There is no legal constraint, once that data reaches the U.S., on what other agencies within the government, what other foreign governments in third countries, or what commercial entities it could be shared with.
Perhaps I might bring in a perspective. I've been following this debate, and it is not happening only in Canada. For example, I testified at similar hearings before the European Parliament earlier this year, and I think part of the answer to what can Canada do, which has been raised in discussions by the European Parliament, is that if this data is to be transferred, there should be enforceable guarantees as to what happens to it in the U.S. There should be constraints on both how the data can be used and to whom it can be transferred, and there should be enforceable rights of judicial redress.
Given that it does not exist in current U.S. law, one way for Canada to pursue this issue would be to not simply and unilaterally amend your laws to comply with non-negotiable demands by the U.S. but to enter into genuine negotiations for a binding international treaty with its own self-enforcing redress provisions. That's a possible way to pursue this issue.