and the Superintendent is accompanied by a peace officer.

34 (1) Subject to any regulations, the Superintendent may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

(2) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

35 The designated operator must comply with the order and provide to the Superintendent, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

36 (1) If the Superintendent believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the Superintendent may order a designated operator to

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

(2) The order must specify the time within which and the manner in which the designated operator may request a review of the order by the Superintendent.

(3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

37 (1) A designated operator that is subject to an order made under section 36 must comply with it.

(2) Once the designated operator complies with the order, it must notify the Superintendent, without delay, of its compliance.

38 (1) An order that is made under section 36 must be reviewed by the Superintendent at the written request of the designated operator that is subject to the order.

(2) The request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.

(3) The order continues to apply during a review unless the Superintendent decides otherwise.

39 (1) On completion of a review, the Superintendent must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

(2) If the Superintendent does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Superintendent and the designated operator, the Superintendent is deemed to have confirmed the order.

40 (1) The Minister of Industry may designate persons or classes of persons as inspectors for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

(2) Each inspector must be provided with a certificate of designation in a form established by the Minister of Industry and, when entering any place under subsection 41(1), must, on request, produce the certificate to the person in charge of the place.

41 (1) Subject to subsection 42(1), the inspector may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

(2) For the purpose referred to in subsection (1), the inspector may

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

(3) If the inspector removes any document, record or cyber system referred to in paragraph (2)‍(f), the inspector must return it to its owner or the person in charge of it, on completion of the examination or copying.

(4) Every owner or person in charge of a place that is entered by the inspector and every person found in the place must give the inspector all reasonable assistance to enable the inspector to exercise the inspector’s powers or perform the inspector’s duties and functions under this Act and provide that inspector with any document or information, or access to any data, that the inspector may reasonably require.

(5) The inspector may be accompanied by any other person that the inspector believes is necessary to help the inspector exercise the inspector’s powers or perform the inspector’s duties and functions under this section.

(6) The inspector and any person accompanying the inspector may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

42 (1) In the case of a dwelling-house, the inspector is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

(2) A justice of the peace may, on ex parte application, issue a warrant authorizing the inspector named in it to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

• (a) the dwelling-house is a place referred to in subsection 41(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 41(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

(3) In executing the warrant, the inspector is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.

43 (1) Subject to any regulations, the Minister of Industry or a person designated by that Minister may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

(2) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

44 The designated operator must comply with the order and provide to the Minister of Industry or the person designated by that Minister, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

45 (1) If the Minister of Industry or a person designated by that Minister believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, they may order a designated operator to

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

(2) The order must specify the time within which and the manner in which the designated operator may request a review of the order by the Minister of Industry.

(3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

46 (1) A designated operator that is subject to an order made under section 45 must comply with it.

(2) Once the designated operator complies with the order, it must notify the Minister of Industry or the person designated by that Minister, without delay, of its compliance.

47 (1) An order that is made under section 45 must be reviewed by the Minister of Industry at the written request of the designated operator that is subject to the order.

(2) The request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.

(3) The order continues to apply during a review unless the Minister of Industry decides otherwise.

48 (1) On completion of a review, the Minister of Industry must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

(2) If the Minister of Industry does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Minister of Industry and the designated operator, the Minister of Industry is deemed to have confirmed the order.

49 (1) The Bank may designate persons or classes of persons for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

(2) Each person designated under subsection (1) must be provided with a certificate of designation in a form established by the Bank and, when entering any place under subsection 50(1), must, on request, produce the certificate to the person in charge of the place.

50 (1) Subject to section 51, the person designated under subsection 49(1) may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

(2) For the purpose referred to in subsection (1), the person designated under subsection 49(1) may

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

(3) If the person designated under subsection 49(1) removes any document, record or cyber system referred to in paragraph (2)‍(f), the person so designated must return it to its owner or the person in charge of it, on completion of the examination or copying.

(4) Every owner or person in charge of a place that is entered by the person designated under subsection 49(1) and every person found in the place must give the person designated under subsection 49(1) all reasonable assistance to enable them to exercise their powers or perform their duties and functions under this Act and provide that person designated under subsection 49(1) with any document or information, or access to any data, that they may reasonably require.

(5) The person designated under subsection 49(1) may be accompanied by any other person that they believe is necessary to help them exercise their powers or perform their duties and functions under this section.

(6) The person designated under subsection 49(1) and any person accompanying the person so designated may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

51 (1) In the case of a dwelling-house, the person designated under subsection 49(1) is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

(2) A justice of the peace may, on ex parte application, issue a warrant authorizing the person designated under subsection 49(1) and named in the warrant to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

• (a) the dwelling-house is a place referred to in subsection 50(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 50(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

(3) In executing the warrant, the person designated under subsection 49(1) is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.

52 (1) Subject to any regulations, the Bank may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

(2) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

53 The designated operator must comply with the order and provide to the Bank, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

54 (1) If a person designated by the Bank believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the person so designated may order a designated operator to

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

(2) The order must specify the time within which and manner in which the designated operator may request a review of the order by the person designated by the Bank.

(3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

55 (1) A designated operator that is subject to an order made under section 54 must comply with it.

