GreatNorthCollective/greatnorth-canada-federal-laws-text huggingface dataset:
Consumer-Driven Banking Act — C-36.78 59
Copy to Bank 59 The Minister must provide a copy of each order made under sections 55 to 57 to the Bank, which must then, as soon as feasible, provide a copy to the individual or entity in question.
Consumer-Driven Banking Act — C-36.78 60
National security order 60 (1) The Minister may, by order, direct a participating entity, an accredited third-party service provider or any director, officer or agent or mandatary of a participating entity or accredited third-party service provider to take or refrain from taking any measures related to the activities that the participating entity or accredited third-party service provider performs under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security. Representations (2) Subject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, accredited third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter. Temporary order (3) If, in the Minister’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Minister may make a temporary order that has the same effect as an order made under subsection (1). End of temporary order (4) A temporary order ceases to have effect on the earlier of (a) the end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, and (b) the day on which an order is made under subsection (1).
Consumer-Driven Banking Act — C-36.78 61
National security order — revocation 61 (1) The Minister may, by order, direct a participating entity or third-party service provider whose accreditation is revoked under subsection 69 (1), or any director, officer or agent or mandatary of the participating entity or third-party service provider, to take or refrain from taking any measures related to the activities that the participating entity or third-party service provider performed under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security. Representations (2) Subject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter. Temporary order (3) If, in the Minister’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Minister may make a temporary order that has the same effect as an order made under subsection (1). End of temporary order (4) A temporary order ceases to have effect on the earlier of (a) the end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, and (b) the day on which an order is made under subsection (1).
Consumer-Driven Banking Act — C-36.78 62
Notice — Committee and Review Agency 62 The Minister must, within 30 days after the day on which an order is made under subsection 60 (1) or (3) or 61 (1) or (3), notify (a) the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act ; and (b) the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act .
Consumer-Driven Banking Act — C-36.78 63
Copy to Bank 63 The Minister must provide a copy of each order made under subsection 60 (1) or (3) or 61 (1) or (3) to the Bank, which must then, as soon as feasible, provide a copy to the individual or entity in question.
Consumer-Driven Banking Act — C-36.78 64
Confidential information 64 (1) The Minister may specify that information about an undertaking required by an order made under section 55 , terms and conditions imposed by an order made under section 56 or an order made under subsection 60 (1) or (3) or 61 (1) or (3), or information that could reveal the existence of the undertaking, terms and conditions or order, is confidential and must be treated accordingly. Prohibition (2) Despite anything in this Act, it is prohibited for any individual or entity to disclose any confidential information referred to in subsection (1) except for the purposes of subsection (3) or section 59 or 63 or in accordance with any conditions that the Minister may specify. Notice — Committee and Review Agency (3) If the Minister specifies under subsection (1) that information is confidential, the Minister must, within 30 days after the day on which the order in question is made under section 55 or 56 or subsection 60 (1) or (3) or 61 (1) or (3), notify (a) the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act ; and (b) the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act .
Consumer-Driven Banking Act — C-36.78 65
Court enforcement 65 (1) If an individual or entity is not complying with an undertaking required by an order made under section 55 , terms and conditions imposed by an order made under section 56 or an order made under subsection 60 (1) or (3) or 61 (1) or (3), the Minister may, in addition to any other action that may be taken under this Act, apply to a superior court for an order requiring the individual or entity to comply with the undertaking, terms and conditions or order. Powers of court (2) The court may make the order and any other order that it thinks fit. Appeal (3) An appeal from an order made under subsection (2) lies in the same manner and to the same court as an appeal from any other order of the court.
Consumer-Driven Banking Act — C-36.78 66
Notice of intent — directive to revoke 66 (1) The Minister may issue to the Bank a notice of the Minister’s intent to issue a directive to the Bank to revoke a participating entity’s or accredited third-party service provider’s accreditation if (a) there are reasons related to national security; (b) the participating entity or accredited third-party service provider has failed to provide additional information in accordance with section 71 ; (c) an order made under section 55 , or an undertaking required under that section, that relates to the participating entity or accredited third-party service provider has not been complied with; (d) a term or condition imposed under section 56 that relates to the participating entity or accredited third-party service provider has not been complied with; (e) the participating entity or accredited third-party service provider has provided false or misleading information to the Bank, the Minister or a designated person or government authority; or (f) the participating entity or accredited third-party service provider or a director, officer or agent or mandatary of the participating entity or accredited third-party service provider has not complied with an order made under subsection 60 (1) or (3). Notice (2) The Bank must, as soon as feasible, notify in writing the participating entity or accredited third-party service provider in question of the notice of intent.
