Bill C-22: An Act respecting lawful access

Alternative Title Alternative title 1 This Act may be cited as the Lawful Access Act, 2026 . PART 1 Timely Access to Data and Information R.S., c. C- 46 Criminal Code Amendments to the Act 2 Subsection 462.32(3) of the Criminal Code is replaced by the following: Other provisions to apply (3) Subsections 487(2.1) to (2.3) and (2.5) to (3) and section 488 apply, with any modifications that the circumstances require, to a warrant issued under this section. 3 (1) The portion of subsection 487(1) of the Act before paragraph (a) is replaced by the following: Information for search warrant 487 (1) A judge or justice who is satisfied by information on oath in Form 1 that there are reasonable grounds to believe that there is in a building, receptacle or place (2) Subsection 487(1) of the Act is amended by replacing “a public officer who has been appointed or designated to administer or enforce a federal or provincial law and whose duties include the enforcement of this Act or any other Act of Parliament and who is named in the warrant” with “a public officer”. (3) Subsections 487(2) to (2.2) of the Act are replaced by the following: Execution in Canada (2) A warrant issued under subsection (1) may be executed at any place in Canada. A peace officer or public officer who executes the warrant must have authority to act in that capacity in the place where the warrant is executed. Operation of computer system and copying equipment (2.1) A person authorized under a warrant issued under subsection (1) to search a computer system in a building or place for computer data may (a) use or cause to be used any computer system at the building or place to search any computer data contained in or available to the computer system; and (b) seize any computer data for examination. Duty of person in possession or control (2.2) Every person who is in possession or control of any building or place in respect of which a search is carried out under a warrant issued under subsection (1) shall, on presentation of the warrant, permit the person carrying out the search to perform any of the acts referred to in subsection (2.1) . Examination of computer data (2.3) The judge or justice may, in a warrant issued under subsection (1), authorize the examination of any computer data seized under the warrant or contained in or available to a computer system seized under the warrant, if the judge or justice is satisfied that there are reasonable grounds to believe that the computer data will afford evidence with respect to the commission of the offence set out in the information. Warrant — examination of computer data (2.4) A judge or justice may at any time issue a warrant authorizing the examination of computer data contained in or available to a computer system that is specified in the warrant and that is in the possession of a peace officer or public officer if the judge or justice is satisfied by information on oath in Form 1 that there are reasonable grounds to believe that (a) an offence has been or will be committed under this Act or any other Act of Parliament; and (b) the computer data will afford evidence with respect to the commission of the offence. Conditions (2.5) The examination of computer data under a warrant issued under this section may be made subject to any conditions that the judge or justice considers advisable to ensure that the examination is reasonable in the circumstances. Copy of warrant relating to computer data (2.6) As soon as feasible after a warrant authorizing the examination of computer data is issued under this section, the person who applied for it shall give a copy of it to the following persons: (a) any person, if known, who is the lawful owner of the computer system that contains the computer data or through which the computer data is available or who is lawfully entitled to the possession of that computer system; and (b) any person who is referred to in the information, who is under investigation for the commission of the offence set out in the warrant and whose computer data is authorized to be examined under the warrant. Exception (2.7) However, a copy of the warrant is not required to be given to a person under subsection (2.6) if (a) the person has already received a copy under section 487.093; or (b) the judge or justice who issues the warrant sets aside the requirement in respect of the person, on being satisfied that doing so is justified in the circumstances. Extension (2.8) If the judge or justice who issues a warrant under this section authorizing the examination of computer data or any other judge or justice having jurisdiction to issue such a warrant is satisfied, on the basis of an affidavit submitted in support of an application to extend the period within which a copy of the warrant shall be given under subsection (2.6), that the interests of justice warrant the granting of the application, the judge or justice may grant an extension, or a subsequent extension, of the period, but no extension may exceed three years. Examination — time and place (2.9) An examination of computer data authorized under a warrant issued under this section may take place at any time and at any place in Canada and, for the purposes of the examination, a person may copy computer data at any time and at any place in Canada. (4) Section 487 of the Act is amended by adding the following after subsection (3): Definitions (4) The following definitions apply in this section. computer data  has the same meaning as in subsection 342.1(2). ( données informatiques ) computer system  has the same meaning as in subsection 342.1(2). ( ordinateur ) judge  means a judge of a superior court of criminal jurisdiction or a judge of the Court of Quebec. ( juge ) public officer  means a public officer who is appointed or designated to administer or enforce a federal or provincial law and whose duties include the enforcement of this Act or any other Act of Parliament. ( fonctionnaire public ) 4 (1) The portion of section 487.011 of the Act before the first definition is replaced by the following: Definitions 487. 011 The following definitions apply in this section and in sections 487.012 to 487.0199, 487.11, 492.1 and 492.2 . (2) Section 487.011 of the Act is amended by adding the following in alphabetical order: subscriber information , in relation to any client of a person who provides services to the public or any subscriber to the services of such a person, means (a) information that may be used to identify the subscriber or client, including their name, pseudonym, address, telephone number and email address; (b) identifiers assigned to the subscriber or client by the person, including account numbers; and (c) information relating to the services provided to the subscriber or client, including (i) the types of services provided, (ii) the period during which the services were provided, and (iii) information that identifies the devices, equipment or things used by the subscriber or client in relation to the services. ( renseignements relatifs à l’abonné ) 5 The Act is amended by adding the following after section 487.012: Confirmation of service demand 487.0121 (1) A peace officer or public officer may make a demand in Form 5.0011 to a telecommunications service provider requiring them to confirm, within the time and in the manner specified in the demand, whether or not they provide or have provided telecommunication services to any subscriber or client, or to any account or identifier, specified in the demand. Conditions for making demand (2) The peace officer or public officer may make the demand only if they have reasonable grounds to suspect that (a) an offence has been or will be committed under this Act or any other Act of Parliament; and (b) the confirmation that is demanded will assist in the investigation of the offence. Medical and privileged information (3) For greater certainty, a demand must not be made if the confirmation would disclose medical information or information that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries. Limitation (4) A demand must not be made to a telecommunications service provider that is under investigation for the offence referred to in subsection (2). Time (5) The time specified in the demand is to be not less than 24 hours. Non-disclosure (6) The peace officer or public officer who makes the demand may impose conditions in the demand prohibiting the disclosure of its existence or some or all of its contents for a period not greater than one year after the day on which the demand is made. The peace officer or public officer may impose the conditions only if they have reasonable grounds to believe that the disclosure during that period would jeopardize the conduct of the investigation of the offence to which the demand relates. Revocation (7) A peace officer or public officer may, at any time, revoke the demand or a condition by notice given to the telecommunications service provider. Application for review (8) The telecommunications service provider may, within five business days after the day on which they receive the demand, apply in writing, to a judge in the judicial district where the demand was received, to revoke or vary the demand. Notice to apply for review (9) The telecommunications service provider may make an application under subsection (8) only if, before the confirmation is required to be provided, they give notice to the peace officer or public officer who made the demand of the telecommunications service provider’s intention to make the application. No obligation to provide confirmation (10) The telecommunications service provider is not required to provide the confirmation until a final decision is made with respect to the application. Revocation or variation of demand (11) The judge in the judicial district where the demand was received may revoke or vary the demand if satisfied that (a) it is unreasonable in the circumstances to require the applicant to provide the confirmation; or (b) provision of the confirmation would disclose information that is privileged or otherwise protected from disclosure by law. Request for confirmation (12) Despite subsection (1), no demand under that subsection is necessary for a peace officer or public officer to ask a telecommunications service provider to voluntarily provide the confirmation referred to in that subsection if the telecommunications service provider is not prohibited by law from providing it. A telecommunications service provider that provides a confirmation in those circumstances does not incur any criminal or civil liability for doing so. Definition of telecommunications service provider (13) In this section, telecommunications service provider has the same meaning as in subsection 2(1) of the Telecommunications Act . 6 The Act is amended by adding the following after section 487.0141: Production order — subscriber information 487.0142 (1) On ex parte application made by a peace officer or public officer, a justice or judge may order a person who provides services to the public to prepare and produce a document containing all the subscriber information that relates to any information, including transmission data, that is specified in the order and that is in their possession or control when they receive the order. Conditions for making order (2) Before making the order, the justice or judge must be satisfied by information on oath in Form 5.004 that there are reasonable grounds to suspect that (a) an offence has been or will be committed under this Act or any other Act of Parliament; and (b) the subscriber information is in the person’s possession or control and will assist in the investigation of the offence. Form (3) The order is to be in Form 5.0052. Limitation (4) A person who is under investigation for the offence referred to in subsection (2) is not to be made subject to an order. 