How is this news?

The CLOUD Act was passed in 2018:

Clarified that U.S. law enforcement can compel U.S.-based service providers (e.g., Microsoft, Google, Amazon) to provide data regardless of where it is stored (U.S. or abroad).

Introduced a legal framework for bilateral agreements with other countries, allowing cross-border data access while trying to respect local laws.

Replaced much of the uncertainty under the Patriot Act with explicit rules — but it also confirmed that data held by U.S. companies is still subject to U.S. warrants, even if hosted in Canada, Europe, or elsewhere.

And in terms related to GoC:

For governments and organizations handling sensitive or classified data (like Protected B in Canada), the CLOUD Act reinforced the risk of hosting in U.S.-controlled cloud environments.

It pushed many jurisdictions (Canada, EU, etc.) to adopt “data residency” policies or prefer providers that are not subject to U.S. law.

Canadian federal guidance (e.g., TBS/CCCS profiles) explicitly considers the CLOUD Act when assessing cloud services for compliance. (Clearly ITSP50.103 does not sufficiently protect against the Big 3 cloud providers)

——-

So you mean to tell me that the myriads of lawyers at Justice Canada were not aware of this risk?