Whose Law Governs Canadian Data?

The CLOUD Act, Executive Agreements and Digital Sovereignty

SPECIAL REPORT

MARCH 11, 2026

Barry Appleton

14. Appendix - Recommended Reading List

The following sources provide essential background for understanding the CLOUD Act and Canadian digital sovereignty.

14.1 Official US Government Documents

The White House, “National Security Strategy of the United States of America,” (November 2025), https://www.whitehouse.gov/wp-content/uploads/2025/12/2025-National-Security-Strategy.pdf .

The White House, “AI Action Plan,” (23 July 2025).

US Department of Justice, “Promoting Public Safety, Privacy, and the Rule of Law Around the World: The Purpose and Impact of the CLOUD Act,” (April 2019), https://www.justice.gov/opa/press-release/file/1153446/download.

14.2 USMCA Review Materials

Appleton, Barry, “Law, Not Leverage: A Rules-Based Path for the USMCA Review — Rebuttal Comments to the US Trade Representative,” Docket No. USTR-2025-0004 (December 12, 2025), https://ssrn.com/abstract=5668791.

Atlantic Council, “Inside the Trump trade strategy with US Trade Representative Jamieson Greer,” Transcript (December 10, 2025), https://www.atlanticcouncil.org/news/transcripts/inside-the-trump-trade-strategy-with-us-trade-representative-jamieson-greer/.

14.3 US Personal Jurisdiction and Digital Services

The following sources provide authoritative analysis of how US courts assess personal jurisdiction over foreign defendants in cases involving online services, digital platforms and cross-border commercial activity. These materials reflect US doctrine and are relied upon by courts, practitioners and government agencies, including in contexts relevant to CLOUD Act exposure.

Borchers, Patrick J., “Jurisdictional Pragmatism: International Shoe’s Half-Buried Legacy,” 28 UC Davis Law Review 561 (1995).

Freer, Richard D., “Personal Jurisdiction in the Twenty-First Century: The Ironic Legacy of International Shoe,” 63 South Carolina Law Review 551 (2012).

Robertson, Cassandra Burke, “Personal Jurisdiction in the Internet Age,” 38 Tulsa Law Review 299 (2003).

Sachs, Stephen E., “How Congress Should Fix Personal Jurisdiction,” 108 Harvard Law Review 1301 (2019).

Stein, Allan R., “Personal Jurisdiction and the Internet: Seeing Due Process Through the Lens of Regulatory Precision,” 98 Northwestern University Law Review 411 (2004).

14.4 Official US Government Interpretations of the CLOUD Act

US Department of Justice, Promoting Public Safety, Privacy, and the Rule of Law Around the World: The Purpose and Impact of the CLOUD Act (April 2019).

U.S. Department of Justice, Report to Congress on the Implementation of the U.S.-U.K. CLOUD Act Agreement (2023).

14.5 Legal Commentary and Analysis

Appleton, Barry, “The Cloud Casts a Long Shadow: Microsoft, the CLOUD Act, and Canada’s Vanishing Digital Sovereignty” Appleton’s Clause & Effect (21 July 2025), online: https://barryappleton.substack.com/p/the-cloud-casts-a-long-shadow.

Appleton, Barry, “Canada is ceding sovereignty to America’s ‘algorithmic empire’” National Post (15 September 2025), online: https://nationalpost.com/opinion/canada-is-ceding-sovereignty-to-americas-algorithmic-empire.

Appleton, Barry, “Canada surrenders to foreign code,” National Post (October 15, 2025), https://nationalpost.com/opinion/canada-surrenders-to-foreign-code.

BSA | The Software Alliance, “The US CLOUD Act: Myths vs. Facts,” (April 2019), https://www.bsa.org/files/policy-filings/04112019uscloudactmyth.pdf.

Canadian Bar Association, Privacy and Access Law Section, “Submission on CLOUD Act Agreement,” (November 2024), https://nationalmagazine.ca/en-ca/articles/cba-influence/submissions/2025/how-to-address-canada-s-digital-data-disclosures-with-the-u-s.

Daskal, Jennifer, “Microsoft Ireland, the CLOUD Act, and International Lawmaking 2.0,” (2019) 71:9 Stanford Law Review 9.

Mulligan, Stephen P., Cross-Border Data Sharing Under the CLOUD Act, Congressional Research Service Report R45173 (updated periodically).