7 The Act is amended by adding the following after section 487.018: Application — transmission data or subscriber information 487.0181 (1) On ex parte application made by a peace officer or public officer, a justice or judge may authorize a peace officer or public officer to make a request to a foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public to prepare and produce a document containing transmission data or subscriber information that is in the foreign entity’s possession or control when it receives the request. Conditions for authorization (2) The justice or judge may authorize a peace officer or public officer to make the production request only if the justice or judge is satisfied by information on oath in Form 5.00801 that there are reasonable grounds to suspect that (a) an offence has been or will be committed under this or any other Act of Parliament; and (b) the transmission data or the subscriber information is in the foreign entity’s possession or control and will assist in the investigation of the offence. Authorization (3) The authorization is to be in Form 5.00802 and must specify that a peace officer or public officer must not send a production request more than 30 days after the day on which the authorization is granted. Form (4) The production request is to be in Form 5.00803 and may include any information that is required by the foreign entity, by the foreign state in which the foreign entity is located or under an international agreement or arrangement to which Canada and the foreign state are parties. 8 Subsection 487.0191(1) of the Act is replaced by the following: Order prohibiting disclosure 487.0191 (1) On ex parte application made by a peace officer or public officer, a justice or judge may make an order prohibiting a person from disclosing the existence or some or all of the contents of a preservation demand made under section 487.012, a confirmation of service demand made under section 487.0121 or an order made under any of sections 487.013 to 487.018 during the period set out in the order. 9 Subsection 487.0192(1) of the Act is replaced by the following: Particulars — production orders 487.0192 (1) An order made under any of sections 487.014, 487.0141, 487.0142 and 487.016 to 487.018 must require a person, financial institution or entity to produce the document to a peace officer or public officer named in the order within the time, at the place and in the form specified in the order. 10 Subsections 487.0193(1) and (2) of the Act are replaced by the following: Application for review of production order 487.0193 (1) A person, financial institution or entity required by an order made under any of sections 487.014 to 487.018 to produce a document may, before the person, institution or entity is required to produce the document but not later than 10 business days after the day on which the order was received , apply in writing to the justice or judge who made the order  —  or to a judge in the judicial district where the order was received   —  to revoke or vary the order. Notice required (2) The person, institution or entity may make the application only if, before the application is made, the person, institution or entity gives notice of their intention to make the application to a peace officer or public officer named in the order. 11 Section 487.0195 of the Act is replaced by the following: For greater certainty 487.0195 (1) For greater certainty, no preservation demand, preservation order, keep account open or active order or production order is necessary for a peace officer or public officer to ask a person to voluntarily preserve data that the person is not prohibited by law from preserving, to voluntarily keep an account open or active that the person is not prohibited by law from keeping open or active or to voluntarily provide a document or information to the officer that the person is not prohibited by law from disclosing. No civil or criminal liability (2) A person who preserves data, keeps an account open or active or provides a document or information in those circumstances does not incur any criminal or civil liability for doing so. Unsolicited provision of information (3) For greater certainty, no production order or warrant, or confirmation of service demand made under section 487.0121, is necessary for a peace officer or public officer to receive any information from a person or a telecommunications service provider, as the case may be, who is lawfully in possession of it, and to act on the information, if the person, without being asked for it, provides it voluntarily or is required by law, including a law of a foreign state, to provide it. Publicly available information (4) For greater certainty, no production order or warrant, or confirmation of service demand made under section 487.0121, is necessary for a peace officer or public officer to receive, obtain and act on any information that is available to the public. 12 Section 487.0197 of the Act is replaced by the following: Offence — preservation or confirmation of service demand 487. 0197 A person who contravenes a preservation demand made under section 487.012 or a confirmation of service demand made under section 487.0121 without lawful excuse is guilty of an offence punishable on summary conviction and is liable to a fine of not more than $5,000. 13 (1) Subsection 487.1(1) of the Act is amended by adding the following after paragraph (l): (l.1) a warrant under subsection 487(2.4); (l.2) an extension under subsection 487(2.8); (2) Subsection 487.1(1) of the Act is amended by adding the following after paragraph (o): (o.1) an authorization under subsection 487.0181(1); 14 Section 487.11 of the Act is replaced by the following: Exigent circumstances 487. 11 A peace officer or public officer may, in the course of their duties, (a) exercise any of the powers described in section 487, 492.1 or 492.2 without a warrant if the conditions for obtaining a warrant exist but by reason of exigent circumstances it would be impracticable to obtain a warrant; or (b) seize any subscriber information that may be the subject of an order made under subsection 487.0142(1) or any data that may be the subject of an order made under subsection 487.016(1) or 487.017(1) if the conditions for obtaining an order exist but by reason of exigent circumstances it would be impracticable to obtain an order. 15 The portion of section 487.2 of the Act before paragraph (a) is replaced by the following: Restriction on publication 487. 2 If a search warrant is issued under subsection 487 (1) or a search is made under such a warrant, everyone who publishes in any document, or broadcasts or transmits in any way, any information with respect to 16 (1) The portion of section 488 of the Act before paragraph (b) is replaced by the following: Warrant search by day 488 A search of a building, receptacle or place under a warrant issued under subsection 487 (1) shall be carried out during the day, unless (a) the judge or justice is satisfied that there are reasonable grounds for the search to be carried out at night; (2) Paragraph 488(c) of the Act is replaced by the following: (c) the warrant authorizes that the search be carried out at night. 17 Section 489.1 of the Act is amended by adding the following after subsection (3): Exception — computer data (4) This section does not apply with respect to computer data , as defined in subsection 342.1(2), other than virtual currency or other digital assets. 18 Subsection 492(1) of the Act is replaced by the following: Seizure of explosives 492 (1) Every person who executes a warrant issued under subsection 487 (1) may seize any explosive substance that they suspect is intended to be used for an unlawful purpose, and shall, as soon as possible, remove to a place of safety anything that they seize under this section and detain it until they are ordered by a judge of a superior court to deliver it to some other person or an order is made under subsection (2). 19 (1) Subsection 492.1(3) of the Act is replaced by the following: Tracking similar things (2.1) A justice or judge who authorizes a peace officer or public officer to obtain tracking data that relates to the location of a thing that a person uses, carries or wears may, in the warrant, authorize the peace officer or public officer to obtain tracking data that relates to the location of any similar thing that is unknown at the time the warrant is issued if the justice or judge is satisfied that there are reasonable grounds to suspect that the person will use, carry or wear that similar thing. Scope of warrant (3) The warrant authorizes the peace officer or public officer, or a person acting under their direction, to install, activate, use, maintain, monitor and remove the tracking device, including covertly. The warrant also authorizes a person acting under the direction of the peace officer or public officer to obtain the tracking data that is authorized to be obtained under the warrant . (2) Subsection 492.1(8) of the Act is replaced by the following: Definition of tracking device (8) In this section, tracking device means a device, including a computer program as defined in subsection 342.1(2), that may be used to obtain or record tracking data or to transmit it by a means of telecommunication. 20 (1) Subsection 492.2(2) of the Act is replaced by the following: Transmission data — means of telecommunication (1.1) A justice or judge who authorizes a peace officer or public officer to obtain transmission data that relates to any means of telecommunication used by a person may, in the warrant, authorize the peace officer or public officer to obtain transmission data that relates to any means of telecommunication that is unknown at the time the warrant is issued but that is of a similar type to the means of telecommunication described in the warrant if the justice or judge is satisfied that there are reasonable grounds to suspect that the person will use that other means of telecommunication. Scope of warrant (2) The warrant authorizes the peace officer or public officer, or a person acting under their direction, to install, activate, use, maintain, monitor and remove the transmission data recorder, including covertly. The warrant also authorizes a person acting under the direction of the peace officer or public officer to obtain the transmission data that is authorized to be obtained under the warrant . Conditions (2.1) A warrant may contain any conditions that the justice or judge considers appropriate, including conditions to protect a person’s interests. (2) Subsection 492.2(6) of the Act is replaced by the following: Subscriber information related to transmission data (5.2) The justice or judge may, in the warrant, authorize a peace officer or public officer to obtain from a person who provides services to the public any information referred to in paragraph (a) of the definition subscriber information in section 487.011 that relates to the transmission data that is authorized to be obtained under the warrant and that is in the person’s possession or control. Definition of transmission data recorder (6) In this section, transmission data recorder means a device, including a computer program as defined in subsection 342.1(2), that may be used to obtain or record transmission data or to transmit it by a means of telecommunication. 