My Globe and Mail op-ed last week argued that the U.S. is pursuing a two-pronged strategy on cross-border data: the CLOUD Act to assert legal access wherever data sits, and trade policy to pressure countries that try to move their data beyond that reach. This post provides the underlying data that the op-ed could not fit with a fuller picture of what the 2026 U.S. National Trade Estimate Report on Foreign Trade Barriers (NTE) actually says about cloud computing and data sovereignty across the globe.
News
Still Not a Privacy Law: Bill C-25’s Political Party Privacy Provisions Fall Short Again
The government’s treatment of political party privacy has been one of the most dispiriting digital policy stories in recent memory. Last year, it buried political party privacy provisions in Bill C-4, an “affordability measures” bill, that required far less of political parties than of virtually any other type of organization in Canada. The rules were designed primarily to shut down litigation in British Columbia that opened the door to applying the provincial privacy law to federal political parties. Bill C-4 ensured that provincial law would not apply and, for good measure, added a clause making the new rule retroactive to the year 2000. The Senate found the bill so outrageous that it sent it back to the House with a sunset clause that would give the government three years to develop something better. But the government rejected that too and rushed the bill to royal assent in a matter of hours with virtually no debate.
Two weeks later, the government introduced Bill C-25, an Elections Act reform bill that includes updated privacy provisions for political parties and which dropped just before Parliament took a holiday break.
Could Bill C-22 Make Canadians Less Safe? The Systemic Vulnerability Gap in Canada’s New Surveillance Law
The lawful access debate in Canada has to date focused on privacy concerns such as access to subscriber information, mandatory metadata retention, and international production orders. But there is another dimension to Bill C-22 that has received less attention and may matter even more to the daily security of Canadians: the risk that the bill’s surveillance-capability requirements and lack of clarity about systemic vulnerabilities will make Canadians less secure. The international experience with similar laws is not reassuring, as it points to risks of hacking, removal of security features that protect users, and reduced investment and innovation. Bill C-22 heads in much the same direction.
Scoping in the Tech Giants: Bill C-22’s International Production Order and the Shift to a Less Privacy-Protective Cross-Border Disclosure System
While much of the focus on lawful access and subscriber information has centred on the reduced standards for obtaining an order for such information from Canadian telecom and Internet providers, there is another new production order deserving of attention (see earlier posts on domestic subscriber information standards and mandatory metadata retention). Bill C-22 introduces a new mechanism for Canadian courts to authorize police to request subscriber information and transmission data held outside the country directly from foreign platforms such as Google, Meta, and other services that provide communications services to the public. The provision is presented as a tool to modernize cross-border investigations, but in practice, it is likely to reduce privacy safeguards.
When Writing About Antisemitism Proves the Point: What the Replies Reveal
Over the past several weeks, I have written and spoken about the escalation of antisemitic violence in Canada including a Globe and Mail op-ed, a blog post after Toronto Police finally moved to restrict protests from Jewish residential streets, an interview on CBC’s The Current, and a PROC committee appearance where antisemitism was raised. In each case, I shared the piece or clip on social media (here, here, here), sparking a torrent of antisemitic vitriol that even after months of escalation leaves me stunned. I write this post not to amplify the vocal hate that fills my timeline, but to ensure that readers who might otherwise not scroll past my original posts understand what has become normalized.
Recent Posts
The Global Battle for Data Control: How the 2026 U.S. Report on Trade Barriers Targets Data Sovereignty Worldwide 
The Law Bytes Podcast, Episode 264: Jon Penney on Chilling Effects in the Digital Age 
Heads They Win, Tails We Lose: What Lies Behind the U.S. Trade Battle For Control over Data 
Still Not a Privacy Law: Bill C-25’s Political Party Privacy Provisions Fall Short Again 
Could Bill C-22 Make Canadians Less Safe? The Systemic Vulnerability Gap in Canada’s New Surveillance Law
