Technology and Entertainment

The cryptographic mechanisms that currently secure digital transactions, communications and signatures may become vulnerable with the advent of sufficiently powerful quantum computers. For businesses, the issue is no longer merely technological: it also affects governance, contracts, information protection and migration planning. Understanding post-quantum cryptography Imagine spending an entire week without transmitting sensitive information over the internet—no banking, no checking health records and no shopping online. Everyday transactions rely in particular on cryptographic mechanisms that: protect the confidentiality and integrity of information; authenticate individuals and systems; and secure digital signatures. However, the advent of sufficiently powerful quantum computers could compromise some of these mechanisms and consequently undermine a key pillar of our current digital security. Cryptography brings together the techniques used to protect the confidentiality and integrity of information, authenticate individuals and systems and secure digital signatures. It plays a role in particular when a browser displays a padlock icon, someone electronically signs a document or a company transmits confidential data. Many of these mechanisms rely on public-key cryptography, which uses a pair of mathematically linked keys: a public key and a private key. These keys derive their security from mathematical problems that would take conventional computers an astronomical amount of time to solve. A sufficiently powerful quantum computer, however, could solve some of these problems in virtually no time. As a result, widely used mechanisms, such as RSA and elliptic-curve cryptography, will no longer offer adequate protection. The immediate nature of the quantum threat Currently, only prototype quantum computers exist, and it is still difficult to predict exactly when they will become commercially viable or when major corporations and nation-states will use them. The Canadian Centre for Cyber Security nonetheless estimates that a quantum computer capable of posing a threat to current mechanisms could emerge as early as 2030, while acknowledging the uncertainty surrounding this timeline.1 In August 2024, the U.S. National Institute of Standards and Technology released its first three standards establishing cryptographic algorithms capable of withstanding this threat.2 For organizations, the issue is therefore not merely knowing when the threat will materialize, but determining what steps to take today to keep their information and systems secure into the future. Post-quantum cryptography refers to methods designed to resist attacks from both conventional computers and future quantum computers. From a mathematical standpoint, resistant algorithms exist, but many IT systems have yet to adopt them. The threat of “Harvest Now, Decrypt Later” The most pressing threat can be summed up by the phrase “Harvest Now, Decrypt Later.” A threat actor can intercept and store encrypted data today, then attempt to decrypt it once sufficient quantum capacity becomes available. Information that retains its value or sensitivity over several years, such as trade secrets, financial data, strategic information and privileged communications, is therefore at the greatest risk.3 The level of urgency depends on each organization's specific technological infrastructure. Key considerations include how long information must remain confidential and the time required to replace vulnerable mechanisms. According to Canadian best practices in the field, some systems have product lifetimes of 15 to 30 years, and a cryptographic migration can itself take several years.4 An organization can therefore fall behind long before a cryptographically relevant quantum computer ever reaches the market. Why businesses rely on their suppliers for the transition Most organizations do not develop replacement cryptographic solutions themselves. Instead, they rely on their software, cloud service, hardware, certificate and cybersecurity vendors. Such reliance does not make planning pointless—on the contrary. It shifts the focus toward governance, procurement and contracts. When it comes to contracts, organizations must assess these risks right now, particularly the allocation of liability between the contracting parties. Ideally, technology service contracts should specify whether the provider or the client bears the risks associated with using technologies that fall short on quantum security. Achieving balanced risk allocation requires open dialogue: Client organizations must ask the right questions and technology providers must be transparent about the limits of their systems. The federal government has begun its transition to post-quantum cryptography The federal government is no longer treating post-quantum cryptography as just a research topic. In June 2025, the Canadian Centre for Cyber Security published a roadmap to migrate the Government of Canada’s unclassified systems. Among other milestones, the document establishes an initial departmental plan and a first progress report starting in April 2026, the migration of high-priority systems by the end of 2031, and the migration of all other relevant systems by the end of 2035.5 A Security Policy Implementation Notice, which took effect in October 2025, reinforces these requirements and compels relevant federal institutions to demonstrate measurable progress.6 While these milestones do not apply directly to private businesses, they can still indirectly affect federal contractors. Since April 1, 2026, in-scope federal contracts with a digital component must incorporate clauses that support post-quantum cryptography and cryptographic agility, among other requirements.7 Federal directives make clear that orderly migration requires governance, inventories, prioritization, financial planning, procurement policies and coordination with vendors. Moreover, the post-quantum transition is by no means confined to the federal government. In September 2026, Canada joined a call to action from the G7 Cyber Security Working Group urging public and private organizations to adopt a phased, risk-based transition. Canadian guidelines likewise recommend that organizations begin preparing before large-scale solutions are rolled out.8 Legal implications for Quebec businesses No Quebec statute expressly requires private businesses to use any specific post-quantum algorithm or complete a migration according to the federal timeline. Instead, Quebec law establishes functional and technologically neutral obligations, which require the adequacy of the selected measures to be assessed in context. Protection of personal information and reasonable security measures The Act respecting the protection of personal information in the private sector requires businesses to take reasonable security measures, taking into account, in particular, the sensitivity, purpose, quantity and distribution of the information and the medium on which it is stored. It also mandates a privacy impact assessment for projects to acquire, develop or overhaul information systems or electronic service delivery systems that process personal information.9 For an organization that retains sensitive information with a lifespan of several years, such as banking information or Social Insurance Numbers, the quantum threat may become a material factor when assessing whether existing security measures are reasonable. Document integrity and confidentiality of transmissions