The Citizen Lab, “Canada-U.S. Cross-Border Surveillance Negotiations Raise Constitutional and Human Rights Concerns,” (February 2025).

14.6 Official Canadian Government Documents

Treasury Board of Canada Secretariat, “Direction on Electronic Data Residency,” (August 2025).

Privacy Commissioner of Canada, Annual Report to Parliament 2023-24, (Office of the Privacy Commissioner, 2024).

Office of the Information and Privacy Commissioner for British Columbia, “Privacy and the USA Patriot Act: Implications for British Columbia Public Sector Outsourcing,” (October 2004), https://www.oipc.bc.ca/special-reports/1271.

14.7 Key US Statutes

Clarifying Lawful Overseas Use of Data Act, Pub L No 115-141, Div V (2018), codified at 18 USC § 2713.

Stored Communications Act, 18 USC §§ 2701-2713.

Electronic Communications Privacy Act of 1986, Pub L No 99-508, 100 Stat 1848.

14.8 Key Canadian Statutes

Foreign Extraterritorial Measures Act, RSC 1985, c F-29.

Personal Information Protection and Electronic Documents Act, SC 2000, c 5.

Freedom of Information and Protection of Privacy Act, RSBC 1996, c 165.

14.9 Key US Cases

In Re Grand Jury Proceedings (Bank of Nova Scotia), 691 F 2d 1384 (11th Cir 1982); 740 F 2d 817 (11th Cir 1984).

International Shoe Co v Washington, 326 US 310 (1945).

Smith v Maryland, 442 US 735 (1979).

Société Nationale Industrielle Aérospatiale v United States District Court, 482 US 522 (1987).

14.10 Key Canadian Cases

R v Bykovets, 2024 SCC 6.

R v Love, 2022 ABCA 269.

R v Spencer, 2014 SCC 43, [2014] 2 SCR 212.

14.11 News and Investigative Reporting

French Senate, “Commande publique : audition de Microsoft,” (June 10, 2025), https://www.senat.fr/actualite/commande-publique-audition-de-microsoft-5344.html.

Menn, Joseph, “U.K. orders Apple to let it spy on users’ encrypted accounts,” The Washington Post (February 7, 2025).

Rudolph, Alexander, “Microsoft Admits: US Law Supersedes Canadian Sovereignty,” Canadian Cyber in Context (July 21, 2025), https://www.cyberincontext.ca/p/microsoft-admits-us-law-supersedes.

14.12 DOJ Reports and Congressional Materials

Nojeim, Greg, “CLOUD Act, Encryption, and Americans' Privacy,” Written Testimony before the House Judiciary Committee, Subcommittee on Crime and Federal Government Surveillance (June 5, 2025), https://www.congress.gov/119/meeting/house/118335/witnesses/HHRG-119-JU08-Wstate-NojeimG-20250605.pdf.

US Department of Justice, Report to Congress on the Implementation of the U.S-U.K. CLOUD Act Agreement, (November 2024), https://www.documentcloud.org/documents/25551978-doj-report-to-congress-on-us-uk-cloud-act-agreement/.

14.13 Commentary on Implementation

Center for Democracy and Technology, “Secrets, Secrets Are No Fun: the United Kingdom's Secret War on Encryption,” (March 25, 2025), https://cdt.org/insights/secrets-secrets-are-no-fun-the-united-kingdoms-secret-war-on-encryption/.

Gidari, Albert, “The Big Interception Flaw in the US-UK Cloud Act Agreement,” Stanford Law School Center for Internet and Society, (October 2019), https://cyberlaw.stanford.edu/blog/2019/10/big-interception-flaw-us-uk-cloud-act-agreement/.

Salgado, Richard, “First Insights Into the U.S.-U.K. CLOUD Act Agreement,” Lawfare, (March 10, 2025), https://www.lawfaremedia.org/article/first-insights-into-the-u.s.-u.k.-cloud-act-agreement.

Shurson, Jessica, “Assessing the US-UK CLOUD Act Agreement” Issues in Cybercrime Law, (March 13, 2025), https://issuesincybercrimelaw.substack.com/p/assessing-the-us-uk-cloud-act-agreement.

14.14 Canadian Civil Society

Canadian Civil Liberties Association, “Bill C-2 Explainer: Information-sharing between Canada & the US,” (October 2025), https://ccla.org/wp-content/uploads/2025/10/Bill.C-2.Explainer-Canada.US_.information.sharing.pdf.

Report Sections

Download Paper
About the Author
See Executive Summary