Whose Law Governs Canadian Data?

In February 2025, The Washington Post reported that the United Kingdom had secretly issued a Technical Capability Notice (TCN) to Apple under the Investigatory Powers Act 2016 (commonly known as the “Snoopers’ Charter”).¹⁰¹ The order demanded that Apple create a backdoor allowing UK authorities to access all encrypted content uploaded to iCloud by any Apple user worldwide — not merely targeted accounts of UK residents.

This demand represents an extraordinary assertion of extraterritorial jurisdiction over encryption. The Investigatory Powers Act 2016 grants the UK Home Secretary authority to issue TCNs requiring telecommunications operators to maintain “permanent technical capabilities” enabling the interception of communications. Critically, the Investigatory Powers Act makes it a criminal offense for companies to disclose that they have received a TCN, creating a regime of secret compulsion.

Rather than comply, Apple chose to disable Advanced Data Protection for new UK users in February 2025. This decision meant that UK users lost access to the highest level of data protection available, but Apple avoided creating a global backdoor that would have compromised security for all users worldwide.

The legal asymmetry illustrated by the United Kingdom-United States example does not arise from any encryption-protective feature of the CLOUD Act itself, but from substantive limits embedded in US domestic law. US courts have been reluctant to compel the creation of encryption backdoors or new technical capabilities absent clear congressional authorization, including under the All Writs Act, reflecting concerns about undue burden and the limits of judicial authority in the absence of a statutory mandate.¹⁰² The CLOUD Act preserves these domestic limits and is encryption-neutral rather than encryption-protective.¹⁰³

By contrast, other jurisdictions, including the United Kingdom, maintain domestic legal authorities that permit the imposition of technical capability obligations. The constitutional concern is therefore not that the CLOUD Act mandates decryption, but that its executive agreement framework enables the cross-border circulation of data obtained under foreign legal regimes that permit surveillance powers incompatible with Canadian constitutional standards.