The Act to establish a legal framework for information technology follows the same approach, requiring in particular that the integrity of a document be maintained throughout its life cycle. For instance, where the information contained in a document is declared by law to be confidential, section 34 requires that it be protected by means appropriate to the mode of transmission.10 Documentation explaining the mode of transmission and the measures taken to protect confidentiality must also be readily available to prove compliance. Rather than mandating specific technologies, the law sets outcome-based obligations, in particular safeguarding document integrity and information confidentiality. Civil liability and the state of knowledge As Quebec legal scholars emphasize, security measures only matter in the eyes of the law if they actually work.11 Accordingly, official publications and technical standards—while not giving rise to a civil obligation on their own—can help establish the state of knowledge, the foreseeability of the risk and recognized industry practices.12 An organization’s liability regarding its data protection obligations must be assessed according to the general rules of civil liability.13Liability would turn primarily on whether the organization acted with prudence and diligence at the relevant time, taking into account: the knowledge available at the time; the sensitivity of the protected information; the lifespan of its systems; and the availability of alternative solutions. Using a cryptographic mechanism that could soon become vulnerable may constitute a civil fault in light of current knowledge. Connected devices and reasonable security expectations Similar considerations could apply to manufacturers, distributors and suppliers of connected devices. Under the Civil Code of Québec, factors include the safety that a person is normally entitled to expect and the state of knowledge at the time the item was manufactured, distributed or supplied. Given these criteria, a product’s reasonably expected capacity to receive security updates could form part of the circumstances weighed when assessing a potential safety defect.14 Practical steps for businesses to prepare now Preparing does not call for an immediate overhaul of all existing mechanisms. Rather, it requires developing cryptographic agility—the ability to identify and replace cryptographic mechanisms without having to rebuild the underlying systems from scratch. The Canadian Centre for Cyber Security recommends a number of practical measures in particular:15 Inventory cryptographic assets. The inventory should cover internal and client-facing systems, certificates, authentication mechanisms, digital signatures, network equipment and cloud services. Special attention should be paid to legacy, custom-built or hard-to-update systems. Establish priorities. Organizations should identify information that must remain confidential over the long term and systems whose modification or replacement will require several years. Engage vendors. Organizations should obtain their vendors’ post-quantum roadmaps to determine whether the transition can be completed through updates or if it will require acquiring new products. Applicable standards, support lifecycles and impacts on interoperability should also be verified. Align contracts and procurement. New agreements could include, as appropriate, terms governing security updates, end-of-support notifications, the adoption of standardized mechanisms, cooperation during migration and the allocation of associated costs. Not all organizations face the same level of exposure. However, immediate attention is warranted where a business retains sensitive information over multiple years, operates systems that are difficult to replace or relies on vendors whose migration roadmaps remain unknown. While vendors will likely deliver the technical solutions, each organization must understand its own requirements, ask the right questions and ensure it remains agile enough to adopt these solutions when the time comes. Key takeaways: The quantum threat is already here, even if quantum computers capable of breaking certain cryptographic mechanisms are not yet widely available. The primary threat is “Harvest Now, Decrypt Later.”Data encrypted today can be intercepted, stored and decrypted in the future. The most exposed organizations are those that retain sensitive information over many years, operate systems that are difficult to replace or rely on vendors whose migration strategies are uncertain. In Quebec, there is no general obligation mandating any specific post-quantum algorithm, but businesses are bound to adopt reasonable security measures, assessed in context and in light of the state of knowledge. Preparation starts with cryptographic agility: inventorying assets and uses, prioritizing critical systems, engaging vendors and adapting contracts. CANADIAN CENTRE FOR CYBER SECURITY, “Preparing your organization for the quantum threat to cryptography (ITSAP.00.017),” February 2025, online: https://www.cyber.gc.ca/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024, online: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1. CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, Canadian National Quantum-Readiness Best Practices and Guidelines, Version 04, July 10, 2024, pp. 3–7, online: https://ised-isde.canada.ca/site/spectrum-management-telecommunications/sites/default/files/documents/Quantum-Readiness%20Best%20Practices%20-%20v04%20-%2010%20July%202024.pdf. CANADIAN CENTRE FOR CYBER SECURITY, Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001), June 23, 2025, p. 13, online: https://www.cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001. TREASURY BOARD OF CANADA SECRETARIAT, Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice, effective since October 9, 2025, online: https://www.canada.ca/en/government/system/digital-government/policies-standards/spin/migrating-government-canada-post-quantum-cryptography.html. TREASURY BOARD OF CANADA SECRETARIAT, supra, note 6, s. 6.3.1. CANADIAN CENTRE FOR CYBER SECURITY, “G7 Cybersecurity Working Group call to action on preparing for the post-quantum era,” September 3, 2026, online: https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era?; CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, supra, note 4, ss. 3–5.  Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.3 and 10. Act to establish a legal framework for information technology, CQLR, c. C-1.1, ss. 6 and 34. Éric LABBÉ, “L’efficacité technique comme critère juridique ou la manière dont les lois se technicisent,” (2004) 9-2 Lex Electronica. Éric LABBÉ, “La multiplicité des normes encadrant le contrat électronique : l’influence de la technologie sur la production des normes,” (2004) 9-2 Lex Electronica; Charles-Étienne DANIEL, “Coder son propre droit : quand la machine pousse l’humain à énoncer de nouvelles normes de gouvernance,” dans Quand la société fait son droit : la gouvernance de proximité en action, 2026, EYB2026QSD19, pp. 397–432. Civil Code of Québec, CQLR, c. CCQ-1991, s. 1457; Act respecting the protection of personal information in the private sector, supra, note 9, s. 10. Civil Code of Québec, supra, note 13, arts. 1468, 1469 and 1473. CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1; CANADIAN CENTRE FOR CYBER SECURITY, Guidance on becoming cryptographically agile (ITSAP.40.018), May 2022, online: https://www.cyber.gc.ca/en/guidance/guidance-becoming-cryptographically-agile-itsap40018.