21 Form 1 of Part XXVIII of the Act is replaced by the following: FORM 1 (Sections 320.29, 462.32, 462.321 and 487) Information to Obtain a Search Warrant Canada, Province of , ( territorial division ). This is the information of A.B., of in the ( territorial division ), ( occupation ), in this information called the informant, taken before me. The informant says that ( describe things or computer data to be searched for and offence in respect of which search is to be made ), and that they believe on reasonable grounds that those things, or some part of them, ( or that computer data ) are in the ( dwelling-house, etc. or computer system ) of C.D., of , in ( territorial division ). ( Here add the grounds of belief, whatever they may be .) The informant therefore requests that a search warrant be granted to search the ( dwelling-house, etc. or computer system ) for those things ( or that computer data ) . ( or ) The informant says that they believe on reasonable grounds that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ) and that computer data contained in or available to ( specify computer system in the possession of a peace officer or public officer ) will afford evidence with respect to the commission of the offence. ( Here add the grounds of belief, whatever they may be .) The informant therefore requests that a warrant be granted to examine that computer data. Sworn before me on ( date ) , at ( place ) . ( Signature of Informant ) A ( judge or justice ) in and for 22 Form 5 of Part XXVIII of the Act is replaced by the following: FORM 5 (Sections 320.29 and 487) Warrant to Search Canada, Province of , ( territorial division ). To the peace officers in the ( territorial division ) or to the public officers whose duties include the enforcement of ( specify an Act of Parliament ) : Whereas it appears on the oath of A.B., of that there are reasonable grounds for believing that ( describe things or computer data to be searched for and offence in respect of which search is to be made ) are in at , in this warrant called the premises; This warrant authorizes and requires you between the hours of ( as the judge or justice may direct ) to enter into the premises and to search for the things referred to in this warrant and to bring them before a justice. ( and, if applicable ) This warrant also authorizes the examination of computer data contained in or available to a computer system seized under this warrant or of computer data seized under this warrant. ( Specify any conditions to which the examination is subject. ) ( or ) Whereas it appears on the oath of A.B., of , that they have reasonable grounds to believe that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ) and to believe that computer data contained in or available to ( specify computer system in the possession of a peace officer or public officer ) will afford evidence with respect to the commission of the offence; This warrant authorizes the examination of that computer data. ( Specify any conditions to which the examination is subject. ) Dated ( date ) at ( place ) . A ( judge or justice ) in and for 23 Part XXVIII of the Act is amended by adding the following after Form 5.001: FORM 5.0011 (Subsection 487.0121(1)) Confirmation of Service Demand Canada, Province of , ( territorial division ) To ( name of the telecommunications service provider ), of : Because I have reasonable grounds to suspect that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ) and that the confirmation specified below will assist in the investigation of that offence, you are required to confirm, as soon as possible but not later than ( specify time by which the confirmation is to be provided ) whether or not you provide or have provided telecommunication services to ( specify subscriber or client, or account or identifier ), unless this demand is revoked. The confirmation must be provided to ( name of peace officer or public officer ), ( specify the form and manner ). This demand is subject to the following conditions: ( specify any conditions to which the demand is subject ). You have the right to apply to revoke or vary this demand. If you contravene this demand without lawful excuse, you may be subject to a fine. ( Signature of peace officer or public officer ) 24 Form 5.004 of Part XXVIII of the Act is replaced by the following: FORM 5.004 (Subsections 487.014(2), 487.0141(2), (5) and (10), 487.0142(2) , 487.015(2), 487.016(2), 487.017(2) and 487.018(3)) Information to Obtain a Production Order Canada, Province of ( territorial division ) This is the information of ( name of peace officer or public officer ), of (“the informant”). The informant says that they have reasonable grounds to suspect ( or, if the application is for an order under section 487.014 or 487.0141 of the Criminal Code , reasonable grounds to believe) (a) that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ); and (b) ( if the application is for an order under section 487.014 of the Criminal Code ) that ( specify the document or data ) is in the possession or control of ( name of the person ) and will afford evidence respecting the commission of the offence. (or) (b) ( if the application is for an order under section 487.0141 of the Criminal Code ) that ( specify the document or data ), if it is in the possession or control of ( name of the person ) on ( specify the dates to be specified in the order ), will afford evidence respecting the commission of the offence ( and if applicable , and that the information contained in all reports made under any of sections 7, 7.1 and 9 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act during the period the order is to be in effect will afford evidence respecting the commission of the offence). (or) (b) ( if the application is for an order under section 487.0142 of the Criminal Code ) that subscriber information is in the possession or control of ( name of the person ) and will assist in the investigation of the offence. (or) (b) ( if the application is for an order under section 487.015 of the Criminal Code ) that the identification of a device or person involved in the transmission of ( specify the communication ) will assist in the investigation of the offence and that ( specify the transmission data ) that is in the possession or control of one or more persons whose identity is unknown will enable that identification. (or) (b) ( if the application is for an order under section 487.016 of the Criminal Code ) that ( specify the transmission data ) is in the possession or control of ( name of the person ) and will assist in the investigation of the offence. (or) (b) ( if the application is for an order under section 487.017 of the Criminal Code ) that ( specify the tracking data ) is in the possession or control of ( name of the person ) and will assist in the investigation of the offence. (or) (b) ( if the application is for an order under section 487.018 of the Criminal Code ) that ( specify the data ) is in the possession or control of ( name of the financial institution, person or entity ) and will assist in the investigation of the offence. The reasonable grounds are: The informant therefore requests ( if the application is for an order under section 487.014 of the Criminal Code ) that ( name of the person ) be ordered to produce a document that is a copy of ( specify the document ) that is in their possession or control when they receive the order ( and/or to prepare and produce a document containing ( specify the data ) that is in their possession or control when they receive the order). (or) ( if the application is for an order under section 487.0141 of the Criminal Code ) that ( name of the person ) be ordered to produce a document that is a copy of ( specify the document ) that is in their possession or control on ( specify the dates to be specified in the order ) ( and/or to prepare and produce a document containing ( specify the data ) that is in their possession or control on ( specify the dates to be specified in the order )) ( and if applicable , and that the person be ordered to produce a copy of all reports made under any of sections 7, 7.1 and 9 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act during the period the order is to be in effect). (or) ( if the application is for an order under section 487.0142 of the Criminal Code ) that ( name of the person ) be ordered to prepare and produce a document containing all the subscriber information that is in their possession or control when they receive the order that relates to ( specify information ). (or) ( if the application is for an order under section 487.015 of the Criminal Code ) that a person who is served with the order in accordance with subsection 487.015(4) of the Criminal Code be ordered to prepare and produce a document containing ( specify the transmission data ) that is in their possession or control when they are served with the order. (or) ( if the application is for an order under section 487.016 of the Criminal Code ) that ( name of the person ) be ordered to prepare and produce a document containing ( specify the transmission data ) that is in their possession or control when they receive the order. (or) ( if the application is for an order under section 487.017 of the Criminal Code ) that ( name of the person ) be ordered to prepare and produce a document containing ( specify the tracking data ) that is in their possession or control when they receive the order. (or) ( if the application is for an order under section 487.018 of the Criminal Code ) that ( name of the financial institution, person or entity ) be ordered to prepare and produce a document setting out ( specify the data ) that is in their possession or control when they receive the order. Sworn before me on ( date ), at ( place ). ( Signature of informant ) ( Signature of justice or judge ) 25 Part XXVIII of the Act is amended by adding the following after Form 5.0051: FORM 5.0052 (Subsection 487.0142(3)) Production Order — Subscriber Information Canada, Province of ( territorial division ) To ( name of person ), of : Whereas I am satisfied by information on oath of ( name of peace officer or public officer ), of , that there are reasonable grounds to suspect that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ) and that subscriber information is in your possession or control and will assist in the investigation of the offence; Therefore, you are ordered to produce a document that is a copy of ( specify the document ) that is in your possession or control when you receive this order ( and/or ) prepare and produce a document containing all the subscriber information that is in your possession or control when you receive this order and that relates to ( specify information ). The document must be produced to ( name of peace officer or public officer ) within ( time ) at ( place ) in ( form ). This order is subject to the following conditions: ( specify any conditions to which the demand is subject ). You have the right to apply to revoke or vary this order. If you contravene this order without lawful excuse, you may be subject to a fine, to imprisonment or to both. Dated ( date ), at ( place ). ( Signature of justice or judge ) 26 Part XXVIII of the Act is amended by adding the following after Form 5.008: FORM 5.00801 (Subsection 487.0181(2)) Information to Obtain an Authorization Canada, Province of ( territorial division ) This is the information of ( name of peace officer or public officer ), of (“the informant”). The informant says that they have reasonable grounds to suspect (a) that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ); and (b) that ( specify the transmission data or the subscriber information ) is in the possession or control of ( name of the foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public ) and will assist in the investigation of the offence. The reasonable grounds are: The informant therefore requests that a peace officer or public officer be authorized to request that ( name of the foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public ) prepare and produce a document containing ( specify the transmission data or the subscriber information ) that is in its possession or control when it receives the request. Sworn before me on ( date ), at ( place ). ( Signature of informant ) ( Signature of justice or judge ) FORM 5.00802 (Subsection 487.0181(3)) Authorization to Request Production of Transmission Data or Subscriber Information Canada, Province of ( territorial division ) Whereas I am satisfied by information on oath of ( name of peace officer or public officer ), of , that there are reasonable grounds to suspect (a) that an offence has been or will be committed under ( specify the provision of the Criminal Code or other Act of Parliament ); and (b) that ( specify the transmission data or the subscriber information ) is in the possession or control of ( name of the foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public ) and the data or information will assist in the investigation of the offence. Therefore, a peace officer or public officer is authorized to request that ( name of the foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public ) prepare and produce a document containing ( specify the transmission data or the subscriber information ) that is in its possession or control when it receives the request. A peace officer or public officer must not send the production request more than 30 days after the day on which this authorization is granted. Dated ( date ), at ( place ). ( Signature of justice or judge ) FORM 5.00803 (Subsection 487.0181(4)) Production Request for Transmission Data or Subscriber Information Canada, Province of To ( name of foreign entity that provides telecommunications services — or that provides services by a means of telecommunication — to the public ), of : This is a production request of ( name of peace officer or public officer ), of . Whereas I am authorized to make this request by a justice or judge under section 487.0181 of the Criminal Code ( attach authorization ). Therefore, I request that you prepare and produce a document containing ( specify the transmission data or the subscriber information ) that is in your possession or control when you receive this request. I request that you produce this document to ( recipient ) in ( form ). ( Specify