FAQ: What you need to know about Bill C-8
What is Bill C-8 about?
Bill C-8 is the Liberal government’s latest proposal on cybersecurity for critical infrastructure.4 Introduced in June 2025, the bill closely mirrors Bill C-26 from the Trudeau era – a half-baked cybersecurity law that had passed through Parliament but died in the Senate when Parliament was dissolved earlier this year (2025).5 Similar to its predecessor, Bill C-8 has two main parts: amendments to the Telecommunications Act, and the creation of a new framework called the Critical Cyber Systems Protection Act (CCSPA).6,7
While some fixes were made in Bill C-26 after citizens and civil society pushed back hard,8,9 BIll C-8 inherited some major flaws from its predecessor:10 secret government orders that can last indefinitely, and new powers to compel telecom providers, banks, and any other federally regulated organizations to weaken encryption or install surveillance capabilities in the name of cybersecurity This is a direct attack on the very foundation of online security and the privacy of all Canadians.
What are the main problems with Bill C-8?
The main problem is that Bill C-8 contains glaring flaws that could permanently break Canadian privacy. Yet it’s moving rapidly through Parliament, and could be passed without fixing its massive gaps in accountability and transparency.11
The bill gives the government power to compel companies to weaken encryption, which compromises the very foundation of securing your online activities from banking to personal communications. It also lets officials issue secret orders that never expire with no oversight, no checks, and no avenue for challenge.
It could also require ISPs, banks, and other companies to hand over huge amounts of our user data, without strong safeguards to prevent misuse for non-cybersecurity purposes. Safeguards proposed by civil society groups during C-26 were only partially adopted,12 and Bill C-8 still carries major gaps in oversight, transparency and privacy protection.
Bill C-8 is basically a copy of C-26, which nearly passed before being sidelined by a typo. With so much political support already lined up, the government could push it through quickly without real debate or scrutiny.13
Why does this matter to Canadians?
Bill C-8’s core purpose is valid. Cybersecurity is essential to our digital lives and encryption is the backbone of all secured online activities, which includes banking, medical records, business information, and our private conversations we share online with family and friends every day. But Bill C-8 does not get the balance between cybersecurity and our privacy right. Measures that break encryption are not security; they fundamentally reduce our safety!
Bill C-8 leaves the door open for the government to order companies to weaken or undermine the encrypted systems that keep our online privacy safe. That’s like tearing down the solid walls of your home and replacing them with a flimsy fence, then calling it “security.” It doesn’t make us safer. It makes us more vulnerable to hackers, cybercriminals, and surveillance. This is a direct attack on the privacy of all Canadians.
On top of this, the bill gives the government the power to issue secret orders that weaken our privacy, with no expiry date or accountability to the public. This will leave all Canadians in the dark about actions that affect our rights and freedoms.
Where is the bill in Parliament?
Bill C-8 was introduced in the House of Commons on June 18, 2025, and passed first reading the same day.14 In theory, it still has to go through the full legislative process, which includes two more readings in the house, committee study, report stage, and three readings in the Senate before it can become law.15
However, Bill C-8 is almost identical to Bill C-26, which already had broad support across political parties and made it all the way to the Senate before dying when Parliament dissolved in early 2025. With the Liberals back in power, Bill C-8 can be pushed through Parliament faster than usual without proper debate or fixes.16
What has been done so far?
When Bill C-26 was introduced, OpenMedia and our partners in civil society immediately got to work.17 We unpacked what the bill meant for Canadians,18 raised the alarm about its risks,19 and put forward practical recommendations to improve cybersecurity without compromising privacy.20 Civil liberties groups, academics, and experts joined us in calling for change. While a few of our fixes were adopted, most were ignored.
Those unfinished issues now carry over into Bill C-8. Without public pressure, it could be rushed through Parliament without proper debate.This campaign is about restarting the national conversation on cybersecurity and privacy. If we push harder this time, we can shape Bill C-8 into the law Canadians want and deserve. Now is the time to raise our voices and protect your own privacy and rights!