Pernicious privacy risks of foreign partnerships

Less than a week after Mark Carney replaced Justin Trudeau as Prime Minister of Canada, he started traversing the globe to catalyze new investments and projects of national significance. Those priorities, reflected in the mandate letters to Cabinet Ministers, focus on the economy, affordability, and security, with little apparent regard for the unavoidable risks to people and their privacy that may result. 

Carney’s government has been clear that it is re-evaluating Canada’s economy, alliances, and its role in global geopolitics. It has also signaled its determination to build a future in which artificial intelligence is leveraged to improve how we live, work, and play.

Over the past decade, Canada’s federal government has invested tens of millions of dollars into research, talent, standards, and commercialization as part of its Pan-Canadian AI Strategy. Last year, Carney appointed Evan Solomon as the country’s first Minister of Artificial Intelligence and Digital Innovation, with a mandate to ensure Canada stays a leader in the fast-paced AI field, while protecting its digital sovereignty.

As part of his efforts, Minister Solomon announced a 30-day public consultation in late 2025 to elicit Canadians’ views about regulating AI. Reflecting his government’s enthusiasm for the topic, Solomon’s officials determined they would need to use AI tools to analyse the survey results "in a timely fashion".

Fortifying Canada’s position as a modern technology leader relies on more than survey results: It demands significant short- and long-term investments in financial and human capital which, like trust in government and public institutions, are in short supply.

Nevertheless, Prime Minister Carney announced nation-building projects that are "part of Canada’s broader national strategies to boost Canada’s competitiveness” — a four-part strategy that includes ensuring "data sovereignty at a scale to serve Canadians safely and securely.”

The objective is laudable; but Canada has been enduring a brain drain of people needed to build, secure, maintain, and protect Canada’s critical digital infrastructure or ensure data sovereignty. The country lacks the workers, materials, and technologies to be its own best customer. Like other countries, Canada depends on foreign-built chips and other components available through a global supply chain that itself is subject to economic and geopolitical pressures.

Canada is also reliant on the small handful of foreign players in the modern technological oligopoly that have well-established cloud environments — a reality that undercuts the potential for data sovereignty. 

For instance, Microsoft recently announced a plan to invest CAD $7.5 Bllion to help “promote and protect Canada’s digital sovereignty” and “power everything from modernized public services to advanced AI innovation—responsibly and within Canadian borders”. 

The absurdity of such claims is not lost on privacy professionals who recognize the folly of a foreign company enmeshing itself so deeply into a country. After all, “keeping Canadian data on Canadian soil” does little to ensure data sovereignty. As Microsoft France's Anton Carniaux, director of public and legal affairs, testified under oath to the French Senate, the company 'cannot guarantee' data sovereignty and would be compelled to pass local customer information to US authorities under the U.S. CLOUD Act. 

Securing Canada’s national security infrastructure remains top of mind for the government; but as witnesses told the House of Commons Standing Committee on Public Safety and National Security studying the issue, relying on foreign vendors for technology and storage poses a significant risk for the data of Canadian organizations and individuals, and for national security. 

The predicament of having to rely on foreign-owned providers has been allowed to continue, and Canada’s “deepened bilateral relations” with Qatar and its new "strategic partnership" with China could see any resolution take even longer.

Qatar is expected to provide “significant strategic investments in Canada’s nation-building projects,” which include projects related to national security, while Canada and China will pursue pragmatic and constsructive engagement in public safety and security. 

Under the China deal, law enforcement agencies will “increase cooperation to better combat narcotics trafficking, transnational and cybercrime, and money laundering," triggering privacy concerns since, by definition, the stated purpose necessitates the interjurisdictional sharing of personal, sensitive, and confidential information.

Canadians might wonder how that could happen, and it is quite simple: Canadian law allows organizations to disclose personal information in response to a request by a foreign or domestic government or one of its institutions —  without the individual’s knowledge or consent — with few restrictions. 

Allowing information to be disclosed merely if it is “requested” for enforcing “any law of…a foreign jurisdiction” or for “gathering intelligence for the purpose of enforcing any such law” is an astoundingly low bar that enables governments, regulators, courts and law enforcement authorities — including those in countries deemed a foreign interference and geopolitical threat for Canada — to obtain information about diaspora populations and Canadians alike. 

Economic, affordability, and security improvements resulting from Mr Carney’s new deals are long-awaited; but other outcomes might be less appreciated. Michael Kovrig, the former diplomat who was detained in Beijing and held for 1,019 days on charges seen by many as politically motivated and retaliatory, notes that “the Chinese Communist Party systematically applies economic and political coercion to shape the political choices of Ottawa and other capitals.” He also cautions that “Canada and other democracies have to stand firm and refuse to compromise on core values, political independence, and national security."

Canadians must now hold their collective breath to see whether and how closely Canada’s core values will be aligned with those of its new partners and investors.

SHARON POLSKY MAPP is President of the Privacy & Access Council of Canada, and a Privacy by Design Ambassador with more than 30 years’ experience advising corporations and governments.

Sharon has appeared before several Senate, Parliamentary, and legislative committees, is a trusted media resource, and has been invited by conference organizers on five continents to share her insights about privacy and access matters, and about the unintended consequences of emerging laws, technologies and global trends.