any information that may be included under subsection 487.0181(4) of the Criminal Code , if applicable .) Dated ( date ), at ( place ). ( Signature of peace officer or public officer ) 27 Forms 5.009 and 5.0091 of Part XXVIII of the Act are replaced by the following: FORM 5.009 (Subsection 487.0191(2)) Information to Obtain a Non-Disclosure Order Canada, Province of ( territorial division ) This is the information of ( name of peace officer or public officer ), of (“the informant”). The informant says that they have reasonable grounds to believe that the disclosure of the existence (or any of the contents or any of the following portion or portions) of ( identify the preservation demand made under section 487.012 of the Criminal Code , the confirmation of service demand made under section 487.0121 of that Act or the order made under any of sections 487.013 to 487.018 of that Act, as the case may be ) during ( identify the period ) would jeopardize the conduct of the investigation of the offence to which it relates: ( specify portion or portions ) The reasonable grounds are: The informant therefore requests an order prohibiting ( name of the person, financial institution or entity ) from disclosing the existence (or any of the contents or any of the specified portion or portions) of the demand (or the order) during a period of ( identify the period ) after the day on which the order is made. Sworn before me on ( date ), at ( place ). ( Signature of informant ) ( Signature of justice or judge ) FORM 5.0091 (Subsection 487.0191(3)) Non-Disclosure Order Canada, Province of ( territorial division ) To ( name of person, financial institution or entity ), of : Whereas I am satisfied by information on oath of ( name of peace officer or public officer ), of , that there are reasonable grounds to believe that the disclosure of the existence (or any of the contents or any of the portion or portions, specified in the information,) of ( identify the preservation demand made under section 487.012 of the Criminal Code , the confirmation of service demand made under section 487.0121 of that Act or the order made under any of sections 487.013 to 487.018 of that Act, as the case may be ) during ( identify the period ) would jeopardize the conduct of the investigation of the offence to which it relates; Therefore, you are prohibited from disclosing the existence (or any of the contents or any of the following portion or portions) of the demand (or the order) during a period of ( identify the period ) after the day on which this order is made. ( specify portion or portions ) You have the right to apply to revoke or vary this order. If you contravene this order without lawful excuse, you may be subject to a fine, to imprisonment or to both. Dated ( date ), at ( place ). ( Signature of justice or judge ) 1999, c. 23 Consequential Amendment to the Foreign Publishers Advertising Services Act 28 Subsection 5(1) of the Foreign Publishers Advertising Services Act is amended by replacing “section 487” with “subsection 487(1)”. R.S., c. 30 (4th Supp.) Mutual Legal Assistance in Criminal Matters Act 29 The Mutual Legal Assistance in Criminal Matters Act is amended by adding the following after section 22.06: Enforcement of Foreign Decisions for Production Request to Minister 22.07 (1) When a written request is presented to the Minister by a state or entity for the enforcement in Canada of a decision made by an authority of that state or entity that is empowered to compel the production of transmission data or subscriber information that is in the possession or control of a person in Canada, the Minister may authorize a competent authority to make arrangements for the enforcement of the decision. Application for enforcement (2) The competent authority must apply ex parte for the enforcement of the decision to a justice , as defined in section 2 of the Criminal Code , a judge of a superior court of criminal jurisdiction , as defined in that section, or a judge of the Court of Quebec. Enforcement (3) The justice or judge to whom the application is made may make the decision enforceable if they are satisfied that (a) in the case of transmission data, the conditions set out in subsection 487.016(2) of the Criminal Code , with any necessary modifications, are met; or (b) in the case of subscriber information, the conditions set out in subsection 487.0142(2) of the Criminal Code, with any necessary modifications, are met. A decision that is made enforceable is deemed to be a judgment of the court to which the judge or justice belongs and may be executed anywhere in Canada. Designated person (4) The justice or judge who makes the decision enforceable under subsection (3) must designate a person to whom a record containing the transmission data or the subscriber information must be produced by the person in Canada referred to in the decision. Timing (5) The justice or judge must order that the person in Canada referred to in the decision produce the record containing the transmission data or the subscriber information to the designated person (a) no later than 45 days after the day on which the decision is served, in the case of transmission data; or (b) no later than 20 days after the day on which the decision is served, in the case of subscriber information. Order prohibiting disclosure (6) Section 487.0191 of the Criminal Code applies, with any necessary modifications, in respect of a decision made enforceable under subsection (3) and an order made under subsection (5). Sending abroad (7) The justice or judge must also order (a) that the designated person send the record containing the transmission data or the subscriber information directly to the state or entity referred to in subsection (1) that made the request; or (b) that sections 20 and 21 apply to the sending of the record containing the transmission data or the subscriber information, with any necessary modifications. Report (8) The designated person must (a) make a report concerning the execution of the decision to the justice or judge who made it enforceable —  or to another justice for the same territorial division or another judge in the judicial district where the decision was made enforceable —  accompanied by a general description of the transmission data or the subscriber information contained in the record and, if the justice or judge requires it, the record containing the transmission data or the subscriber information; and (b) send a copy of the report to the Minister without delay. Timing of report and sending abroad (9) If the justice or judge makes an order under paragraph (7)(a), the designated person must make the report to the justice or judge and send the record containing the transmission data or the subscriber information to the state or entity that made the request no later than five days after the day on which the record was produced under subsection (5). Offence (10) Section 487.0198 of the Criminal Code applies with respect to an order made under subsection (5). Definitions (11) In this section, transmission data and subscriber information have the same meaning as in section 487.011 of the Criminal Code . R.S., c. C- 23 Canadian Security Intelligence Service Act 30 The heading of Part II of the Canadian Security Intelligence Service Act is replaced by the following: Confirmation of Service Demand and Judicial Control 31 The Act is amended by adding the following before section 20.3: Definition of telecommunications service provider 20. 21 In sections 20.22 to 20.26 and 20.5, telecommunications service provider has the same meaning as in subsection 2(1) of the Telecommunications Act . Confirmation of service demand 20.22 (1) For the purpose of performing its duties and functions under section 12 or 16, the Service may make a demand in Form 0.1 of Schedule 2 to a telecommunications service provider requiring them to confirm, within the time and in the manner specified in the demand, whether or not they provide or have provided services to any subscriber or client, or to any account or identifier, specified in the demand. Medical and privileged information (2) For greater certainty, a demand must not be made if the confirmation would disclose medical information or information that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries. Time (3) The time specified in the demand is to be not less than 24 hours. Non-disclosure (4) The Service may impose conditions in the demand prohibiting the disclosure of its existence or some or all of its contents. Obligation to comply (5) The telecommunications service provider must comply with the demand. Section 126 of the Criminal Code does not apply in respect of a contravention of this subsection. Revocation of demand (6) The Service may, at any time, revoke the demand or a condition by notice given to the telecommunications service provider. Revocation or variation of confirmation of service demand 20.23 (1) Before a telecommunications service provider is required to provide the confirmation required by a demand made under section 20.22, but not later than five business days after the day on which they receive the demand, they may apply in writing to a judge to revoke or vary the demand. Notice required (2) The telecommunications service provider may make the application only if, before the application is made, they give notice of their intention to do so to an employee in the manner specified in the demand and to a judge in Form 0.2 of Schedule 2. No obligation to provide confirmation (3) The telecommunications service provider is not required to provide the confirmation until a final decision is made with respect to the application. Revocation or variation of demand (4) The judge may revoke or vary the demand if satisfied that (a) it is unreasonable in the circumstances to require the applicant to provide the confirmation; or (b) provision of the confirmation would disclose information that is privileged or otherwise protected from disclosure by law. Application for order 20.24 (1) If a telecommunications service provider fails to comply with a confirmation of service demand made under section 20.22, the Director or an employee who is designated by the Director for the purpose may make an application to a judge for an order under this section. Making of order (2) The judge may order the telecommunications service provider to provide, within the time and in the manner specified in the order, the confirmation referred to in subsection 20.22(1) if the judge is satisfied that the confirmation will assist the Service to perform its duties and functions under section 12 or 16. Measures (3) The judge may include in the order any measure that they consider necessary in the public interest, including to ensure the confidentiality of the order. Clarification — voluntary provision of confirmation 20.25 (1) For greater certainty, the Service may request that a telecommunications service provider voluntarily provide the confirmation required by a confirmation of service demand made under section 20.22 or by an order made under section 20.24, without such a demand or such an order having been made, so long as the telecommunications service provider is not prohibited by law from providing the confirmation, and the Service may collect it under section 12 or 16. Clarification — other collection authorities (2) For greater certainty, the fact that a confirmation of service demand may be made under section 20.22 or that an order may be made under section 20.24 does not affect the Service’s authority to collect any information under any other provision of this Act. No civil or criminal liability 20. 26 No criminal or civil proceedings lie against a telecommunications service provider that voluntarily provides a confirmation following a request from the Service made in the circumstances described in subsection 20.25(1) or against a person acting on behalf of a telecommunications service provider that receives such a request. 