Appleton’s Clause & Effect | Privacy and Digital Sovereignty: Part 2 of 2 | July 1, 2026
The anthem promises a watch. For Canadian data, the watch is not a sentiment. It is compute, a statute, and the nerve to use the exits the trade agreement already leaves open.
Strong intentions lose to strong institutions every time.
Yesterday’s post described a gap. The Supreme Court of the United States strengthened the privacy of American data in Chatrie, the CLOUD Act reaches Canadian data held by American providers, and the protection the Court announced runs to American persons, not to us.
July 1 is Canada Day. Canada’s national anthem has a line for a gap like that. We stand on guard for thee.
Standing on guard is the part Canadians sing with feeling and fund with nothing. We treat it as a sentiment. It is a building program. A watch is posts and people and rules, or it is a word in a song.
Sovereign compute is the foundation. Most Canadian data lives on rails an American court can reach, because the company that runs them is American. Build Canadian-governed compute, and the data stops sitting exclusively inside a foreign order’s reach. Switzerland made the choice and built it. The question for Canada was never whether it could afford the capacity. It is whether it can afford to keep renting the alternative. Owning the rails is the precondition for writing the rules, and for keeping the surplus those rules carry.
A statute has to stand behind the compute. Canada has real room within CUSMA to protect sensitive data through the essential security exception in Article 32.2 and the government procurement carve-out in Article 19.2. Those doors open only when a domestic law stands behind them. An exception defends a regime that already exists; it cannot defend one that a country merely promises to build. A Digital Sovereignty Act would give the exceptions something to protect.
The data that stays in private hands needs its own shield, and Canada has built one before. The Foreign Extraterritorial Measures Act lets the Attorney General direct a Canadian company not to comply with a foreign order that reaches across the border against Canadian interests. It can be amended by a Ministerial order to broaden its scope without additional legislation. American courts weigh a foreign blocking statute in a comity analysis and accord it weight when the statute is mandatory and has actually been invoked. A permissive measure that has never been used earns little, which is the weakness in the Act as it stands. A blocking regulation applicable for the CLOUD Act, mandatory and actively used, is legally available now. Ottawa has not drafted it.
One rule runs under all of it. Build the institution first, then invoke the clause. I have called this code before clause. The domestic architecture comes first, and the treaty exception is the second move, never the first. A counterpart’s lawyers discount a promise and respect a statute already in force. The continental agreement entered its scheduled joint review on Canada Day 2026, and Canada arrives with intentions where the United States arrives with fifteen industry advisory committees and a constitution that has just grown stronger.1 Strong intentions lose to strong institutions every time.
In 2018, Parliament changed one line of the anthem. True patriot love in all of us command. The changed words were "thy sons," now "of us." The word that stayed was command. A country that commands its own digital infrastructure can keep a promise to its citizens about who may open their files. A country that rents the infrastructure makes that promise on a landlord's behalf.
God keep our land glorious and free.
Free is not a condition a country sings itself into. It is a condition a country builds, with compute it governs, statutes it has passed, and the nerve to use the exits its own trade agreement leaves open.
The anthem wrote the instruction a century ago. In the digital age, we stand on guard for thee reads as a work order. Canada has not yet filled it.
This is part two of a two-part series on privacy and digital sovereignty. Part one, The True North, Strong and Rented, set out the exposure. On the construction agenda, see Code Before Clause Revisited on the nine actions Canada must take before the table is set, and A Made-in-Canada National Security Framework on the four pillars of a sovereign strategy.
Prof. Barry Appleton is Interim Director of the Balsillie Legal Advisory Centre at the Balsillie School of International Affairs, Managing Partner of Appleton & Associates International Lawyers, and Co-Director of the Center for International Law at New York Law School.
© 2026 Barry Appleton. All rights reserved.
[1] On the construction-first agenda, see Barry Appleton, The Exits Exist: Canada’s Strategic Case for the 2026 CUSMA Review (SSRN, March 2026), and Code Before Clause (Balsillie School of International Affairs, 2025). The fifteen Industry Trade Advisory Committees are administered through trade.gov; the CUSMA joint review under Article 34.7 opened July 1, 2026.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.