The True North, Strong and Rented

Appleton’s Clause & Effect | Privacy and Digital Sovereignty: Part 1 of 2 | June 30, 2026

Canada Day asks us to sing that the land is ours and free. The data that runs the country answers to a court we did not elect.

Same data. Same rails. The variable is the passport.

Two days before Canada Day, the Supreme Court of the United States handed Americans a gift. In Chatrie v. United States, the Supreme Court held that police conduct a search under the Fourth Amendment when they pull the location history a phone leaves behind, even from a private company, even for a couple of hours. The vote was six to three. Justice Kagan wrote that an American keeps a reasonable expectation of privacy in the record of where his phone has been, and that a new technology should not quietly take what people had every reason to think they could keep. The decision carries the earlier 2017 Carpenter rule forward from long location trails to short ones.

It is a strong ruling. It is also, for a Canadian, a lesson in what we do not have.

Sing the first line of Oh Canada on the first of July. Our home and native land. The words carry more than we usually ask of them. The anthem tells us the land is ours, but the data that runs it is a separate question with a different answer. Your bank record, your doctor’s file, the email system inside the federal government, the platform your daughter uses for her homework: most of it sits on rails that virtually no Canadian owns, and no Canadian court can reach. The server may be in Quebec. The authority to open it lies elsewhere.

That somewhere is what makes the American gift instructive. The Fourth Amendment protects “the people,” and the Supreme Court decided in 1990 (which seems so long ago) in United States v. Verdugo-Urquidez that the phrase means the American national community, not a foreign national abroad. The new protection in Chatrie attaches to the American. The privacy protection stops at the border.

The CLOUD Act decides the rest. A 2018 statute compels any provider under American jurisdiction to produce the data it controls, wherever that data sits, on the order of an American court. Amazon, Microsoft, and Google are those providers. They run the rails beneath most Canadian cloud services, including the platform that carries the Department of National Defence.¹¹

Put the two together and the holiday turns strange. Picture one file, one server, one company, two owners. The American owner now carries a constitutional shield, freshly sharpened by Chatrie. The Canadian owner carries none. No expectation of privacy an American court will honour, and no Canadian judge in the room, because the order runs against the company in the United States and not against the person in Canada. Same data. Same rails. The thing that decides who is protected is the passport.

The contrast lands harder this week than in most. On the first of July, Canadians sing that the True North is strong and free. Three days later, Americans celebrate a constitution written to keep their own government out of their lives, and a court that has just read that promise onto their phones. Strong, the True North is. Free is the word that needs the asterisk. A country that rents the rails its data runs on does not set the terms on which that data is read. In the older language of the farm, it is a tenant working someone else’s land.

The instinct in Ottawa is to point to the new privacy law. On June 15 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which names privacy a fundamental right and modernizes how companies handle personal information. Canada needs the bill. The bill does not touch this problem. C-36 governs what a company may do with your data, says nothing about what a foreign court may compel, and cannot order Canadian data onto Canadian-controlled servers, because CUSMA Article 19.12 forbids that requirement outright. Your data can satisfy every clause of C-36 and still answer an American subpoena that no Canadian law can reach.

Our own Supreme Court saw the gap years ago. In R v Spencer and R v Bykovets, the Canadian Supreme Court refused the American rule that data shared with a company loses its protection and held that Canadians keep a reasonable expectation of privacy in what their providers hold. The Charter draws that circle generously. It draws it inside Canada. A Canadian court cannot bind an American company served with an American order on American soil.

The anthem and the architecture point in opposite directions on the same morning.

The song says native land. The infrastructure says foreign jurisdiction. The next line of the anthem is the one that matters now. We stand on guard for thee. For Canadian data, no one is standing, and nothing is built.

Tomorrow, in part two of this series on privacy and digital sovereignty, I set out what standing on guard would actually require and why the watch is a set of statutes, not a sentiment.

This piece continues a thread I have followed across Clause & Effect: see The Cloud Casts a Long Shadow on the CLOUD Act’s reach into Canadian data, and The Digital Hinge of Sovereignty on cloud law, AI dominance, and the limits of data residency.

Prof. Barry Appleton is Interim Director of the Balsillie Legal Advisory Centre at the Balsillie School of International Affairs, Managing Partner of Appleton & Associates International Lawyers, and Distinguished Adjunct Professor of Law and Co-Director of the Center for International Law at the New York Law School.

© 2026 Barry Appleton. All rights reserved.