32 (1) Subsections 20.5(1) to (3) of the Act are replaced by the following: Revocation or variation — sections 20.24 and 20.4 20.5 (1) Before a telecommunications service provider is required to provide a confirmation under an order made under section 20.24, or a person or entity is required to produce any information, record or document under an order made under section 20.4, but no later than 10 business days after the day on which they receive the order, the telecommunications service provider or the person or entity, as the case may be , may apply in writing to a judge to revoke or vary the order. Notice required (2) The telecommunications service provider , person or entity may make the application only if, before the application is made, they give notice of their intention to do so to a judge and to an employee in Form 5 of Schedule 2. No obligation to provide or produce (3) The telecommunications service provider , person or entity is not required to provide the confirmation or to produce the information, record or document, as the case may be , until a final decision is made with respect to the application. (2) Paragraphs 20.5(4)(a) and (b) of the Act are replaced by the following: (a) it is unreasonable in the circumstances to require the applicant to provide the confirmation or produce the information, record or document; or (b) provision of the confirmation or production of the information, record or document would disclose information that is privileged or otherwise protected from disclosure by law. 33 Section 27 of the Act is replaced by the following: Making and hearing of applications 27 (1) An application for a judicial authorization under section 11.13, an application for an order under section 20.24 , an application under section 20.3 for a preservation order, an application under section 20.4 for a production order, an application under section 21, 21.1, 22.21 or 23 for a warrant, an application under section 22 or 22.1 for the renewal of a warrant or an application for an order under section 22.3 shall be made ex parte and heard in private in accordance with regulations made under section 28. Making and hearing of applications — sections 20.23 and 20.5 (2) An application under section 20.23 for the revocation or variation of a confirmation of service demand or under section 20.5 for the revocation or variation of an order made under section 20.24 or a production order shall be made and heard in accordance with regulations made under section 28 and may be heard in private in accordance with those regulations . 34 (1) Paragraph 28(b) of the Act is replaced by the following: (b) governing the practice and procedure of, and security requirements applicable to, hearings of applications for judicial authorization under section 11.13, for warrants that may be issued under section 21, 21.1, 22.21 or 23, for renewals of those warrants and for orders that may be made under section 20.24 , 20.3, 20.4 or 22.3; (2) Paragraph 28(b.2) of the Act is replaced by the following: (b.2) governing the practice and procedure of, and security requirements applicable to, the making of applications for the revocation or variation of a confirmation of service demand under section 20.22, an order under section 22.24 or a production order under section 20.5 and hearings of such applications ; and 35 Schedule 2 to the Act is amended by adding the following before Form 1: FORM 0.1 (Subsection 20.22(1)) Confirmation of Service Demand To ( name of person or entity ), of : You are required under section 20.22 of the Canadian Security Intelligence Service Act to confirm, as soon as possible, but not later than ( specify time by which the confirmation is to be provided ), whether or not you provide or have provided telecommunication services to ( specify subscriber or client, or account or identifier ), unless this demand is revoked. The confirmation must be provided ( specify the form and manner ). This demand is subject to the following conditions: ( specify conditions, if any ) You have the right to apply to revoke or vary this confirmation of service demand in accordance with section 20.23 of the Canadian Security Intelligence Service Act . FORM 0.2 (Subsection 20.23(2)) Notice — Application for Revocation or Variation of a Confirmation of Service Demand FEDERAL COURT IN THE MATTER OF an application by ( Name ) for the revocation or variation of a confirmation of service demand under section 20.23 of the Canadian Security Intelligence Service Act , R.S.C. 1985, c. C- 23 NOTICE This is a notice that ( name of telecommunications service provider named in the confirmation of service demand ) (“the applicant”) intends to apply to the Federal Court for the revocation or variation of the confirmation of service demand made on ( date ). Notice of the applicant’s intention has been provided to an employee of the Canadian Security Intelligence Service on ( date ). The applicant intends to file the application for revocation or variation on or before ( date ). Dated ( date ), at ( place ). ( Signature of applicant ) 36 Form 5 of Schedule 2 to the Act is replaced by the following: FORM 5 (Subsection 20.5(2)) Notice — Application for Revocation or Variation of an Order Under Section 20.24 or a Production Order (Court File No. — to match order under section 20.24 or production order) FEDERAL COURT IN THE MATTER OF an application by ( Name ) for the revocation or variation of an order under section 20.24 or a production order under section 20.5 of the Canadian Security Intelligence Service Act , R.S.C. 1985, c. C- 23 NOTICE This is a notice that ( name of telecommunications service provider , person or entity named in the order ) (“the applicant”) intends to apply to the Federal Court for the revocation or variation of the ( specify: order under section 20.24 or production order) made on ( date ) and received by the applicant on ( date ). A copy of this notice has been provided to an employee of the Canadian Security Intelligence Service on ( date ). The applicant intends to file the application for revocation or variation on or before ( date ). Dated ( date ), at ( place ). ( Signature of applicant ) 1996, c. 19 Controlled Drugs and Substances Act 37 Section 11 of the Controlled Drugs and Substances Act is amended by adding the following after subsection (3): Computer data (3.1) Subsections 487(2.1) to (2.3) and (2.5) to (2.9) of the Criminal Code apply, with any modifications that the circumstances require, with respect to a warrant issued under subsection (1). 2018, c. 16 Cannabis Act 38 Section 87 of the Cannabis Act is amended by adding the following after subsection (3): Computer data (3.1) Subsections 487(2.1) to (2.3) and (2.5) to (2.9) of the Criminal Code apply, with any modifications that the circumstances require, with respect to a warrant issued under subsection (1). Coordinating Amendments Bill C-16 39 (1) Subsections (2) to (4) apply if Bill C-16, introduced in the 1st session of the 45th Parliament and entitled the Protecting Victims Act (in this section referred to as the “other Act”), receives royal assent. (2) If section 43 of the other Act comes into force before section 17 of this Act, then that section 17 is repealed. (3) If section 17 of this Act comes into force before section 43 of the other Act, then that section 43 is repealed. (4) If section 43 of the other Act and section 17 of this Act come into force on the same day, then that section 17 is deemed never to have come into force and is repealed. Coming into Force 180th day after royal assent 40 This Part, other than section 39 , comes into force on the 180th day after the day on which this Act receives royal assent. PART 2 Supporting Authorized Access to Information Act Enactment of Act Enactment 41 The Supporting Authorized Access to Information Act , whose text is as follows and whose schedule is set out in the schedule to this Act, is enacted: An Act respecting the obligations of electronic service providers in relation to authorized access to information Short Title Short title 1 This Act may be cited as the Supporting Authorized Access to Information Act . Interpretation Definitions 2 (1) The following definitions apply in this Act. access , in relation to information, includes obtaining a document containing information and, with respect to information related to a communication, intercepting the communication within the meaning of section 183 of the Criminal Code . ( accès ) authorized person  means a person having authority under the Criminal Code or the Canadian Security Intelligence Service Act to access information. ( personne autorisée ) core provider  means an electronic service provider belonging to a class of electronic service providers set out in the schedule. ( fournisseur principal ) electronic protection  means authentication, encryption and any other prescribed type of data protection. ( protection électronique ) electronic service  means a service, or a feature of a service, that involves the creation, recording, storage, processing, transmission, reception, emission or making available of information in electronic, digital or any other intangible form by an electronic, digital, magnetic, optical, biometric, acoustic or other technological means, or a combination of any such means. ( service électronique ) electronic service provider  means a person that, individually or as part of a group, provides an electronic service, including for the purpose of enabling communications, and that (a) provides the service to persons in Canada; or (b) carries on all or part of its business activities in Canada. ( fournisseur de services électroniques ) information  includes any information, intelligence or data to which access may be authorized under the Criminal Code or the Canadian Security Intelligence Service Act . ( information ) Minister  means the Minister of Public Safety and Emergency Preparedness. ( ministre ) person  includes a corporation, a trust, a partnership, a fund, a joint venture, a government, a government agency, an unincorporated association or organization and any other legal entity . ( personne ) prescribed  means prescribed by the regulations. ( Version anglaise seulement ) systemic vulnerability  means a vulnerability in the electronic protections of an electronic service that creates a substantial risk that secure information could be accessed by a person who does not have any right or authority to do so. ( vulnérabilité systémique ) Preservation of existing authorities (2) Nothing in this Act derogates from any authority to access information conferred under the Criminal Code or the Canadian Security Intelligence Service Act — or from any similar authority conferred under another Act of Parliament — or from any corresponding obligation imposed on an electronic service provider to assist in a person’s exercise of such an authority. Preservation of agreements and arrangements (3) Nothing in this Act derogates from any agreement or arrangement between an electronic service provider and a national security or law enforcement agency with respect to assistance to be provided to an authorized person in the exercise of the person’s authority to access information, nor prevents entry into such an agreement or arrangement. Purpose Purpose 3 The purpose of this Act is to ensure that electronic service providers can facilitate the exercise of authorities to access information that are conferred on authorized persons. His Majesty Binding on His Majesty 4 This Act is binding on His Majesty in right of Canada or of a province. Core Providers Core providers — classes 5 (1) The Governor in Council may, by regulation, amend the schedule by adding, amending or deleting a class of electronic service providers. Core providers — obligations (2) The Governor in Council may make regulations respecting the obligations of core providers, including regulations respecting (a) the development, implementation, assessment, testing and maintenance of operational and technical capabilities, including capabilities related to extracting and organizing information that is authorized to be accessed and to providing access to such information to authorized persons; (b) the installation, use, operation, management, assessment, testing and maintenance of any device, equipment or other thing that may enable an authorized person to access information; (c) notices to be given to the Minister or other persons, including with respect to any capability referred to in paragraph (a) and any device, equipment or other thing referred to in paragraph (b); and (d) the retention of categories of metadata — including transmission data , as defined in section 487.011 of the Criminal Code — for reasonable periods of time not exceeding one year. Factors (3) In making a regulation under subsection (2), the Governor in Council must take into account the following factors: (a) the benefits of the regulation to the administration of justice, in particular to investigations under the Criminal Code , and to the exercise of powers and the performance of duties and functions under the Canadian