Canucks' ISPs routing data through snoop heaven USA

| wouldn't they say please ?

They might not even say "sorry"!

I am neither Canadian nor a lawyer, but it appears on reading that PIPEDA applies in the private sector and defers matters relating to government data collection to the Privacy Act. The latter appears to have loopholes large and numerous enough to accommodate a broad range of activities, conceivably including the kinds of activity we have come to expect of signals intelligence agencies. In particular, it is not obvious that collecting, e. g., telephone and email metadata, or internet search data, would be restricted. Subparagraphs c and d in the definition of personal information might not be enough, depending on the interpretation of "identifying number" or "address". The section on "Exemptions" (to disclosure), too, covers a lot of territory, including information received in confidence from foreign governments and international organizations of states and their institutions as well as that accumulated in conjunction with investigations of illegal activity or national security threats.

Again, I am not a lawyer, and case law based on the Privacy Act and other related legislation may tightly constrain what intelligence agencies may do, although I would expect things to far more settled in matters of police activity. In the end, however, much depends on how government officials behave in practice, whether they can be (and are) trusted to behave well, and whether there are adequate controls on their misbehavior. The Canadian Privacy Commissioner appears to be important, and hopefully is more active and effective than its US counterpart has been.