However, wouldn't there be rules through the United Nations, who are signatories to certain conventions? And also, the actual U.S. law itself, if I'm not mistaken, does provide at least some legal basis for the use of the data.
I reckon that when a Canadian makes a credit card purchase via the Internet, they're never completely certain whether they're making that transaction in good faith. There is a certain amount of risk there. I know it's an extreme example, but I'm trying to test out the logic of the argument.