Security Intelligence Service Act ; (b) the feasibility of compliance with the regulation for the core providers; (c) the costs to be incurred by the core providers to ensure compliance with the regulation; (d) the potential impact of the regulation on the persons to whom the core providers provide services; (e) the potential impact of the regulation on privacy protection and cybersecurity; and (f) any other factor that the Governor in Council considers relevant. Restrictions (4) Paragraph (2)(d) does not authorize the making of regulations that require core providers to retain information that would reveal (a) the content — that is to say the substance, meaning or purpose — of information transmitted in the course of an electronic service; (b) a person’s web browsing history; or (c) a person’s social media activities. Systemic vulnerability (5) A core provider is not required to comply with a provision of a regulation made under subsection (2), with respect to an electronic service, if compliance with that provision would require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability. Temporary exemption 6 (1) On application by a core provider, the Minister may, by order and on any terms that the Minister considers necessary, exempt the core provider, for a specified period, from the application of any provision of a regulation made under subsection 5 (2). Application (2) The application must be submitted in the form and manner specified by the Minister and must contain (a) the provision with respect to which the exemption is sought; (b) a proposed period for the exemption; (c) a rationale explaining why the core provider requires the exemption; (d) a plan setting out the measures that the core provider intends to take to comply with the provision within the period referred to in paragraph (b); and (e) any other information specified by the Minister. Pending application (3) The provision with respect to which the exemption is sought does not apply to the core provider pending the determination of the application. Decision (4) As soon as feasible after the application is submitted, the Minister must make a decision in respect of it and give written notice of the decision to the core provider. Denial of application (5) In a decision to deny the application, the Minister may specify the day by which the core provider must comply with the provision with respect to which the application was denied. Statutory Instruments Act (6) The Statutory Instruments Act does not apply to an order made under subsection (1). Ministerial Orders Order 7 (1) Subject to section 8 , the Minister may make an order with respect to an electronic service provider and the order may contain any provision that may be contained in a regulation made under subsection 5 (2), whether or not the provider is a core provider. The order must specify the period during which it has effect. Approval of Intelligence Commissioner (2) The order is valid when — if it is approved by the Intelligence Commissioner under paragraph 20(1)(a) of the Intelligence Commissioner Act — the Intelligence Commissioner provides the Minister with the written decision approving the order. Factors (3) In making the order, the Minister must take into account the following factors: (a) the benefits of the order to the administration of justice, in particular to investigations under the Criminal Code , and to the exercise of powers and the performance of duties and functions under the Canadian Security Intelligence Service Act ; (b) the feasibility of compliance with the order for the electronic service provider; (c) the costs to be incurred by the electronic service provider to ensure compliance with the order; (d) the potential impact of the order on the persons to whom the electronic service provider provides services; (e) the potential impact of the order on privacy protection and cybersecurity; and (f) any other factor that the Minister considers relevant. Discretionary compensation (4) For the purpose of offsetting all or part of the costs referred to in paragraph (3)(c), in the order, the Minister may provide for compensation to be paid to the electronic service provider in an amount that the Minister considers appropriate and may include provisions with respect to the time and manner of payment. Systemic vulnerability (5) The electronic service provider is not required to comply with a provision of the order, with respect to an electronic service, if compliance with that provision would require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability. Statutory Instruments Act (6) The Statutory Instruments Act does not apply to an order made under subsection (1). Representations 8 Before making an order under subsection 7 (1), the Minister must provide the electronic service provider with an opportunity to make representations. Intelligence Commissioner 9 (1) The Minister must provide a copy of any order made under subsection 7 (1) to the Intelligence Commissioner for the purposes of the Intelligence Commissioner’s review and approval under the Intelligence Commissioner Act . Notice (2) The copy of the order constitutes notice of the order for the purposes of calculating the time limit referred to in paragraph 20(3)(b) of the Intelligence Commissioner Act . Duration 10 (1) Unless revoked, an order made under subsection 7 (1) has effect for the period specified in the order. Non-application (2) Subsection 7 (2) and sections 8 and 9 do not apply in respect of an order that only revokes another order made under subsection 7 (1) or only extends the period specified in another order made under subsection 7 (1). Review 11 (1) Before the order expires, the Minister must review the order to determine whether, taking into account the factors referred to in subsection 7 (3), the period specified in it should be extended. New information (2) Before the order expires, an electronic service provider subject to it may submit to the Minister any information that is relevant to the review. Compliance with order 12 An electronic service provider that is subject to an order made under subsection 7 (1) must comply with it. Order prevails 13 An order made under subsection 7 (1) prevails over any regulation made under subsection 5 (2) to the extent of any inconsistency. Obligation to Assist Obligation to assist 14 (1) On request made by the Minister, an electronic service provider must provide all reasonable assistance to a person or class of persons specified in the request to permit the assessment or testing of any device, equipment or other thing that may enable an authorized person to access information. Persons to be assisted (2) Only the following persons or classes of persons may receive assistance: (a) the Minister; (b) an employee of the Canadian Security Intelligence Service; (c) a person appointed or employed under Part I of the Royal Canadian Mounted Police Act or a civilian employee referred to in section 10 of that Act; (d) a civilian employee of another police force; (e) a peace officer , as defined in section 2 of the Criminal Code . Request (3) The request must be in writing and set out the purpose of the assessment or testing and any limits and conditions that the Minister considers appropriate. For greater certainty (4) For greater certainty, the assessment or testing must not have the effect of granting access to personal information. Confidentiality Prohibition on disclosure 15 An electronic service provider and any person acting on its behalf must not disclose any of the following information except as permitted under this Act or the Canada Evidence Act : (a) information contained in an order made under subsection 6 (1) or 7 (1); (b) information on which the Minister relied in making the order; (c) the fact that the electronic service provider is subject to the order; (d) information provided in the course of representations made under section 8 or in any response given by the Minister and the fact that the Minister has invited the representations; (e) information contained in an application referred to in subsection 6 (1) or in a decision made under subsection 6 (4); (f) information submitted under subsection 11 (2) and any information received from the Minister in response; (g) any prescribed information. Confidential information 16 The following information is confidential and must, subject to the regulations, be treated accordingly by a person designated under subsection 19 (1): (a) information obtained by the designated person in the course of exercising their powers or performing their duties and functions under sections 20 and 21 ; and (b) information contained in an audit report referred to in section 23 . Judicial review — notice to Minister 17 (1) An electronic service provider is not to make an application for judicial review in respect of an order or decision made under this Act unless, at least 15 days before making the application, it provides written notice to the Minister, including a copy of the notice of application. For greater certainty (2) For greater certainty, the Federal Court has exclusive jurisdiction to hear applications for judicial review in respect of any order or decision made under this Act. Regulations — confidentiality and security 18 The Governor in Council may make regulations respecting confidentiality and security requirements with which electronic service providers and persons acting on their behalf must comply, including regulations (a) respecting the disclosure of information referred to in section 15 or 16 ; (b) establishing rules of procedure for the protection of information referred to in section 15 or 16 in administrative or judicial proceedings; (c) respecting requirements related to employees of electronic service providers and other persons whose services may be engaged by electronic service providers — who participate in activities in relation to requests for access to information that is authorized under the Criminal Code or the Canadian Security Intelligence Service Act or in relation to compliance with this Act — including with respect to their security clearance and location; and (d) respecting security requirements with respect to the facilities and premises of electronic service providers that are used for storing, processing or transmitting information that is related to — or that may be the subject of — requests for access to information that is authorized under the Criminal Code or the Canadian Security Intelligence Service Act . Administration and Enforcement Designation Designation 19 (1) The Minister may, subject to any restrictions or conditions that the Minister may specify, designate persons or classes of persons for the purposes of the administration and enforcement of this Act. Certificate (2) The Minister must provide every designated person with a certificate attesting to their designation. Inspections Authority to enter place 20 (1) Subject to subsection 21 (1), a designated person may, for the purpose of verifying compliance or preventing non-compliance with this Act, at any reasonable time enter any place if they have reasonable grounds to believe that anything relevant to that purpose, including any document or electronic data, is located in that place or that an activity regulated by this Act is conducted in that place. Production of certificate (2) On entering a place referred to in subsection (1), the designated person must, on request, produce the certificate attesting to their designation to the person in charge of the place. Powers on entry (3) The designated person may, for a purpose referred to in subsection (1), (a) examine anything found in the place, including any document or electronic data; (b) make copies of any document or electronic data that is found in the place or take extracts from the document or electronic data; (c) remove any document found in the place for examination or copying; (d) use or cause to be used any computer or data processing system at the place to examine or copy electronic data; and (e) use or cause to be used any copying equipment at the place to make copies of any document. Return of items (4) If the designated person removes a document under paragraph (3)(c), they must return it to its owner or the person in charge of it on completion of the examination or copying. Duty to assist (5) Every owner or person in charge of a place that is entered by the designated person and every person found in the place must give all assistance that is reasonably required to enable the designated person to