(2) Once the designated operator complies with the order, it must notify the person designated by the Bank referred to in subsection 54(1), without delay, of its compliance.

56 (1) An order that is made under section 54 must be reviewed by the Governor at the written request of the designated operator that is subject to the order.

(2) The request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.

(3) The order continues to apply during a review unless the Governor decides otherwise.

57 (1) On completion of a review, the Governor must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

(2) If the Governor does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Governor and the designated operator, the Governor is deemed to have confirmed the order.

58 (1) The Canadian Nuclear Safety Commission may designate persons or classes of persons for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

(2) Each person designated under subsection (1) must be provided with a certificate of designation in a form established by the Canadian Nuclear Safety Commission and, when entering any place under subsection 59(1), must, on request, produce the certificate to the person in charge of the place.

59 (1) Subject to subsection 60(1), the person designated under subsection 58(1) may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

(2) For the purpose referred to in subsection (1), the person designated under subsection 58(1) may

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

(3) If the person designated under subsection 58(1) removes any document, record or cyber system referred to in paragraph (2)‍(f), the person so designated must return it to its owner or the person in charge of it, on completion of the examination or copying.

(4) Every owner or person in charge of a place that is entered by the person designated under subsection 58(1) and every person found in the place must give the person designated under subsection 58(1) all reasonable assistance to enable them to exercise their powers or perform their duties and functions under this Act and provide them with any document or information, or access to any data, that they may reasonably require.

(5) The person designated under subsection 58(1) may be accompanied by any other person that they believe is necessary to help them exercise their powers or perform their duties and functions under this section.

(6) The person designated under subsection 58(1) and any person accompanying the person so designated may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

60 (1) In the case of a dwelling-house, the person designated under subsection 58(1) is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

(2) A justice of the peace may, on ex parte application, issue a warrant authorizing the person designated under subsection 58(1) and named in the warrant to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

• (a) the dwelling-house is a place referred to in subsection 59(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 59(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

(3) In executing the warrant, the person designated under subsection 58(1) is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.

61 (1) Subject to any regulations, the person designated under subsection 58(1) may, by order in writing, require a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

(2) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

(3) A person designated under subsection 58(1) must refer any order made under this section to the Canadian Nuclear Safety Commission for review and the Canadian Nuclear Safety Commission must confirm, amend or revoke the order.

62 The designated operator must comply with the order and provide to the person designated under subsection 58(1), within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

63 (1) If the person designated under subsection 58(1) believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the person so designated may, by order, require a designated operator to

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

(2) The order must specify the time within which and manner in which the designated operator may request a review of the order by the Canadian Nuclear Safety Commission.

(3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

(4) A person designated under subsection 58(1) must refer any order made under this section to the Canadian Nuclear Safety Commission for review and the Canadian Nuclear Safety Commission must confirm, amend or revoke the order.

64 (1) A designated operator that is subject to an order made under section 63 must comply with it.

(2) Once the designated operator complies with the order, it must notify the person designated under subsection 58(1), without delay, of its compliance.

65 (1) An order that is made under section 63 must be reviewed by the Canadian Nuclear Safety Commission at the written request of the designated operator that is subject to the order.

(2) The request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.

(3) The order continues to apply during a review unless the Canadian Nuclear Safety Commission decides otherwise.

66 (1) On completion of a review under subsection 65(1), the Canadian Nuclear Safety Commission must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

(2) If the Canadian Nuclear Safety Commission does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Canadian Nuclear Safety Commission and the designated operator, the Canadian Nuclear Safety Commission is deemed to have confirmed the order.

67 (1) The Chief Executive Officer may designate persons or classes of persons as inspection officers for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

(2) Each inspection officer must be provided with a certificate of designation in a form established by the Canadian Energy Regulator and, when entering any place under subsection 68(1), must, on request, produce the certificate to the person in charge of the place.

68 (1) Subject to subsection 69(1), the inspection officer may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

(2) For the purpose referred to in subsection (1), the inspection officer may

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

(3) If the inspection officer removes any document, record or cyber system referred to in paragraph (2)‍(f), the inspection officer must return it to its owner or the person in charge of it, on completion of the examination or copying.

(4) Every owner or person in charge of a place that is entered by the inspection officer and every person found in the place must give the officer all reasonable assistance to enable the officer to exercise the officer’s powers or perform the officer’s duties and functions under this Act and provide that officer with any document or information, or access to any data, that the officer may reasonably require.

(5) The inspection officer may be accompanied by any other person that the inspection officer believes is necessary to help the inspection officer exercise the inspection officer’s powers or perform the inspection officer’s duties and functions under this section.

(6) The inspection officer and any person accompanying the inspection officer may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

69 (1) In the case of a dwelling-house, the inspection officer is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

(2) A justice of the peace may, on ex parte application, issue a warrant authorizing the inspection officer named in it to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

• (a) the dwelling-house is a place referred to in subsection 68(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 68(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

(3) In executing the warrant, the inspection officer is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.

70 (1) Subject to any regulations, an inspection officer who is expressly authorized by the Chief Executive Officer to make orders under this section may, by order in writing, require a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

(2) The inspection officer who makes an order under this section must, as soon as possible, report the circumstances and terms of the order to the Commission.