Consumer-Driven Banking Act — C-36.78 67
Review of notice of intent 67 (1) A participating entity or accredited third-party service provider that has been notified under subsection 66 (2) may, within the period provided for in the regulations, request a review of the notice of intent by the Minister. The request must be submitted to the Bank, which must then, as soon as feasible, transmit it to the Minister. Temporary suspension (2) If, in the Minister’s opinion, the length of time required for a review of the notice of intent might be prejudicial to the public interest, the Minister may issue a directive to the Bank to immediately suspend the participating entity’s or accredited third-party service provider’s accreditation while the review is being undertaken. Suspension and notice (3) The Bank must immediately suspend the participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection (2). The Bank must then, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been suspended in accordance with a directive issued by the Minister. Reference to suspension in registry (4) The Bank must immediately include a reference to the suspension in the registry. Effect of suspension — participating entity (5) A participating entity that is notified that its accreditation has been suspended under subsection (3) must immediately cease all consumer-driven banking activities that it performs under this Act. Effect of suspension — accredited third-party service provider (6) An accredited third-party service provider that is notified that its accreditation has been suspended under subsection (3) must immediately cease all activities for which it is accredited. Decision (7) On completion of the review and after giving the participating entity or accredited third-party service provider an opportunity to make representations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation. Notice (8) If the Minister decides to withdraw the notice of intent, the Minister must notify the Bank, which must then immediately notify the participating entity or accredited third-party service provider in writing, end any suspension and remove any reference to the suspension from the registry.
Consumer-Driven Banking Act — C-36.78 68
Review not requested 68 If a participating entity or accredited third-party service provider that has been notified under subsection 66 (2) does not request a review of the notice of intent within the period provided for in the regulations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation.
Consumer-Driven Banking Act — C-36.78 69
Revocation of accreditation 69 (1) The Bank must revoke a participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection 67 (7) or section 68 . Notice of revocation (2) The Bank must, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been revoked in accordance with a directive issued by the Minister. Reference to revocation in registry (3) The Bank must, as soon as feasible, include a reference to the revocation in the registry. Duties of former participating entity (4) A participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations. Duties of former accredited third-party service provider (5) A third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations.
Consumer-Driven Banking Act — C-36.78 70
Notice — Committee and Review Agency 70 Within 30 days after the day on which the Minister issues a directive under subsection 67 (2), the Minister must notify (a) the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act ; and (b) the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act .
Consumer-Driven Banking Act — C-36.78 71
Additional information 71 (1) A participating entity or accredited third-party service provider must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the participating entity or the activities that it performs under this Act or in relation to the accredited third-party service provider or the activities for which it is accredited. Manner (2) A request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the participating entity or accredited third-party service provider. The participating entity or accredited third-party service provider, as the case may be, must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority.
Consumer-Driven Banking Act — C-36.78 72
Notice to appropriate provincial authority 72 If the Bank gives notice under subsection 67 (3) or (8) or 69 (2) to a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
Consumer-Driven Banking Act — C-36.78 73
Personal information 73 The Minister is not authorized to make a request or an order under section 54 , 55 , 56 , 60 , 61 or 71 requiring an individual, a participating entity, an accredited third-party service provider or any other entity to provide the Minister or any designated person or government authority with a consumer’s personal information.
Consumer-Driven Banking Act — C-36.78 74
Decisions and orders final 74 Decisions and orders made by the Minister under this Act are final and binding and, except for judicial review under the Federal Courts Act , are not subject to appeal or to review by any court.
Consumer-Driven Banking Act — C-36.78 75
Advice and information to Minister 75 (1) The Bank must, at least once every year, provide the Minister with advice and information on matters relating to national security and the integrity or security of the financial system in Canada, as those matters relate to the Minister’s exercise of powers or performance of duties and functions under this Act. Consultation — Superintendent of Financial Institutions (2) The Bank must consult the Superintendent of Financial Institutions before providing the Minister with advice or information that relates to a federal financial institution.
Consumer-Driven Banking Act — C-36.78 76
Sharing as directed by consumer 76 (1) Unless otherwise prohibited by law and subject to the regulations, a participating entity must share a consumer’s data with other participating entities as directed by the consumer. Technical standard (2) A participating entity that shares a consumer’s data must do so in compliance with the technical standard referred to in subsection 125 (1). No condition (3) Subject to the regulations, a participating entity must not impose any conditions on another participating entity for the sharing of a consumer’s data in accordance with this Act. Notice to Bank (4) Unless otherwise prohibited by law, a participating entity must notify the Bank, within the time and in the manner specified by the Bank, if the participating entity does not share a consumer’s data as required by subsection (1).
Consumer-Driven Banking Act — C-36.78 77
No charge for sharing 77 A participating entity must not impose a charge for sharing a consumer’s data in accordance with this Act, including for obtaining or renewing a consumer’s consent or for withdrawing that consent.
