Yes, and that is part of the reason we object to having personal information sent out of the country. As long as it is held within the country, it's subject to PIPEDA and other regulations, and we feel it's much easier to control the access.
On February 15th, 2007. See this statement in context.