Communications Security Establishment Act — C-35.3 34
Conditions for authorizations 34 (1) The Minister may issue an authorization under subsection 26 (1), 27 (1) or (2), 29 (1) or 30 (1) only if he or she concludes that there are reasonable grounds to believe that any activity that would be authorized by it is reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities. Conditions for authorizations — foreign intelligence (2) The Minister may issue an authorization under subsection 26 (1) only if he or she concludes that there are reasonable grounds to believe — in addition to the matters referred to in subsection (1) — that (a) any information acquired under the authorization could not reasonably be acquired by other means and will be retained for no longer than is reasonably necessary; (b) any unselected information acquired under the authorization could not reasonably be acquired by other means, in the case of an authorization that authorizes the acquisition of unselected information; and (c) the measures referred to in section 24 will ensure that information acquired under the authorization that is identified as relating to a Canadian or a person in Canada will be used, analysed or retained only if the information is essential to international affairs, defence or security. Conditions for authorizations — cybersecurity (3) The Minister may issue an authorization under subsection 27 (1) or (2) only if he or she concludes that there are reasonable grounds to believe — in addition to the matters referred to in subsection (1) — that (a) any information acquired under the authorization will be retained for no longer than is reasonably necessary; (b) the consent of all persons whose information may be acquired could not reasonably be obtained, in the case of an authorization to be issued under subsection 27 (1); (c) any information acquired under the authorization is necessary to identify, isolate, prevent or mitigate harm to (i) federal institutions’ electronic information or information infrastructures, in the case of an authorization to be issued under subsection 27 (1), or (ii) electronic information or information infrastructures designated under subsection 21 (1) as being of importance to the Government of Canada, in the case of an authorization to be issued under subsection 27 (2); and (d) the measures referred to in section 24 will ensure that information acquired under the authorization that is identified as relating to a Canadian or a person in Canada will be used, analysed or retained only if the information is essential to identify, isolate, prevent or mitigate harm to (i) federal institutions’ electronic information or information infrastructures, in the case of an authorization to be issued under subsection 27 (1), or (ii) electronic information or information infrastructures designated under subsection 21 (1) as being of importance to the Government of Canada, in the case of an authorization to be issued under subsection 27 (2). Conditions for authorizations — defensive and active cyber operations (4) The Minister may issue an authorization under subsection 29 (1) or 30 (1) only if he or she concludes that there are reasonable grounds to believe — in addition to the matters referred to in subsection (1) — that the objective of the cyber operation could not reasonably be achieved by other means and that no information will be acquired under the authorization except in accordance with an authorization issued under subsection 26 (1) or 27 (1) or (2) or 40 (1).