Bill C-8 received royal assent on June 15, 2026. It deserves special attention. The bill marks a shift in our approach to cyber security, giving the federal government the means to respond quickly when a threat is identified. It also requires certain parties to comply with higher standards, and imposes real penalties for noncompliance. The legislation is structured around two main areas. The first strengthens the Telecommunications Act by empowering the Governor in Council and the Minister of Industry to impose specific measures through Orders in Council and Ministerial Orders. The second establishes the Critical Cyber Systems Protection Act (the “CCSPA”), targeting vital systems and services. With these legislative changes, cyber security is emerging from the shadows—it is becoming a matter of governance and compliance. And with the adoption of this Act, technology decisions, supplier management, and responses to cyber security incidents will need to be more robust, better regulated, and duly documented. We believe that organizations that are proactive in preparing their governance and evidence practices, as well as their contingency plans, will be more agile and more credible in the eyes of their clients and partners. That said, an important distinction must be made from the outset: the amendments to the Telecommunications Act set forth in Part 1 are now in force, whereas the CCSPA, as provided for in Part 2, will come into force following one or more Orders in Council. To date, Schedule 2 of the CCSPA, which is meant to identify the classes of designated operators and their corresponding regulatory bodies, remains blank. Key takeaways at a glance - Bill C-8 introduces: (i) the authority to issue telecommunications orders (that is, Orders in Council and Ministerial Orders); (ii) guidelines for a mandatory program for certain critical cyber systems, subject to the CCSPA coming into force and future designations; and (iii) strengthened enforcement in terms of information exchange, audits, administrative monetary penalties, and violations. Part 1 of the Act – Telecommunications: Security becomes the driving force for action Bill C-8 explicitly enshrines security in Canada’s telecommunications policy by adding the objective of “the promotion of the security of the Canadian telecommunications system.” It provides the legal basis for measures that are now designed to be direct, swift, and enforceable. An important element of the Act, both for its application and for defining the nature of the threats it addresses, is the clarification that “interference with or manipulation, disruption or degradation of a telecommunications system include actions of a technical nature that impede the operation of the telecommunications system but do not include the e?ect of lawful expression, persuasion or political debate.” The text thus expressly provides room for freedom of expression and lawful public debate. Part 1 of the Act includes a two-tier enforcement mechanism: Orders in Council and Ministerial Orders (issued by the Minister of Industry). Orders in Council The Governor in Council may issue an Order in Council if they have reasonable grounds to believe that the measure is necessary to secure the system against a threat, and that it is reasonable in relation to the gravity of that threat. Specifically, the order may: Prohibit telecommunications service providers (”TSPs”) from using the products and services provided by a specified person in, or in relation to, their networks or facilities; or Order the removal of products supplied by a specified person. Bill C-8 imposes a proportionality requirement: the scope and content must be necessary and reasonable in view of the gravity of the threat. The Order in Council takes precedence over any conflicting decisions, orders, or authorizations, including those under the Radiocommunication Act. Furthermore, the government does not bear the economic cost—no compensation is payable for financial losses attributable to the Order in Council. This is, in a sense, the “heavy artillery” of the Act. The Order in Council may also include a prohibition against disclosing its existence or all or part of its content. Before imposing such a prohibition, the Governor in Council must, in particular, consider the extent to which disclosure could undermine the objective of the order, the necessity of the prohibition in light of the nature of the threat, the possibility of limiting its scope, its impact on the transparency and accountability of the Government of Canada, and any representations made by the affected TSPs. Before issuing the order, the Governor in Council must also consider the measure’s operational impact on the affected TSPs, its financial implications, its effect on the provision of telecommunications services in Canada—including the confidentiality and security of telecommunications—as well as its potential impacts on Canadians’ privacy. Ministerial Orders The Minister of Industry may, by Ministerial Order, impose highly operational measures when they are necessary and reasonable in view of a threat. The order may, in particular: Prohibit the use of specific products or services, order the disposal of personal information, and impose conditions on the use and provision of services; Prohibit or force TSPs to terminate service agreements; Require review processes for networks, facilities, and procurement plans; Require security plans, vulnerability assessments, and mitigation measures; Require the implementation of standards; Require a backup system; Prohibit TSPs from providing services to a specified person; Order the suspension of the provision of services to a specified person for a specified period; Prohibit certain upgrades; or Order TSPs to do or refrain from doing any specified act, subject to the limitations provided for by the Act. As with Orders in Council, the minister must consider the operational and financial impacts, the effect on the provision of services—including the confidentiality and security of telecommunications—and the potential implications for the privacy of Canadians. The minister may not order the interception of a private communication or a radio-based telephone communication, nor the decryption of an encrypted private communication. The Ministerial Order also comes with a provision stating that no compensation will be paid. The Act also sets forth a specific limitation: the suspension of service to an individual may be ordered only if the order is necessary to secure the Canadian telecommunications system against a threat of a technical nature specified in the order. Like an Order in Council, a Ministerial Order may include a prohibition on disclosure. Before imposing such a prohibition, the minister must consider comparable factors, including the impact of non-disclosure on the