(3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

71 The designated operator must comply with the order and provide to the inspection officer within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

72 (1) If an inspection officer has reasonable grounds to believe that a designated operator or other person has contravened any provision of this Act or the regulations made under this Act, the inspection officer may issue a notice of non-compliance to the designated operator or other person.

(2) The notice of non-compliance must be made in writing and must set out

• (a) the name of the designated operator or other person to which the notice is directed;

• (b) the provision of this Act or of the regulations made under it that is alleged to have been contravened or the order or decision that is alleged to have been contravened;

• (c) the relevant facts surrounding the alleged contravention; and

• (d) the period within which the designated operator or other person may provide comments in response to the notice.

73 (1) If the inspection officer who is expressly authorized by the Chief Executive Officer to make orders under this section believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the inspection officer may order a designated operator to

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

(2) The order may specify the time within which and the manner in which the designated operator may request a review of the order by the Commission.

(3) An inspection officer who makes an order under this section must, as soon as possible,

• (a) notify, in writing, the designated operator of the terms of the order and the reasons for the order; and

• (b) report the circumstances and terms of the order to the Commission.

(4) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

74 (1) A designated operator that is subject to an order made under section 73 must comply with it.

(2) Once the designated operator complies with the order, it must notify the inspection officer, without delay, of its compliance.

75 (1) The Commission may designate persons or classes of persons to conduct reviews under this section.

(2) An order that is made under section 73 must be reviewed by the Commission or the person designated under subsection (1) at the written request of the designated operator that is subject to the order.

(3) The request must be made within the time and in the manner specified in the order, if any, and state the grounds for review and set out the evidence that supports those grounds.

(4) The order continues to apply during a review unless the Commission or the person designated under subsection (1) decides otherwise.

76 (1) On completion of a review, the Commission or the person designated under subsection 75(1) must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

(2) If the Commission or the person designated under subsection 75(1) does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Commission or the person designated under subsection 75(1) and the designated operator, the Commission or the person designated under subsection 75(1) is deemed to have confirmed the order.

77 The Minister of Transport may delegate, subject to any restrictions or limitations that the Minister of Transport may specify, any of the Minister of Transport’s powers, duties and functions under this Act — other than the power to delegate under this section — to any person or class of persons.

78 (1) Subject to section 79, the Minister of Transport may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which the Minister of Transport has reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

(2) For the purpose referred to in subsection (1), the Minister of Transport may

• (a) examine anything in the place;

• (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

• (c) prepare a document, or cause one to be prepared, based on the information;

• (d) examine any record, report, data or other document and make copies of it or take extracts from it;

• (e) use any copying equipment in the place or cause it to be used; and

• (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

(3) If the Minister of Transport removes any document, record or cyber system referred to in paragraph (2)‍(f), the Minister of Transport must return it to its owner or the person in charge of it, on completion of the examination or copying.

(4) Every owner or person in charge of a place that is entered by the Minister of Transport and every person found in the place must give the Minister of Transport all reasonable assistance to enable the Minister of Transport to exercise the Minister of Transport’s powers or perform the Minister of Transport’s duties and functions under this Act and provide that Minister with any document or information, or access to any data, that the Minister of Transport may reasonably require.

(5) The Minister of Transport may be accompanied by any other person that the Minister of Transport believes is necessary to help the Minister of Transport exercise the Minister of Transport’s powers or perform the Minister of Transport’s duties and functions under this section.

(6) The Minister of Transport and any person accompanying the Minister of Transport may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

79 (1) In the case of a dwelling-house, the Minister of Transport is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

(2) A justice of the peace may, on ex parte application, issue a warrant authorizing the Minister of Transport to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

• (a) the dwelling-house is a place referred to in subsection 78(1);

• (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 78(1); and

• (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

(3) In executing the warrant, the Minister of Transport is not entitled to use force unless the use of force has been specifically authorized in the warrant and they are accompanied by a peace officer.

80 (1) Subject to any regulations, the Minister of Transport may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

(2) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

81 The designated operator must comply with an order and provide to the Minister of Transport, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

82 (1) If the Minister of Transport believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the Minister of Transport may order a designated operator to

• (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

• (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

(2) The order must specify the time within which and the manner in which the designated operator may request a review of the order by the Minister of Transport.

(3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

83 (1) A designated operator that is subject to an order made under section 82 must comply with it.

(2) Once the designated operator complies with the order, it must notify the Minister of Transport, without delay, of its compliance.

84 (1) An order that is made under section 82 must be reviewed by the Minister of Transport at the written request of the designated operator that is subject to the order.

(2) The request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.

(3) The order continues to apply during a review unless the Minister of Transport decides otherwise.

85 (1) On completion of a review, the Minister of Transport must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

(2) If the Minister of Transport does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Minister of Transport and the designated operator, the Minister of Transport is deemed to have confirmed the order.

General Provisions

86 A person must not obstruct or hinder the Superintendent, inspector, person designated under subsection 49(1) or 58(1), inspection officer or Minister of Transport, as the case may be, in exercising their powers or performing their duties and functions under this Act.