exercise their powers or perform their duties and functions under this section and provide the designated person with any document or electronic data that they may reasonably require. Persons accompanying (6) The designated person may be accompanied by any other person that the designated person believes is necessary to help them exercise their powers or perform their duties and functions under this section. Entering private property (7) The designated person and any person accompanying them may enter and pass through private property, other than a dwelling-house on that property, to gain entry to a place referred to in subsection (1). For greater certainty, they are not liable for doing so. Dwelling-house 21 (1) In the case of a dwelling-house, a designated person is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2). Authority to issue warrant (2) A justice of the peace may, on ex parte application, issue a warrant authorizing the designated person named in it to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that (a) the dwelling-house is a place referred to in subsection 20 (1); (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 20 (1); and (c) entry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant. Use of force (3) In executing the warrant, the designated person is not entitled to use force unless the use of force is specifically authorized in the warrant and they are accompanied by a peace officer. Internal Audit Audit order 22 (1) Subject to the regulations, a designated person may, for a purpose related to verifying compliance or preventing non-compliance with this Act, make an order in writing requiring an electronic service provider to conduct, within the time and in the manner specified in the order, an internal audit of its practices, documents and electronic data to determine whether it is in compliance with any provision of this Act or the regulations. Statutory Instruments Act (2) The Statutory Instruments Act does not apply to an order made under subsection (1). Compliance with order 23 The electronic service provider must comply with the order and provide to the designated person, within the period specified in the order, a report of the results of the audit, including, if the electronic service provider determines that there is non-compliance with a provision of this Act or the regulations, the nature of the non-compliance and any measures that it has taken or will take to comply with the provision or the order. Compliance Order Power to order termination of contravention 24 (1) If a designated person believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, they may make an order in writing requiring an electronic service provider to (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or (b) take any measure that is necessary to comply with the requirements of that provision or mitigate the effects of non-compliance. Time and manner for review (2) The order must specify the time within which and the manner in which the electronic service provider may request a review of the order by the Minister. Statutory Instruments Act (3) The Statutory Instruments Act does not apply to an order made under subsection (1). Compliance with order 25 (1) An electronic service provider that is subject to an order made under subsection 24 (1) must comply with it. Notification of compliance (2) Once the electronic service provider complies with the order, it must notify the designated person of its compliance without delay. Request for review 26 (1) An order that is made under subsection 24 (1) must be reviewed by the Minister at the written request of the electronic service provider that is subject to the order. Time and manner of request (2) The request must be made within the time and in the manner specified in the order and must state the grounds for review and set out the evidence that supports those grounds. Order in effect (3) The order continues to apply during a review unless the Minister decides otherwise. Decision on completion of review 27 (1) On completion of a review, the Minister must confirm, amend, revoke or cancel the order and provide notice of the decision and the reasons for the decision to the electronic service provider. Deemed confirmation (2) If the Minister does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Minister and the electronic service provider, the Minister is deemed to have confirmed the order. Administrative Monetary Penalties Violations Purpose of penalty 28 The purpose of an administrative monetary penalty is to promote compliance with this Act and not to punish. Commission of violations 29 (1) A person who contravenes any of the following provisions commits a violation and is liable to a penalty of an amount that is to be established by a designated person in accordance with the regulations: (a) section 12 , subsection 14 (1), section 15 , subsection 20 (5), section 23 or subsection 25 (1) or (2); (b) a provision of the regulations designated by a regulation made under paragraph 47 (1)(e). Maximum penalty (2) The maximum penalty for a violation is $50,000 in the case of an individual and $250,000 in the case of any other person. Continuing violation (3) A violation that is committed or continued on more than one day constitutes a separate violation in respect of each day on which it is committed or continued. Due diligence defence (4) A person is not to be found liable for a violation if they establish that they exercised due diligence to prevent its commission. Common law principles (5) Every rule and principle of the common law that renders any circumstance a justification or excuse in relation to a charge for an offence under this Act applies in respect of a violation to the extent that it is not inconsistent with this Act. Proof of violation 30 In any proceedings under this Act against a person in relation to a violation, it is sufficient proof of the violation to establish that the act or omission that constitutes the violation was committed by an employee or an agent or mandatary of the person, whether or not the employee or agent or mandatary is identified. Violation by corporate officers, etc. 31 If a person other than an individual commits a violation under this Act, any of the person’s directors, officers or agents or mandataries who directed, authorized, assented to, acquiesced in or participated in the commission of the violation is a party to and liable for the violation, whether or not the person who actually committed the violation is proceeded against under this Act. Proceedings Issuance of notice of violation 32 If a designated person believes on reasonable grounds that a person has committed a violation, the designated person may issue, and must serve the person with, a notice of violation. Limitation or prescription period 33 (1) A notice of violation is not to be issued in respect of a violation more than two years after the day on which the Minister becomes aware of the acts or omissions that constitute the alleged violation. Certification by Minister (2) A document appearing to have been issued by the Minister, certifying the day on which the acts or omissions that constitute the alleged violation became known to the Minister, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and, in the absence of evidence to the contrary, is proof that the Minister became aware of the acts or omissions on that day. How act or omission may be proceeded with 34 If an act or omission may be proceeded with either as a violation or as an offence, proceeding in one manner precludes proceeding in the other. Payment of Penalties and Alternatives to Payment Effect of payment 35 (1) If a person named in a notice of violation pays, in the prescribed time and manner, the penalty set out in the notice of violation, (a) they are deemed to have committed the violation in respect of which the amount is paid; (b) the Minister must accept that amount as complete satisfaction of the penalty; and (c) the proceedings commenced in respect of the violation are ended. Alternatives to payment (2) Instead of paying the penalty, the person may, in the prescribed time and manner, (a) request to enter into a compliance agreement with the Minister that ensures the person’s compliance with the provision to which the violation relates; or (b) request a review by the Minister of the acts or omissions that constitute the alleged violation or the amount of the penalty. Failure to act (3) If the person does not pay the penalty in the prescribed time and manner and does not make one of the requests referred to in subsection (2) in the prescribed time and manner, they are deemed to have committed the violation identified in the notice. Compliance Agreements Compliance agreements 36 (1) The Minister may, on request, enter into a compliance agreement with a person named in a notice of violation on any conditions that are satisfactory to the Minister. The compliance agreement may provide for the reduction, in whole or in part, of the amount of the penalty for the violation. Effect of entering into agreement (2) A person who enters into a compliance agreement with the Minister is, on doing so, deemed to have committed the violation in respect of which the compliance agreement was entered into. Notice of compliance (3) If the Minister is satisfied that a person who has entered into a compliance agreement has complied with it, the Minister must cause a notice to that effect to be provided to the person, at which time the proceedings commenced in respect of the violation are ended. Notice of default (4) If the Minister is of the opinion that a person who has entered into a compliance agreement has not complied with it, the Minister must cause a notice of default to be provided to the person to the effect that, instead of the penalty set out in the notice of violation in respect of which the compliance agreement was entered into, the person is liable to pay, in the prescribed time and manner, twice the amount of that penalty, and, for greater certainty, subsection 29 (2) does not apply in respect of that amount. Effect of notice of default (5) Once provided with the notice of default, the person is not to deduct from the amount set out in the notice any amount that they spent under the compliance agreement and the person is liable to pay the amount set out in the notice. Effect of payment (6) If the person pays the amount set out in the notice of default, the Minister must accept the amount as complete satisfaction of the amount owing and the proceedings commenced in respect of the violation are ended. Refusal to enter into compliance agreement 37 (1) If the Minister refuses to enter into a compliance agreement with a person named in a notice of violation, the person is liable to pay, in the prescribed time and manner, the penalty set out in the notice of violation. Effect of payment (2) If the person pays the penalty, (a) they are deemed to have committed the violation in respect of which the payment is made; (b) the Minister must accept the amount as complete satisfaction of the penalty; and (c) the proceedings commenced in respect of the violation are ended. Effect of non-payment (3) If the person does not pay the penalty in the prescribed time and manner, they are deemed to have committed the violation identified in the notice of violation. Review by the Minister Review — facts 38 (1) On completion of a review requested under paragraph 35 (2)(b) with respect to the acts or omissions that constitute the alleged violation, the Minister must determine, on a balance of probabilities, whether the person named in the notice of violation committed the violation. If the Minister determines that the person committed the violation but that the amount of the penalty was not established by the designated person in accordance with the regulations, the Minister must correct the amount. Violation not committed — effect (2) If the Minister determines that the person named in the notice of violation did not commit the violation, the proceedings commenced in respect of the violation are ended. Review — with respect to penalty (3) On completion of a review requested under paragraph 35 (2)(b) with respect to the amount of the penalty, the Minister must determine whether the amount of the penalty was established in accordance with the regulations and, if not, the Minister must correct the amount. Notice of decision (4) The Minister must cause a notice of any decision made under subsection (1) or (3) to be provided to the person named in the notice