principles of transparency and accountability of the Government of Canada. Specifics regarding the publication of orders In principle, Orders in Council and Ministerial Orders must be published in the Canada Gazette within 90 days of their issuance, but the minister making the order may specify in the text itself that it need not be published. In addition, incorporation by reference facilitates the integration of technical documents that are subject to change. We can therefore expect this process to adopt international technical standards. Collection of information by the minister Bill C-8 provides that the minister may require the disclosure of information if they have reasonable grounds to believe that it is both reasonable for the information to be provided in view of the gravity of the threat and that it is necessary. However, a confidentiality framework is in place for the information provided, particularly when it involves trade secrets or financial, commercial, scientific, or technical information. Personal information and de-identified information are also subject to protective measures. The text also provides for the exchange of information among various federal authorities, as well as with the provinces, foreign countries, or certain international organizations under written agreements. The scope and content of personal or de-identified information must be reasonable in view of the gravity of the threat. The Act also provides for the disposal of personal or de-identified information when it is no longer needed. It should also be noted that personal and de-identified information are deemed to be confidential information for the purposes of Part 1, even if they have not been expressly designated as such. Part 2 of the Act – The Critical Cyber Systems Protection Act (CCSPA) It is important to note that this part of the Act will not take effect until the date or dates set by Order in Council. Furthermore, its actual applicability will depend on future designations, since Schedule 2 is currently blank. The framework has therefore been adopted, but it has yet to be implemented. Key concepts: What the Act actually aims to achieve The CCSPA applies to critical cyber systems as strictly defined by the text, that is, a cyber system that, if its confidentiality, integrity or availability were compromised, could affect the continuity or security of a vital service or vital system. The definition of “cyber system” is intentionally broad. In practice, the Act is therefore not limited to a “network” in the traditional sense; it can encompass platforms, cloud environments, control systems, digital services, and interconnected technical assets, provided that if they were compromised, it could affect a vital service or system. The version of the text that has been assented to also adds the definition of “internal audit”, which is an independent and objective review conducted in accordance with internationally recognized guidance on professional internal auditing practices. This reinforces the idea that the expected compliance goes beyond simply adopting internal policies and, where necessary, requires structured assurance mechanisms. How organizations are designated A “designated” operator that controls, operates, or owns a critical cyber system is required to comply with the provisions of the CCSPA and its regulations pertaining to that cyber system. How are operators designated? First, “vital services” and “vital systems” are those listed in Schedule 1, namely: telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems that are within the legislative authority of Parliament, banking systems, and clearing and settlement systems. By Order in Council, items may be modified, or added to or removed from this schedule within the scope of authority provided for by the Act. Second, the Act includes a schedule—which is currently blank—that allows for the establishment of classes of operators and regulatory bodies responsible for these vital services or systems. In practice, compliance depends on both the vital service or system in question (Schedule 1) and the operator class in which the organization is classified (Schedule 2). Cyber security programs: The foundational requirement At the heart of the CCSPA is the requirement to develop a cyber security program. After being designated through an amendment to Schedule 2, an operator must establish, within 90 days, a program relating to its critical cyber systems. This program must include measures, in accordance with the regulations, to identify and manage organizational risks (including supply chains and the use of third-party products and services), protect critical cyber systems, detect incidents and minimize their consequences, as well as any other measures required by the regulations. The program is therefore not merely a policy—it must cover the entire risk management cycle and be amenable to a “compliance” review. This will force organizations and companies to respond quickly when such a designation is made. The Act also imposes a monitoring mechanism: once the program is established, the operator must notify the relevant regulatory body in writing. The Act also requires that any such program be updated periodically. Lastly, reporting requirements apply when significant changes occur, including changes to ownership or control, supply chains, and the use of third parties. This approach transforms cyber security into a governance and maintenance requirement, rather than a one-time project. Supply chains and third parties: From assessment to mitigation The CCSPA explicitly emphasizes supply chains. Once the risks related to supply chains and third parties have been identified in the program (paragraph 9(1)(a)), the designated operator is required to mitigate them (section 15). The verb is important: it is not enough simply to “observe” or “monitor”; the law requires an active mitigation effort, which must be demonstrable. The Communications Security Establishment (the “CSE”) may develop guidelines on mitigating risks associated with supply chains and the use of third-party products and services, drawing on internationally recognized frameworks. The appropriate regulator may also provide the CSE with information—including confidential information—regarding the program or the measures taken, so that the CSE can provide advice, guidance, and services in accordance with its mandate. For organizations, this signals a convergence between regulatory requirements and technical expectations: managing suppliers, access, updates, software dependencies, and subcontractors is becoming a core component of compliance. Incident reporting: A requirement for speed and coordination The CCSPA establishes a requirement to report cyber security incidents to the CSE. Every designated operator must report any cyber security