87 A person must not, with respect to any matter related to this Act, knowingly

• (a) provide any person with false or misleading information; or

• (b) provide any incident report that contains false or misleading information.

Administrative Monetary Penalties

88 In sections 89 to 135, penalty means an administrative monetary penalty imposed under those sections for a violation.

89 The purpose of a penalty is to promote compliance with this Act and not to punish.

90 Every designated operator or other person that contravenes or fails to comply with a provision of this Act or of the regulations made under this Act — designated by regulations made under paragraph 135(e) — commits a violation and is liable to a penalty of an amount to be determined in accordance with this Act and the regulations.

91 The amount that may be fixed under any regulations made under paragraph 135(g) as the penalty for a violation must not be more than

• (a) $1,000,000, in the case of an individual; and

• (b) $15,000,000, in any other case.

92 (1) Due diligence is a defence in a proceeding in relation to a violation.

(2) Every rule and principle of the common law that renders any circumstance a justification or excuse in relation to a charge for an offence under this Act applies in respect of a violation to the extent that it is not inconsistent with this Act.

93 If a designated operator commits a violation, any director or officer of the designated operator that directed, authorized, assented to, acquiesced in or participated in the commission of the violation is a party to the violation and is liable to a penalty of an amount to be determined in accordance with this Act and the regulations, whether or not the designated operator has been proceeded against in accordance with this Act.

94 A violation that is committed or continued on more than one day constitutes a separate violation in respect of each day on which it is committed or continued.

95 (1) Proceeding with any act or omission as a violation under this Act precludes proceeding with it as an offence under this Act, and proceeding with it as an offence under this Act precludes proceeding with it as a violation under this Act.

(2) For greater certainty, a violation is not an offence and, accordingly, section 126 of the Criminal Code does not apply in respect of a violation.

96 Proceedings in respect of a violation must not be commenced later than three years after the subject matter of the proceedings became known to the appropriate regulator.

97 (1) A penalty and any interest due in respect of the penalty constitute a debt due to Her Majesty in right of Canada and may be recovered in the Federal Court or any other court of competent jurisdiction.

(2) Proceedings to recover the debt must not be commenced after the period of five years that begins on the day on which the debt became payable.

(3) A penalty paid or recovered under this Act is payable to and must be remitted to the Receiver General.

98 (1) The unpaid amount of any debt referred to in subsection 97(1) may be certified by

• (a) the appropriate regulator; or

• (b) if the appropriate regulator is the Minister of Transport, by the Tribunal.

(2) Registration in the Federal Court or in any other court of competent jurisdiction of a certificate issued under subsection (1) has the same force and effect as a judgment of that court for a debt of the amount specified in the certificate and all related registration costs.

99 (1) If the Superintendent has reasonable grounds to believe that a designated operator or other person has committed a violation, the Superintendent may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the Superintendent must cause it to be served on the designated operator or other person.

(2) The notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set out

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Superintendent specifies, to pay the penalty or to make representations to the Superintendent with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

(3) At any time before the designated operator or other person makes representations in respect of a notice of violation to the Superintendent or enters into a compliance agreement with the Superintendent, the Superintendent may cancel the notice of violation or correct an error in it.

100 The penalty for a violation is to be determined by taking into account

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factors prescribed by the regulations; and

• (f) any other factors that the Superintendent considers relevant.

101 (1) If the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.

(2) Instead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,

• (a) make representations to the Superintendent in respect of the alleged violation or of the penalty; or

• (b) if the Superintendent offers a compliance agreement, enter into the compliance agreement with the Superintendent to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

102 (1) The Superintendent must decide, on a balance of probabilities, after considering any representations made under paragraph 101(2)‍(a), whether the designated operator or other person committed the violation and, if the Superintendent so decides, the Superintendent may, subject to the regulations made under paragraph 135(g), impose the penalty set out in the notice, a lesser penalty or no penalty.

(2) The Superintendent must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.

(3) If the Superintendent decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.

(4) If the designated operator or other person pays the penalty set out in the decision, the Superintendent must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.

(5) If the Superintendent decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of the violation are ended.

103 (1) If the Superintendent offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Superintendent considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

(2) If a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 101(2)‍(a).

(3) A designated operator or other person that enters into a compliance agreement with the Superintendent is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the Superintendent is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Superintendent must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

(5) If the Superintendent is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Superintendent must cause the designated operator or other person to be served with a notice of default informing them that

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Superintendent may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

(6) If a designated operator or other person pays the penalty set out in the notice of default within the time and in the manner set out in that notice, the Superintendent must accept the amount as complete satisfaction of the penalty owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

104 The Minister of Industry may designate persons or classes of persons who are authorized to issue notices of violation and to enter into a compliance agreement with a designated operator.

105 (1) If a person designated under section 104 has reasonable grounds to believe that a designated operator or other person has committed a violation, the person so designated may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the person designated under section 104 must cause it to be served on the designated operator or other person.

(2) The notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set out

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 104 specifies, to pay the penalty or to make representations to the Minister of Industry with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

(3) At any time before the designated operator or other person makes representations in respect of a notice of violation to the Minister of Industry or enters into a compliance agreement with the person designated under section 104, the person so designated may cancel the notice of violation or correct an error in it.