Consumer-Driven Banking Act — C-36.78 78
Credit or refund 78 (1) If a participating entity imposes a charge on a consumer for sharing the consumer’s data in accordance with this Act, the participating entity must credit the amount of the charge to the consumer or, if the amount was collected, refund it. Interest (2) The amount referred to in subsection (1) bears interest beginning on the day on which the charge is imposed, at a rate equal to the Bank’s overnight rate on that day, and ending on the day on which the amount is refunded or credited.
Consumer-Driven Banking Act — C-36.78 79
Security safeguards 79 (1) A participating entity must implement the security safeguards that are provided for in the regulations. Notice to Bank (2) A participating entity must notify the Bank, as soon as feasible and in the manner specified by the Bank, of any change that has a significant impact on the participating entity’s compliance with the security safeguards.
Consumer-Driven Banking Act — C-36.78 80
Designated officer or employee 80 A participating entity must designate one of its officers or employees to be responsible for the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act.
Consumer-Driven Banking Act — C-36.78 81
Mitigating harm 81 A participating entity must establish policies and procedures to mitigate the harm to consumers that may result from a breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act.
Consumer-Driven Banking Act — C-36.78 82
Report to Bank 82 (1) A participating entity must report to the Bank any breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act if the breach involves consumer data that is under the participating entity’s control. Report requirements (2) The report must contain the information that is provided for in the regulations and must be made, in the form and manner specified by the Bank, immediately after the participating entity determines that a breach of the security safeguards has occurred. Notice to consumer (3) Unless otherwise prohibited by law, a participating entity must notify a consumer of any breach of the security safeguards that involves the consumer’s data that is under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the consumer. Contents of notice (4) The notice must contain sufficient information to allow the consumer to understand the significance of the breach to them and to take steps, if any are possible, to reduce the risk of harm that could result from the breach or to mitigate that harm. The notice must contain any other information that is provided for in the regulations. Manner of notice (5) The notice must be conspicuous and must be given to the consumer in the manner provided for in the regulations. Timing of notice (6) The notice must be given as soon as feasible after the participating entity determines that the breach has occurred. Definition of significant harm (7) For the purposes of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, of business or of professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. Real risk of significant harm — factors (8) The factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to a consumer include (a) the sensitivity of the consumer data involved; (b) the probability that the consumer data has been, is being or will be misused; and (c) any other factor provided for in the regulations.
Consumer-Driven Banking Act — C-36.78 83
Duty to investigate 83 A participating entity must investigate every breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act, for the purposes of identifying any significant, recurring or systemic problems and remedying the problems identified. The participating entity must report the conclusions of every investigation to the Bank in accordance with the regulations.
Consumer-Driven Banking Act — C-36.78 84
Notice 84 If a participating entity identifies a significant, recurring or systemic problem that may have an impact on the consumer-driven banking system, the participating entity must, as soon as feasible, notify the Bank, which may then notify other participating entities.
Consumer-Driven Banking Act — C-36.78 85
Express consent required 85 (1) A participating entity must obtain a consumer’s express consent before requesting that another participating entity provide it with the consumer’s data. Use not consent (2) Use by the consumer of a product or service does not constitute express consent for the purposes of subsection (1). Oral consent — written confirmation (3) If the express consent is given orally, the participating entity must immediately confirm the consumer’s express consent in writing. Information to consumer (4) The participating entity must provide a consumer with the following information before obtaining the consumer’s express consent: (a) a description of the data in respect of which it is seeking the consumer’s express consent; (b) a description of how it will use the data; (c) the period during which the consumer’s consent will be valid, which must not exceed the period referred to in section 86 ; and (d) any other information that is provided for in the regulations. Clear, simple and not misleading (5) Any communication from a participating entity seeking to obtain a consumer’s express consent to have the participating entity receive the consumer’s data, including for the purposes of providing information under subsection (4), must be made in a manner, and using language, that is clear, simple and not misleading. Consent — use of data (6) Subject to the regulations, a participating entity must use the data of a consumer that it receives from another participating entity only for the uses described in the information that is provided to the consumer under paragraph (4)(b). Use of data — product or service (7) A participating entity must not require a consumer to consent to the sharing of the consumer’s data beyond what is necessary for the participating entity to provide the consumer with a product or service. Record of consent (8) A participating entity must keep a record of each express consent obtained. Clarification (9) Nothing in this section renders ineffective any federal or provincial legislative or regulatory provision requiring a participating entity that provides data to obtain a consumer’s express consent.
Consumer-Driven Banking Act — C-36.78 86
Duration of consent 86 A consumer’s express consent may be valid for a period of not more than 12 months after the day on which a participating entity obtains it.