incident involving one of its critical cyber security systems within the prescribed time limits, which may not exceed 72 hours. The definition of “cyber security incident” covers an incident (including an act, omission, or circumstance) that interferes or may interfere with the continuity or security of a vital service or system, or the confidentiality, integrity, or availability of a critical cyber system. After filing a report with the CSE, the operator must, without delay, notify the appropriate regulatory body and provide it with a copy of the incident report. The text specifies that these obligations do not diminish the obligations arising from the Personal Information Protection and Electronic Documents Act. Cyber security guidelines: The mandatory response tool The CCSPA provides for a particularly intrusive measure: cyber security directions. By Order in Council, the government may direct any designated operator or class of operators to comply with any measure set out in the direction for the purpose of protecting a critical cyber system, but only if it has reasonable grounds to believe that the direction is necessary. Before issuing the order, the government must consider the operational impacts, public safety, privacy protection, financial impacts, and the impacts on the provision of vital services and systems. The scope and content must be reasonable in relation to the protection objective, and the operator in question is required to comply. The law also sets out two explicit limitations: the Governor in Council may not order the decryption of an encrypted private communication or the interception of a private communication or a radio-based telephone communication. In addition, a safeguard related to awareness has been put in place: an operator cannot be found guilty of contravening the direction unless they were notified of it or reasonable steps were taken to inform them of it. However, it will be important for an operator not to ignore the notifications received, even if they sometimes seem minor. The operator in question may not disclose the existence or content of a direction except to the extent necessary to comply with it. This requirement has a significant practical impact: it mandates the implementation of a “need-to-know” policy both internally and with respect to suppliers, subcontractors, insurers, and other partners. Information: Confidentiality, sharing, and removal of personal information The CCSPA establishes a comprehensive information-sharing framework, in particular to support the making, amending or revoking of directions. For purposes related to the making, amending or revoking of a direction, certain entities may collect and share information—including confidential information—with one another. The law also regulates the disclosure and use of confidential information and provides for exceptions, particularly when disclosure is required by law or necessary to protect vital services, systems, or cyber systems. “Provable” compliance The CCSPA requires the maintenance of records covering program implementation, reported incidents, steps taken to mitigate third-party risks, compliance with directions, and any other matters specified by the regulations. These documents must be kept in Canada in accordance with the terms and conditions prescribed by the regulations or, in the absence thereof, by the appropriate regulator. This requirement is central: it transforms compliance into a burden of proof. The regulatory framework provides for broad audit and enforcement powers, which are exercised by different authorities—the Superintendent of Financial Institutions, the Minister of Industry through inspectors, the Bank of Canada, the Canadian Nuclear Safety Commission, the Canadian Energy Regulator, and the Minister of Transport—depending on the sector. The provisions governing access to premises, the examination of cyber security systems, and the reproduction and temporary seizure of documents and systems are detailed in the CCSPA. Mechanisms for internal audits and compliance orders are in place, depending on the authority. The law prohibits obstruction and the provision of false or misleading information, which underscores the importance of the quality of the information provided. The version of the text that has been assented to also adds an explicit provision: the CCSPA does not infringe upon solicitor-client privilege or the professional secrecy of lawyers or notaries. Watch out for penalties! It should be noted that the law provides for substantial administrative penalties, as well as criminal offences (including imprisonment). Executives and directors may be considered co-perpetrators of a violation or offence, as the case may be. Ongoing violations can be counted on a day-by-day basis. Under Part 2 of the Act, administrative penalties may reach $500,000 for an individual and $15,000,000 in other cases. Furthermore, certain violations constitute criminal offences that are punishable, in some cases, either through charges or summary proceedings. Depending on the nature of the violation and whether the offender is an individual, imprisonment may be possible. How we can assist you in implementing Bill C-8 In particular, we can assist you with the following: Regulatory positioning Mapping your exposure (in terms of telecommunications, vital services or systems, and your current or anticipated designation) and establishing a realistic roadmap, prioritized by risk Responding to the imposed measures Supporting the receipt, analysis, and implementation of Orders in Council, Ministerial Orders, or directions Compliance Establishing or strengthening governance, record-keeping, and internal processes (including requests for information, audits and inspections, and the traceability of decisions) Third parties and procurement Reviewing and negotiating contracts and security requirements (including incident reporting, cooperation, audits, subcontracting, corrections, and withdrawal/replacement) and documenting mitigation measures Incidents and enforcement Supporting incident response (including triage, notifications, and the preservation of evidence) and managing the risk of penalties and criminal liability, including for executives and directors Conclusion In practice, organizations that may be affected would be wise to start preparing now, even though Part 2 of the law is not yet in force. The practical scope of the Act will depend on the CCSPA coming into force, the adoption of implementation regulations, and the inclusion in Schedule 2 of the classes of operators concerned and their corresponding regulators. In the meantime, organizations that begin structuring their governance, documentation, and third-party management now will be better positioned to adapt quickly once the sector-specific requirements are clarified.