106 The penalty for a violation is to be determined by taking into account

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factors prescribed by the regulations; and

• (f) any other factors that the person designated under section 104 who issued the notice of violation considers relevant.

107 (1) If the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.

(2) Instead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,

• (a) make representations to the Minister of Industry in respect of the alleged violation or of the penalty; or

• (b) if the person designated under section 104 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

108 (1) The Minister of Industry must decide, on a balance of probabilities, after considering any representations made under paragraph 107(2)‍(a), whether the designated operator or other person committed the violation and, if that Minister so decides, that Minister may, subject to the regulations made under paragraph 135(g), impose the penalty set out in the notice, a lesser penalty or no penalty.

(2) The Minister of Industry must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.

(3) If the Minister of Industry determines that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.

(4) If the designated operator or other person pays the penalty set out in the decision, the Minister of Industry must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.

(5) If the Minister of Industry determines that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.

109 (1) If the person designated under section 104 offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the person so designated considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

(2) If a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 107(2)‍(a).

(3) A designated operator or other person that enters into a compliance agreement with the person designated under section 104 is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the person designated under section 104 is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the person so designated must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

(5) If the person designated under section 104 is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the person so designated must cause the designated operator or other person to be served with a notice of default informing them that

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Minister of Industry may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

(6) If a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Minister of Industry must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

110 (1) If the Bank has reasonable grounds to believe that a designated operator or other person has committed a violation, the Bank may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the Bank must cause it to be served on the designated operator or other person.

(2) The notice of violation must name the designated operator or other person, identify the alleged violation and set out

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

(3) At any time before the designated operator or other person makes representations in respect of a notice of violation to the Governor or enters into a compliance agreement with the Bank, the Bank may cancel the notice of violation or correct an error in it.

111 The penalty for a violation is to be determined by taking into account

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the Bank considers relevant.

112 (1) If the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.

(2) Instead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,

• (a) make representations to the Governor in respect of the alleged violation or of the penalty; or

• (b) if the Bank offers a compliance agreement, enter into the compliance agreement with the Bank to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

113 (1) The Governor must decide, on a balance of probabilities, after considering any representations made under paragraph 112(2)‍(a), whether the designated operator or other person committed the violation and, if the Governor so decides, the Governor may, subject to the regulations made under paragraph 135(g), impose the penalty set out in the notice, a lesser penalty or no penalty.

(2) The Governor must render a decision in writing, including reasons for it and the Bank must serve a copy of the decision on the designated operator or other person.

(3) If the Governor decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.

(4) If the designated operator or other person pays the penalty set out in the decision, the Bank must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.

(5) If the Governor decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.

114 (1) If the Bank offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Bank considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

(2) If a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 112(2)‍(a).

(3) A designated operator or other person that enters into a compliance agreement with the Bank is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the Bank is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Bank must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

(5) If the Bank is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Bank must cause the designated operator or other person to be served with a notice of default informing them that

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Bank may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

(6) If a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Bank must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

115 The Canadian Nuclear Safety Commission may designate persons or classes of persons who are authorized to issue notices of violation and to enter into a compliance agreement with a designated operator.

116 (1) If a person designated under section 115 has reasonable grounds to believe that a designated operator or other person has committed a violation, the person so designated may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the person so designated must cause it to be served on the designated operator or other person.

(2) The notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set out

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 115 specifies, to pay the penalty or to make representations to the Canadian Nuclear Safety Commission with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

(3) At any time before the designated operator or other person makes representations in respect of a notice of violation to the Canadian Nuclear Safety Commission or enters into a compliance agreement with the person designated under section 115, the person so designated may cancel the notice of violation or correct an error in it.

117 The penalty for a violation is to be determined by taking into account

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the person designated under section 115 who issued the notice of violation considers relevant.

118 (1) If the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.

(2) Instead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,

• (a) make representations to the Canadian Nuclear Safety Commission in respect of the alleged violation or of the penalty; or

• (b) if the person designated under section 115 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

119 (1) The Canadian Nuclear Safety Commission must decide, on a balance of probabilities, after considering any representations made under paragraph 118(2)‍(a), whether the designated operator or other person committed the violation and, if it so decides, it may, subject to the regulations made under paragraph 135(g), impose the penalty set out in the notice, a lesser penalty or no penalty.

(2) The Canadian Nuclear Safety Commission must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.

(3) If the Canadian Nuclear Safety Commission decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.

(4) If the designated operator or other person pays the penalty set out in the decision, the Canadian Nuclear Safety Commission must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.

(5) If the Canadian Nuclear Safety Commission decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.

120 (1) If the person designated under section 115 offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the person so designated considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

(2) If a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 118(2)‍(a).

(3) A designated operator or other person that enters into a compliance agreement with the person designated under section 115 is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the person designated under section 115 is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the person so designated must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

(5) If the person designated under section 115 is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the person so designated must cause the designated operator or other person to be served with a notice of default informing them that

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Canadian Nuclear Safety Commission may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

(6) If a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Canadian Nuclear Safety Commission must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

121 The Chief Executive Officer may designate persons or classes of persons who are authorized to issue notices of violation and to enter into a compliance agreement with a designated operator.

