Trump's NAFTA Renegotiations Could Put Canadians' Personal Data At Risk

Canada and the US are getting ready to renegotiate the North American Free Trade Agreement (NAFTA)—something president Trump has been vocal about changing—and on the table are rules defining where online information will be stored. Privacy experts are concerned American law enforcement or spy agencies could get access to Canadians' sensitive information, while others point out that Canada already shares plenty of data with the US.

Currently, policies in British Columbia and Nova Scotia require public-sector information—data from universities, hospitals, and government institutions—to be stored in Canada with the intent to prevent public information from being accessed elsewhere. Other provinces have no such regulations. If Canadians' data is stored within Canada, that storage must comply with the Charter of Rights and Freedoms as well as privacy laws. However, that protection no longer applies if that data is stored in the US, and its own protections don't extend to non-citizens.

In their list of objectives for the negotiations, which begin August 16, the US has indicated it wants to end any regulations that restrict cross-border data flow, arguing they prevent US-based cloud storage companies from doing their business there.

But according to Meghan Sali, communications manager for OpenMedia, a Canadian nonprofit that advocates for internet rights and privacy, there are concerns about keeping Canadians' sensitive data on American soil, especially following the implementation of the Patriot Act, which allows the FBI to access information in the country as they see fit. Then there's the problem of the NSA attempting to intercept Canadians' info, too.

"Our position is that we should be able to make our own privacy policies in Canada, without the interference or oversight of other state actors," Sali said. "Especially when we're talking about our health records or our government records, it's perfectly reasonable to want to create policies that require the local storage of that data."

Sali said there are also concerns that if the US has access to Canadians' sensitive data, it might affect how individuals are treated at the border. Canadians have reported being denied entry to the US based on their personal information and beliefs. For example, a Montreal woman told the CBC she was denied entry after border officials checked her phone and questioned her about her religion.

David Fraser, a technology privacy lawyer based out of Halifax, said that the privacy policy in BC originated more from a desire to keep data storage jobs local than to protect people's personal information. He isn't surprised the US is bringing up these issues, because restricting the location and country of origin of data storage companies goes against the intentions of NAFTA, he pointed out.

"You don't put up these artificial barriers to try to increase employment on your side of the border," Fraser said.

Just because data is stored in Canada, Fraser emphasized, doesn't mean it's safe—Canada already shares plenty of information with the States "like nobody's business," Fraser said.

Michael Geist, a law professor at the University of Ottawa, agrees with Fraser that data localization doesn't ensure its safety. He said that big companies like Google and Amazon already store Canadians' data in the country, because there's a growing public demand.

Even so, Geist said, keeping the data in Canada would still make it harder for the US to get, and they would have to "jump through more hoops" to access that information.

As the NAFTA renegotiations approach, OpenMedia's Sali is also concerned that Canada's advisory board for the meetings doesn't include anybody from the online privacy sector, and that demands from the US on online data might be used as bargaining chips for other decisions regarding other types of trade like labour and automotive.

"If we're looking at that as an indication of what the government's priorities are, we don't really see digital policy privacy to be in that list at all. And it's certainly something that concerns us," Sali said.

Canada hasn't released its list of objectives for the negotiations. In terms of data localization, we'll just have to wait and see.

Get six of our favorite Motherboard stories every day by signing up for our newsletter.