Biotechnology projects rely on sensitive genetic data and biological material Nowadays, innovation-driven companies involved in life sciences, research and biotechnology handle some of the most legally sensitive assets: human tissue, biological material and genetic data. Innovation models involving tissue engineering, biobanks or AI-based analytical technologies are now based on the transfer and use of biological data with high scientific and commercial value. Yet, many organizations still prioritize the scientific and operational aspects of their projects without giving sufficient consideration to the legal restrictions that arise when a project involves a person’s DNA or biological material. From a business standpoint, the risk is that an organization—whether a private company or a public institution—might develop a technology, but then be unable to market that technology because it does not hold the necessary rights to use the biological material and information involved. In Canada, and particularly in Quebec, laws that protect personal and health information have become central to such projects.1 We are no longer simply dealing with typical cybersecurity or privacy concerns. These laws directly affect how biological material is:  collected used transferred stored altered and potentially leveraged for commercial or collaborative research purposes2. Why DNA and human tissue are subject to a particular legal protection The highly sensitive nature of DNA and genetic data is no longer disputed. Canadian case law has long recognized the highly personal and private nature of this type of information.3 It also emphasizes the fact that human tissue and genetic data play a unique role in research and innovation projects because of the identification risks they carry, their scientific value, and the ethical and commercial concerns related to their use.4 This perspective is evident in section 2 of the Act respecting health and social services information5, for example, which defines health information as any information that concerns “any material taken from [a] person,” including biological material. Section 5 and following of this act set out the conditions under which such information may be used, disclosed or transferred in the context of research or collaboration involving third parties6  These obligations supplement those set forth in the Act respecting the protection of personal information in the private sector,7 which requires in particular that personal information be collected for specific and legitimate purposes, and that it be used in a manner consistent with the purposes for which it was originally collected.8 Artificial intelligence, genetic data and the risk of re-identification From a biotechnology perspective, the matter becomes particularly touchy when human tissue or genetic data, which was initially collected for clinical or scientific purposes, is then used for technology or artificial intelligence projects. In fact, many projects that utilize artificial intelligence require not only biological samples and DNA, but also phenotypic data, health information and family history information from the patients from whom the biological samples were obtained. As such, there is a real risk of data cross-referencing here that must be managed with full awareness of the potential impact on those individuals. In certain projects, combining DNA with family information could compromise the privacy of not only the individuals from whom the biological material was collected, but also their family members. This problem has already been raised in relation to genetic genealogy.9 Consent, health information and secondary uses tend to be overlooked A project that was initially intended for research purposes can quickly drift into secondary uses that extend beyond its original scope. However, consent obtained at the outset does not necessarily cover all future uses, particularly where derived data or analysis results are integrated into technology platforms or used to develop analytical tools.10 Research agreements and biological material transfer agreements constitute an essential governance mechanism Agreements have thus become the key governance mechanism. Biological material transfer agreements, collaborative research agreements and data-related provisions are no longer solely intended to protect intellectual property or commercial confidentiality. They also serve to define the processes involved in transferring biological samples, ensuring data traceability, imposing restrictions on reuse and meeting anonymization requirements.11 The rights relating to intellectual property, DNA and personal information are interconnected The interplay between biotech innovation, intellectual property and personal information protection raises complex legal issues. A genetic database or a biological model derived from it can be both a strategic business asset AND a collection of highly sensitive personal information. However, any intellectual property rights that may apply to the results, algorithms or analytical methods do not exempt organizations from the obligations set out in Quebec laws regarding the protection of personal and health information12. On the contrary, in order to market a technology, organizations must hold not only the necessary intellectual property rights but also the rights required under the legal framework governing health and personal information. The commercialization of a technology begins long before it is brought to market As organizations increasingly seek to leverage data from scientific research, issues related to the governance of human tissue, DNA and biological material should no longer be treated as a secondary consideration addressed only at the end of a project. They are becoming an integral part of the legal, operational and commercial framework of modern biotechnology projects and therefore deserve careful consideration from the outset. Summary 1. From a legal standpoint, DNA is considered to be health information In Quebec, biological material and genetic data are not merely instruments of research. Under the law, they are defined as highly sensitive “health information”. The collection, use and transfer of this type of information is strictly regulated and requires explicit, informed consent. 2. Intellectual property does not confer all rights to the holder Just because a company develops a high-performance AI algorithm or an innovative biological model does not mean it can circumvent Quebec’s privacy laws. Bringing biotech products to market requires holding the necessary intellectual property rights AND complying with the legal framework governing the use of health data. 3. The pitfall of project drift (secondary uses) Consent obtained at the outset of a clinical research project usually does not extend to future uses, such as the integration of data into AI platforms. Organizations that fail to establish a solid contractual framework (e.g., transfer agreements, anonymization clauses) from the start may never be able to market their technology. Act respecting health and social services information, CQLR c R-22.1, ss. 1, 2, 5, 44 to 49 and 77. Act respecting the protection of personal information in the private sector, CQLR c P-39.1, ss. 4, 5, 8, 12 and 14. R. v. Dyment, 1988 CanLII 10 (SCC), [1988] 2 SCR 417 Marie Hirtle and Bartha Maria Knoppers, Le stockage des éléments du corps humain, les droits de propriété intellectuelle et les autres droits de propriété, Industrie Canada, 2014. Act respecting health and social services information, supra, note 1, s. 2. Id., ss. 5, 44 to 49 and 77. Act respecting the protection of personal information in the private sector, supra, note 2. Id., ss. 4, 5, 8, 12 and 14. Clausius, K., Kenny, E. & Crawford, M. J. (2023). BILL S-231: The Ethics of Familial and Genetic Genealogical Searching in Criminal Investigations. Canadian Journal of Bioethics / Revue canadienne de bioéthique, 6(3-4), 44–56.  Act respecting health and social services information, supra, note 1, ss. 44 to 49; Act respecting the protection of personal information in the private sector, supra, note 2, ss. 12 and 14. Act respecting health and social services information, supra, note 1, ss. 48 and 49; Act respecting the protection of personal information in the private sector, supra, note 2, ss. 18.3 and 23. Act respecting health and social services information, supra, note 1, ss. 5 and 49; Act respecting the protection of personal information in the private sector, supra, note 2, ss. 12, 17 and 18.3.