122 (1) If a person designated under section 121 has reasonable grounds to believe that a designated operator or other person has committed a violation, the person so designated may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the person so designated must cause it to be served on the designated operator or other person.

(2) The notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set out

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the person designated under section 121 specifies, to pay the penalty or to make representations to the Commission with respect to the violation or the proposed penalty, or both, and the manner for doing so; and

• (c) the fact that, if the designated operator or other person does not pay the penalty or make representations in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

(3) At any time before the designated operator or other person makes representations in respect of a notice of violation to the Commission or enters into a compliance agreement with the person designated under section 121, the person so designated may cancel the notice of violation or correct an error in it.

123 The penalty for a violation is to be determined by taking into account

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the person designated under section 121 who issued the notice of violation considers relevant.

124 (1) If the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.

(2) Instead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,

• (a) make representations to the Commission in respect of the alleged violation or of the penalty; or

• (b) if the person designated under section 121 offers a compliance agreement, enter into the compliance agreement with the person so designated to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

125 (1) The Commission may designate persons or classes of persons to consider the representations made under paragraph 124(2)‍(a).

(2) The Commission or the person designated under subsection (1) must decide, on a balance of probabilities, after considering any representations made under paragraph 124(2)‍(a), whether the designated operator or other person committed the violation and, if it so decides, it may, subject to the regulations made under paragraph 135(g), impose the penalty set out in the notice, a lesser penalty or no penalty.

(3) The Commission or the person designated under subsection (1) must render a decision in writing, including reasons for it and must serve a copy of the decision on the designated operator or other person.

(4) If the Commission or the person designated under subsection (1) decides that the designated operator or other person committed the violation, the designated operator or other person is liable to the penalty as set out in the decision.

(5) If the designated operator or other person pays the penalty set out in the decision, the Commission or the person designated under subsection (1) must accept the amount as complete satisfaction of the penalty in respect of the violation and the proceedings commenced in respect of the violation are ended.

(6) If the Commission or the person designated under subsection (1) decides that the designated operator or other person did not commit the violation, the proceedings commenced in respect of it are ended.

(7) Despite section 28 of the Federal Courts Act, the Federal Court has exclusive original jurisdiction to hear and determine an application for judicial review of a decision made under this section by the Commission or the person designated under subsection (1).

126 (1) If the person designated under section 121 offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the person so designated considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

(2) If a compliance agreement is entered into, the designated operator or other person cannot make any representations under paragraph 124(2)‍(a).

(3) A designated operator or other person that enters into a compliance agreement with the person designated under section 121 is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the person designated under section 121 is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the person so designated must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

(5) If the person designated under section 121 is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the person designated under section 121 must cause the designated operator or other person to be served with a notice of default informing them that

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Canadian Energy Regulator may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

(6) If a designated operator or other person pays the amount set out in the notice of default within the time and in the manner specified in that notice, the Canadian Energy Regulator must accept the amount as complete satisfaction of the amount owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

127 (1) If the Minister of Transport has reasonable grounds to believe that a designated operator or other person has committed a violation, the Minister of Transport may issue a notice of violation to the designated operator or other person. If a notice of violation is issued, the Minister of Transport must cause it to be served on the designated operator or other person.

(2) The notice of violation must name the designated operator or other person that is alleged to have committed the violation, identify the alleged violation and set out

• (a) the penalty for the violation that the designated operator or other person is liable to pay;

• (b) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Minister of Transport specifies, to pay the penalty and the manner for doing so;

• (c) the right of the designated operator or other person, within 30 days after the notice is served or within any longer period that the Tribunal on application may allow, to file a request to review under paragraph 129(2)‍(a) with respect to the violation or the proposed penalty, or both; and

• (d) the fact that, if the designated operator or other person does not pay the penalty or file a request to review with the Tribunal in accordance with the notice, the designated operator or other person will be deemed to have committed the violation and be liable to the penalty set out in the notice.

(3) At any time before the designated operator or other person files a request to review with the Tribunal under paragraph 129(2)‍(a) or enters into a compliance agreement with the Minister of Transport, the notice of violation may be canceled by the Minister of Transport or an error in it may be corrected.

128 The penalty for a violation is to be determined by taking into account

• (a) the designated operator’s or other person’s history of compliance or non-compliance with the provisions of this Act or of the regulations;

• (b) the nature and scope of the violation;

• (c) whether the designated operator or other person made reasonable efforts to mitigate or reverse the effects of the violation;

• (d) whether the designated operator or other person derived any competitive or economic benefit from the violation;

• (e) any other factor prescribed by the regulations; and

• (f) any other factors that the Minister of Transport considers relevant.

129 (1) If the designated operator or other person named in the notice of violation pays the penalty set out in the notice, they are deemed to have committed the violation and the proceedings commenced in respect of the violation are ended.

(2) Instead of paying the penalty set out in the notice, the designated operator or other person named in the notice may, in accordance with the notice,

• (a) file a request for a review with the Tribunal in respect of the alleged violation or of the penalty; or

• (b) if the Minister of Transport offers a compliance agreement, enter into the compliance agreement with the Minister of Transport to ensure the designated operator’s or other person’s compliance with the provision to which the violation relates.

