I would start with what recourse there would be for improper disclosure, either by Canadian institutions or the CRA. Canadian financial institutions normally would have to keep the information of their clients secret, but the arrangement provides the legal basis for them to share information with the CRA with a view to sharing it with the IRS.
If there is something wrong, and if there's oversharing of information, PIPEDA would be a ground to invoke. In terms of oversharing by the CRA to the IRS, the Privacy Act could be invoked.
If on the American side, there is something untoward that is happening, again we will have to look into this question.