Canada decides to enact legislation to protect the online information of Canadians from US Intelligence services. The legislation states that all data about Canadians must be stored on servers in Canada. Assuming this could be implemented perfectly and that US agencies respect the sovereignty of Canadian computes, this plan is still insufficient. Why?

How might US agencies obtain some of the information of Canadians without accessing the servers? Be specific.

What is a possible additional restriction that Canada could put in place to mitigate this issue?