Will Canada's Bill C-8 Impact the Future of EU-Canada Cross-border Data Flows?

Abstract

Canada's proposed cyber security for critical infrastructure bill, Bill C-8, which reintroduces Bill C-26 from the previous Parliament (with minor tweaks), could lead to a re-evaluation of the European Commission's adequacy decision concerning Canada's data protection laws. As such, the bill could push Canada to the brink of a disruption in the framework governing cross-border data flows between the two jurisdictions. Such a scenario would create tremendous uncertainty for actors in the digital economy who routinely process European's personal data, such as airlines, financial institutions, information management service providers, cloud and data storage companies, and e-commerce platforms.