Indeed, one of my recommendations regarding the modernization of federal legislation on privacy protections in the private sector is that there should be stricter rules in this area and on extraterritorial data sharing: Guidelines are needed and, in some cases, assessments must be carried out beforehand. It is therefore important that the framework be very rigorous.
Some things will be outside our control, such as when a foreign government seizes information from a company in another jurisdiction. It is more difficult to control, but, even then, things can be done through international agreements, protocols and legislative requirements, as Europe has done. In this case, it plans to evaluate the other country's legal system to determine whether it's adequate or sufficiently compliant with the rule of law, so that people are aware and explicitly informed. In the TikTok investigation, for example, we asked for much greater clarity and transparency. Since the information was going to China, there was a possibility the Chinese government could access it.
The issue must be examined from all angles. In many cases, it will be useful, even necessary, to have this data in the other jurisdiction, but a framework will be needed to regulate its transmission. In certain circumstances, we may refuse to allow information to leave Canada because it's too sensitive or poses too great a risk.