The World Anti Doping Agency suffered a data breach in 2016­—a vivid illustration that even the most prominent sporting institutions are not immune to cyber incidents. The authorities have now formalized what was previously just an observation: In a bulletin published in 2024, the Canadian Centre for Cyber Security warned that the entire sports ecosystem—spectators, athletes, organizations and government representatives—is the target of cyberattack campaigns.  Malicious actors will attempt extortion through business email compromise, ransomware attacks, phishing, malicious websites and search engine poisoning, among others. Take heed, as when an incident occurs that is serious enough to require a report to the authorities, it is often too late to establish sound governance and engage in due diligence. The sporting competitions of today are producing massive amounts of data. The quantity is staggering, and the data itself almost Orwellian. Check the tables below to see for yourself. Data collected on athletes  League Information collected NFL Performance data (statistics, position and movement metrics, speed, and passing, rushing and receiving yards) Medical and/or health data (examinations, injuries, concussion protocols) Substance screening data Data on disciplinary actions and investigations Professional and contractual data Travel, logistics and security data NHL Performance data Medical and/or health data (examinations, injuries, concussion protocols) Substance screening data Data on disciplinary actions and investigations Professional and contractual data Travel, logistics and security data MLB Performance data Medical and/or health data (examinations, injuries, concussion protocols) Substance screening data Data on disciplinary actions and investigations Professional and contractual data Travel, logistics and security data   Collection of customer information online  League Information collected NFL  Information provided by individuals  Identifiers: name, email, address, telephone number, date of birth; unique identifiers (username, password, SSN and other government identifiers if required, e.g. for awards) Demographic data and other protected categories: gender, race, ethnicity, sexual orientation Financial and commercial information: payment data, purchase history Real-time geolocation; precise geolocation Communication and marketing preferences Favorite team and inferences about preferences Audio, electronic and visual information (e.g., photos provided) Biometric data, if you opt for biometric authentication at the stadium; with consent and additional notice if required Information about your contacts (name, email) that you share; if authorized, access to your contacts, calendars and photos Search queries Content posted (comments, forums) Professional and employment information Education information Information that may be health-related (e.g., accessible seating) Correspondence, waivers, consents and other information sent Automatic collection  Device and network identifiers and technical data: IP address, MAC address, advertising identifiers, device type, browser, OS Usage: page views, links clicked, browsing journeys, application usage data Tracking and emails: cookies, pixels, tags, interaction with emails (opened emails, clicks) Social media (if linked): data received according to your settings and the platform’s policy Logs and traffic: server logs, stadium Wi-Fi traffic Video and audio recordings: CCTV and pictures taken or video recorded during events   NHL  Information provided by individuals Identifiers and contact information (name, email, telephone number, address, date of birth) Commercial information (payments, purchases, services) Demographic data (language, age, gender, race, ethnicity, household composition and income) Preferences (favourite team, favourite players) Photos and/or videos Content, feedback (comments, surveys) Contact information of friends Application data (resume, references, checks permitted) Automatic collection Activity and interactions (content viewed, bids, purchases, time spent, cookies, tags), access methods (browser, OS, IP address, browsing history before and after) Device information and identifiers (type, unique identifiers, local content if allowed) Location (GPS, Bluetooth, Wi-Fi, cells) Inferences about preferences Commercial information about transactions (e.g., timestamps) Collection from third parties Member clubs (ticketing, login credential, usage logs) Fanatics, NHL Shop, NHL Auctions (name, email, items purchased; marketing engagement statistics) Other business partners, public sources, commercial sources (data brokers) Connected social media (according to the platform’s settings and policies) NHL teams* Contact information: name, email address, home address, gender, date of birth, telephone number (e.g., ticket purchase, ticket transfer, account creation, inquiries, contests, promotions) Demographic data and preferences (age group, race, gender; preferred events, preferred products, e.g., surveys) Health data related to accessibility needs Video surveillance in venues (security; sharing limited by law) Anonymous traffic analysis and device counting (cameras, technological devices; Wi-Fi); statistics that can be shared with partners Depersonalized web analytics (Google Analytics); opt-out option Online advertising and/or remarketing (Google, Facebook, LinkedIn, etc.) through cookies; opt-out mechanisms (platform settings; DAAC) Geolocation through applications if enabled Social media: profile data and authorized interactions Technical data (IP, browser, OS, resolution, location, language, origin, keywords, pages viewed, data entered, ads viewed), identifiers (IDFA, AAID), connection information (operator, ISP, Wi-Fi); ability to recognize a device) MLB Information provided by individuals Identifiers and contact information: full name, email address, home address, telephone numbers, date of birth Security and authentication: password Payments: payment details Demographic data: demographic characteristics Content and recordings: voice recordings, audiovisual recordings Preferences and interests: information about your interests and preferences Activity and event related data: information requested for an activity or event (e.g., emergency contact) Sensitive personal information: as defined by applicable laws (e.g., racial or ethnic origin; health information such as disabilities or allergies) Automatic collection  Technical and usage data: IP addresses, device data, usage data Location and contacts: location data; contacts saved on your mobile device Collection from third parties Data from third parties and integrations: information provided by other companies if individuals connect their services * This data is collected about website users, people who visit venues, people who apply for jobs or participate in contests, people who submit drafts.   