Sure. Part of the concern comes from a technological perspective. There was early talk, for example, of requiring an organization to ensure that the information only resided on computer servers based, say, in Canada, so the information would never physically leave the jurisdiction. The outsourced company could provide some level of assurance that yes, it's in the private sector, but Canadian law still applies and it's going to remain in Canada.
For many of the major outsourcers, creating that clear distinction, essentially creating a virtual border where the real space borders exist, is challenging if not impossible. Data really does flow that freely. It's difficult to create those kinds of strictures in an environment. Many organizations say they can't provide that level of assurance.