130 (1) On receipt of the request referred to in paragraph 129(2)‍(a), the Tribunal must appoint a time and place for the review and notify the Minister of Transport and the designated operator or other person who filed the request of the time and place in writing.

(2) The member of the Tribunal who is assigned to conduct the review must provide the Minister of Transport and the designated operator or other person that filed the request with an opportunity that is consistent with procedural fairness and natural justice to present evidence and make representations.

(3) The Minister of Transport has the burden of establishing on a balance of probabilities that the designated operator or other person committed a violation.

(4) A designated operator or other person that is alleged to have committed a violation is not required to give any evidence or testimony in the matter.

(5) For the purpose of a review requested under paragraph 129(2)‍(a), the Minister of Transport or the designated operator or other person may disclose confidential information to the Tribunal.

131 In making a determination at the conclusion of a review, the member of the Tribunal who conducts the review must, without delay, inform the Minister of Transport and the designated operator or other person

• (a) that the designated operator or other person has not committed a violation, in which case no further proceedings under this Act are to be taken against the designated operator or other person in respect of the alleged violation; or

• (b) that the designated operator or other person has committed a violation, in which case the member must also inform the Minister of Transport and the designated operator or other person of the amount determined by the member, subject to section 128 and the regulations made under paragraph 135(g), to be payable to the Tribunal by or on behalf of the designated operator or other person and the period within which it must be paid.

132 (1) Within 30 days after a determination is made under section 131, the Minister of Transport or designated operator or other person affected by the determination may appeal the determination to the Tribunal.

(2) A party who does not appear at a review hearing is not entitled to appeal the determination, unless the party establishes that there was sufficient reason to justify their absence.

(3) The appeal panel of the Tribunal that is assigned to hear an appeal may dismiss it or allow it and, in allowing the appeal, may substitute its decision for the determination.

(4) If the appeal panel finds that a designated operator or other person has committed a violation, the panel must immediately inform the designated operator or other person, as the case may be, and the Minister of Transport of the finding and, subject to any regulations made under paragraph 135(g), of the amount determined by the panel to be payable to the Tribunal by or on behalf of the designated operator or other person, as the case may be, in respect of the violation and the time within which it must be paid.

(5) If the appeal panel finds that a designated operator or other person has not committed a violation, the panel must immediately inform the designated operator or other person, as the case may be, and the Minister of Transport of the finding.

133 The Minister of Transport may obtain from the Tribunal or the member, as the case may be, a certificate in the form established by the Governor in Council setting out the penalty required to be paid by the designated operator or other person that fails, within the time required,

• (a) to pay the penalty set out in the notice of violation or to file a request for a review under paragraph 129(2)‍(a); or

• (b) to pay the amount determined under paragraph 131(b).

134 (1) If the Minister of Transport offers to enter into a compliance agreement with the designated operator or other person, the agreement is subject to any terms that the Minister of Transport considers appropriate, including the reduction, in whole or in part, of the penalty for the violation.

(2) If a compliance agreement is entered into, the designated operator or other person cannot file a request for a review under paragraph 129(2)‍(a).

(3) A designated operator or other person that enters into a compliance agreement with the Minister of Transport is deemed to have committed the violation in respect of which the compliance agreement was entered into.

(4) If the Minister of Transport is of the opinion that a designated operator or other person that has entered into a compliance agreement has complied with it, the Minister of Transport must serve a notice to that effect on the designated operator or other person and, on the service of the notice, the proceedings commenced in respect of the violation are ended.

(5) If the Minister of Transport is of the opinion that a designated operator or other person that has entered into a compliance agreement has not complied with it, the Minister of Transport must cause the designated operator to be served with a notice of default informing them that

• (a) they are liable to pay, within the time and in the manner set out in the notice of default, the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, less any amount they paid under the compliance agreement; and

• (b) the Minister of Transport may make public the designated operator’s or other person’s name, the nature of the violation, the scope of the non-compliance with the compliance agreement and the penalty payable.

(6) If a designated operator or other person pays the penalty set out in the notice of default within the time and in the manner set out in that notice, the Minister of Transport must accept the amount as complete satisfaction of the penalty owing in respect of the violation and the proceedings commenced in respect of the violation are ended.

Regulations

135 The Governor in Council may make regulations for carrying out the purposes and provisions of this Act, including regulations

• (a) respecting cyber security programs;

• (b) respecting any condition and criteria respecting internal audits;

• (c) respecting the form and manner for reporting any cyber security incidents referred to in section 17 and the types of incidents that must be reported;

• (d) respecting the management of records referred to in section 30, including the collection, use, retention, disclosure and disposal of those records;

• (e) designating any provision of this Act or of the regulations made under this Act for the purposes of section 90;

• (f) classifying each violation as a minor violation, a serious violation or a very serious violation;

• (g) fixing the maximum penalty in respect of each violation;

• (h) defining, for the purposes of this Act, any word or expression that is used in this Act but is not defined; and

• (i) prescribing anything that is to be prescribed under this Act.

