First of all, if the personal information of Canadians is at stake, any foreign company holding the information is subject to Canadian law. Canadian statutes applicable to the private sector stipulate that Canadians must provide express consent before their data can be transferred to a foreign jurisdiction.
Second of all, there are limits. Of course, technological advancements and business models operate on a large scale, so it's complicated, but the laws still apply.