of violation. Liability for penalty (5) The person named in the notice of violation is liable to pay, in the time and manner specified in a decision made under subsection (1) or (3), the amount of the penalty that is confirmed or corrected in the decision. Effect of payment (6) If the person named in the notice of violation pays the amount referred to in subsection (5), the Minister must accept the amount as complete satisfaction of the penalty and the proceedings commenced in respect of the violation are ended. Recovery of Debts Debt to His Majesty 39 (1) The following amounts constitute debts due to His Majesty in right of Canada that may be recovered in the Federal Court: (a) the amount of a penalty, beginning on the day on which the notice of violation setting out the amount of the penalty is served; (b) the amount set out in a compliance agreement entered into under subsection 36 (1), beginning on the day on which the compliance agreement is entered into; (c) the amount set out in a notice of default referred to in subsection 36 (4), beginning on the day on which the time the notice is provided; and (d) the amount of a penalty as set out in a decision made by the Minister under subsection 38 (1) or (3), beginning on the day on which the time the notice of that decision is provided. Limitation or prescription period (2) No proceedings to recover such a debt may be commenced later than five years after the debt became payable. Debt final (3) The debt is final and not subject to review or to be restrained, prohibited, removed, set aside or otherwise dealt with except to the extent and in the manner provided by sections 35 to 38 . Certificate 40 (1) Any debt referred to in subsection 39 (1) in respect of which there is a default of payment, or the part of any such debt that has not been paid, may be certified by the Minister. Registration (2) Registration in the Federal Court of the certificate has the same force and effect as a judgment of that court for a debt of the amount specified in the certificate and all related registration costs. Offences Offences — general 41 (1) A person who contravenes any of the following provisions commits an offence: (a) section 12 , subsection 14 (1), section 15 , subsection 20 (5), section 23 or subsection 25 (1) or (2); (b) a provision of the regulations designated by a regulation made under paragraph 47 (1)(f). Punishment (2) A person who commits an offence under subsection (1) is liable on summary conviction to a fine of not more than $100,000 in the case of an individual and not more than $500,000 in the case of any other person. Continuing offence (3) If an offence under subsection (1) is committed or continued on more than one day, it constitutes a separate offence for each day on which it is committed or continued. Due diligence defence (4) A person is not to be found guilty of an offence under subsection (1) if they establish that they exercised due diligence to prevent its commission. Proof of offence 42 In a prosecution of a person for an offence under subsection 41 (1), it is sufficient proof of the offence to establish that the act or omission that constitutes the offence was committed by an employee or an agent or mandatary of the person, whether or not the employee or agent or mandatary is identified. Offence by corporate officers, etc. 43 If a person other than an individual commits an offence under subsection 41 (1), any of the person’s directors, officers or agents or mandataries who directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to the offence and is liable on conviction to the punishment provided for by this Act, whether or not the person who actually committed the offence is prosecuted. Obstruction 44 A person commits an offence if they knowingly obstruct or hinder any of the following persons who are exercising powers or performing duties or functions under this Act: (a) a person to whom assistance must be provided under subsection 14 (1); (b) a person designated under subsection 19 (1). False or misleading statements 45 A person commits an offence if they knowingly make a false or misleading statement, verbally or in writing, to any of the following persons who are exercising powers or performing duties or functions under this Act: (a) a person to whom assistance must be provided under subsection 14 (1); (b) a person designated under subsection 19 (1). Punishment 46 A person who commits an offence under section 44 or 45 is liable on summary conviction (a) in the case of an individual, to a fine of not more than $25,000 for a first offence and of not more than $50,000 for each subsequent offence; and (b) in the case of any other person, to a fine of not more than $100,000 for a first offence and of not more than $250,000 for each subsequent offence. Regulations Regulations 47 (1) The Governor in Council may make regulations (a) respecting any fees payable to electronic service providers for different types of assistance that they provide to persons exercising an authority referred to in subsection 2 (2); (b) respecting record-keeping and reporting by electronic service providers; (c) respecting the meaning of any term or expression for the purposes of this Act; (d) respecting orders referred to in section 22 and reports referred to in section 23 ; (e) respecting the administrative monetary penalties scheme, including regulations (i) designating provisions of the regulations for the purposes of paragraph 29 (1)(b), (ii) respecting the establishment of penalty amounts, (iii) respecting the content of notices of violation, (iv) respecting reviews by the Minister, and (v) respecting the service or provision of documents; (f) designating provisions of the regulations for the purposes of paragraph 41 (1)(b); (g) prescribing anything that is required or authorized by this Act to be prescribed; (h) prescribing the way in which anything that is required or authorized by this Act to be prescribed is to be determined; and (i) generally, for carrying out the purposes and provisions of this Act. Periodic review (2) Every five years after the day on which the first regulation is made under paragraph (1)(a), the Minister must review all regulations made under that paragraph. Notice (3) Before the first regulation under paragraph (1)(a) is made and during every review referred to in subsection (2), the Minister must publish a notice inviting the following persons to make representations within the time and in the form and manner specified in the notice: (a) the Attorney General of Canada; (b) the attorney general of each province; (c) core providers; and (d) electronic service providers that are subject to orders made under subsection 7 (1). Distinguishing 48 For greater certainty, regulations made under this Act may establish classes of electronic service providers and distinguish among them, including on the basis of the electronic service provided and on the basis of the number of persons in Canada to whom the electronic service provider provides services. Report Annual report 49 (1) Within 90 days after the end of each calendar year, the Minister must prepare a report on the Minister’s activities under this Act during that year. Contents (2) The report must include (a) the number of orders made under subsection 7 (1), as well as information relating to the classes of electronic service providers in respect of which the orders were made and the obligations imposed by the orders in respect of operational and technical capabilities; (b) the number of orders that were not approved by the Intelligence Commissioner, as well as information relating to the electronic service providers in respect of which the orders were made and the obligations that were to be imposed by the orders in respect of operational and technical capabilities; (c) information relating to the compliance orders made and enforcement actions taken under this Act; (d) the number of requests for assistance made under subsection 14 (1) and the classes of persons to whom assistance was provided; and (e) any other prescribed information. Publication (3) The Minister must make the report available to the public, with any redactions that the Minister considers necessary, within 60 days after the day on which it has been prepared. Unredacted report (4) If the report contains any redactions, the Minister must cause the unredacted report to be provided to the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency on any of the first 15 days on which either House of Parliament is sitting after the day on which the report is prepared. 2019, c. 13, s. 50 Related and Consequential Amendments to the Intelligence Commissioner Act 42 Paragraphs 12(a) and (b) of the Intelligence Commissioner Act are replaced by the following: (a) reviewing the conclusions on the basis of which certain authorizations are issued or amended, and certain determinations are made, under the Communications Security Establishment Act and the Canadian Security Intelligence Service Act and on the basis of which certain orders are made under the Supporting Authorized Access to Information Act ; and (b) if those conclusions are reasonable, approving those authorizations, amendments, determinations and orders . 43 The Act is amended by adding the following after section 19: Ministerial orders 19. 1 The Commissioner must review whether the conclusions — made under subsection 7(3) of the Supporting Authorized Access to Information Act and on the basis of which an order was made under subsection 7(1) of that Act — are reasonable. 44 (1) Subsection 20(1) of the Act is replaced by the following: Commissioner’s decision 20 (1) After conducting a review under any of sections 13 to 16 and 18 to 19.1 , the Commissioner, in a written decision, (a) must approve the authorization, amendment, determination or order if the Commissioner is satisfied that the conclusions at issue are reasonable, and must set out the Commissioner’s reasons for doing so; or (b) must not approve the authorization, amendment, determination or order if the Commissioner is not so satisfied, and must set out the Commissioner’s reasons for doing so. (2) Paragraph 20(3)(b) of the Act is replaced by the following: (b) within 30 days after the day on which the Commissioner receives notice of the authorization, amendment, determination or order , or within any other period that may be agreed on by the Commissioner and the person, in any other case. 45 Subsections 22(1) and (2) of the Act are replaced by the following: Report to Prime Minister 22 (1) The Commissioner must, each calendar year, submit to the Prime Minister a report with respect to the Commissioner’s activities during the previous calendar year. The report must include statistics, that the Commissioner considers appropriate, relating to the authorizations, amendments, determinations and orders that were approved and not approved. Protection of confidential information (2) The Commissioner must consult with the Director of the Canadian Security Intelligence Service, the Chief of the Communications Security Establishment and the Minister of Public Safety and Emergency Preparedness in preparing the report in order to ensure that it does not contain information the disclosure of which would be injurious to national security, national defence or international relations or information that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege. 46 Subsection 23(1) of the Act is replaced by the following: Provision of information to Commissioner 23 (1) Despite any other Act of Parliament and subject to section 26, the person whose conclusions are being reviewed by the Commissioner under any of sections 13 to 19.1 must, for the purposes of the Commissioner’s review, provide the Commissioner with all information that was before the person in issuing or amending the authorization or making the determination or order at issue, including information that is subject to any privilege under the law of evidence, solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege. Coming into Force Order in council 47 This Part comes into force on a day to be fixed by order of the Governor in Council. PART 3 Parliamentary Review Review after three years 48 During the third year after the first day on which all the provisions of this Act are in force, a comprehensive review of the provisions enacted or amended by Parts 1 and 2 as well as their operation is to be undertaken by the standing committee of each House of Parliament that normally considers matters relating to national security.