How leagues are structured Regarding privacy and personal information, we must look at how sports leagues are organized to understand who does what. In most cases, sports leagues are non-profit organizations or corporations. An entire framework of rules is built around these structures, defining both how governance is done and what business model is used. First, there are the articles of association and by-laws, which dictate governance, team admissions, voting rights, and the powers of the commissioner or board of directors. There are also the sporting and competition regulations regarding eligibility, game schedules, transfers, drafts, salary caps and cost control mechanisms. The leagues also adopt integrity and security policies against doping, betting and manipulation, harassment and abuse, as well as commercial agreements covering broadcasting, sponsorships, ticketing and data leveraging, among others. There can also be collective agreements with players’ associations and formal dispute resolution mechanisms. In this environment, the league plays a central role. It generally has the power to adopt, interpret and amend its rules; admit teams; manage expansion and relocation projects and changes of control; as well as the power to impose sanctions such as fines, point deductions, suspensions or exclusions. It also centralizes strategic commercial rights, media rights, trademarks and data, and it implements revenue-sharing policies designed to maintain a competitive balance between teams. Personal information: the roles of each Teams In day-to-day relations with athletes and customers, teams are generally the main point of contact. They sign contracts with players, sell tickets, manage subscriptions and operate online stores and loyalty programs. In practice, teams are often the ones that collect personal information, that explain what the information is used for, that decide what information needs to be collected and that put in place security and incident management measures. Teams must therefore be able to clearly inform athletes and customers about the purposes for which personal information is collected, the means by which it is collected, the categories of information collected, who receives the information, and the rights that  athletes and customers have. Teams must limit collection to what is necessary. They must ensure that information is accurate; they must obtain valid, manifest, free, informed and explicit consent for sensitive information such as health or biometric data; they must implement security measures adapted to risks; they must manage and report confidentiality incidents likely to cause serious harm; they must respond to requests for access and rectification; and they must stringently govern the sharing of information with service providers and mandataries. Athletes and customers often see the team as the true holder of their data. Leagues The role leagues play regarding personal information is more difficult to understand, as it varies depending on activities. When a league directly collects information from an individual, for example through an official application, a broadcasting platform or a transactional site for its own purposes, it must assume responsibilities comparable to those a team has. This is what MLB Advanced Media does, for example, defining itself as a “data controller” with respect to its customers’ data. But in many cases, the league acts behind the scenes. In some respects, it acts as a mandatary for the teams, negotiating and signing technology contracts, broadcasting agreements and other commercial agreements that will be used by the teams. In other respects, it acts as a service provider, offering centralized technology platforms, ticketing systems, data infrastructure and shared administrative services. Under Quebec law, these two roles—mandatary and service provider—are treated the same: The team can transmit to the league the information it needs to perform the mandate or service contract without having to ask for the consent of each person again, provided that a written agreement imposes clear measures to protect privacy, limits the use of data to the sole purposes of the mandate or service and governs data retention. The league must also promptly inform a team’s privacy officer of any privacy breach or attempted privacy breach and allow the officer to conduct checks. Also, teams and the league can always choose to base certain exchanges of information on the explicit consent of athletes or customers. However, such consent must be genuinely explicit, free, informed, given for specific purposes and presented separately when asked to be given in writing. Conclusion Although professional leagues are the ones in the spotlight, the same logic applies to amateur or non-professional sports organizations. In all cases, the relationship between the league, the team and the athlete or customer must be clearly governed from a privacy standpoint. Sports organizations should map the flow of personal information, harmonize the information messages they give to the those concerned, establish a standard agreement governing the sharing of information between teams and the league, provide simple mechanisms for access and rectification, and have key employees trained in privacy matters. Incorporating these points into articles of association, by-laws and team and league agreements will reduce risks and strengthen the confidence of athletes, parents, fans and business partners. Yet, a fundamental question still remains: Given that by law, data can only be collected for serious and legitimate reasons (necessity criterion), is the mass of information currently collected in the sports ecosystem really warranted? Sports organizations will have no choice but to delve into this strategic issue.