Offences

136 (1) Every person who contravenes section 10, subsection 13(1) or 14(1), section 17 or 18, subsection 30(1) or (2) or 32(4), section 35, subsection 37(1) or 41(4), section 44, subsection 46(1) or 50(4), section 53, subsection 55(1) or 59(4), section 62, subsection 64(1) or 68(4), section 71, subsection 74(1) or 78(4), section 81 or subsection 83(1) is guilty of an offence punishable on summary conviction.

(2) Every person, partnership or unincorporated organization that contravenes section 29 is guilty of an offence punishable on summary conviction.

137 Every person who contravenes subsection 9(1), section 12 or 15, subsection 20(3), section 24, subsection 25(2), section 26 or 86 or paragraph 87(a) or (b) is guilty of an offence and liable

• (a) on summary conviction

  • (i) in the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than two years less a day, or to both, and

  • (ii) in the case of a corporation, to a fine in an amount that is in the discretion of the court; or

• (b) on conviction on indictment

  • (i) in the case of an individual, to a fine in an amount that is in the discretion of the court or to imprisonment for a term of not more than five years, or to both, and

  • (ii) in the case of a corporation, to a fine in an amount that is in the discretion of the court.

138 If a designated operator commits an offence under this Act, any director or officer of the designated operator that directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to the offence and is liable on conviction to the punishment provided for by this Act, even if the designated operator is not prosecuted for or convicted of the offence.

139 If an offence under section 136 or 137 is committed or continued on more than one day, it constitutes a separate offence for each day on which the offence is committed or continued.

140 A prosecution must not be commenced in respect of an offence under this Act later than three years after the day on which the subject matter of the prosecution arose.

141 A person, partnership or unincorporated organization is not to be found guilty of an offence under this Act — other than an offence under section 137 that is in respect of a contravention of subsection 9(1), section 15 or 26 or paragraph 87(a) or (b) — if they establish that they exercised all due diligence to prevent the commission of the offence.

142 In a prosecution under this Act, it is sufficient proof of an offence to establish that it was committed by an employee or agent or mandatary of the accused whether or not the employee or agent or mandatary is identified or has been prosecuted for the offence.

143 In any action or proceeding under this Act, any document purporting to be certified by a regulator as a true copy of a document made, given or issued under this Act is, without proof of the signature or of the official character of the person appearing to have signed the document,

• (a) evidence of the original document of which it purports to be a copy;

• (b) evidence of the fact that the original document was made, given or issued by or by the authority of or deposited with the person named in it and was made, given or issued at the time stated in the certified copy, if a time is stated in it; and

• (c) evidence of the fact that the original document was signed, certified, attested or executed by the persons and in the manner shown in the certified copy.

144 In any action or proceeding under this Act, an entry in any record required under this Act to be kept is, in the absence of evidence to the contrary, proof of the matters stated in it as against the person who made the entry or the designated operator that was required to keep the record.

145 (1) The following rules apply to judicial review proceedings in respect of the issuance of a cyber security direction under section 20:

• (a) at any time during a proceeding, the judge must, at the Minister’s request, hear submissions on evidence or other information in the absence of the public and of the applicant and their counsel if, in the judge’s opinion, the disclosure of the evidence or other information could be injurious to international relations, national defence or national security or endanger the safety of any person;

• (b) the judge must ensure the confidentiality of the evidence and other information provided by the Minister if, in the judge’s opinion, its disclosure would be injurious to international relations, national defence or national security or endanger the safety of any person;

• (c) throughout the proceeding, the judge must ensure that the applicant is provided with a summary of the evidence and other information available to the judge that enables the applicant to be reasonably informed of the Government of Canada’s case but that does not include anything that, in the judge’s opinion, would be injurious to international relations, national defence or national security or endanger the safety of any person if disclosed;

• (d) the judge must provide the applicant and the Minister with an opportunity to be heard;

• (e) the decision of the judge may be based on evidence or other information available to the judge even if a summary of that evidence or other information has not been provided to the applicant;

• (f) if the judge determines that evidence or other information provided by the Minister is not relevant or if the Minister withdraws the evidence or other information, the decision of the judge must not be based on that evidence or other information and the judge must return it to the Minister; and

• (g) the judge must ensure the confidentiality of all evidence and other information that the Minister withdraws.

(2) Subsection (1) applies to any appeal of a decision made by a judge in relation to the judicial review proceedings referred to in this section and to any further appeal, with any necessary modifications.

(3) In this section, judge means the Chief Justice of the Federal Court or a judge of that Court designated by the Chief Justice.

General

146 The Minister must, within three months after the end of each fiscal year, prepare a report on the administration of this Act for that fiscal year and cause a copy of the report to be laid before each House of Parliament on any of the first 15 sitting days of that House after the report is completed.

6 A judge of the Federal Court, for the purposes of section 145 of the Critical Cyber Systems Protection Act

Critical Cyber Systems Protection Act

Loi sur la protection des cybersystèmes essentiels

Item	Vital Services and Vital Systems
1	Telecommunications services
2	Interprovincial or international pipeline and power line systems
3	Nuclear energy systems
4	Transportation systems that are within the legislative authority of Parliament
5	Banking systems
6	Clearing and settlement systems

	Column 1	Column 2
Item	Class of Operators	Regulator