Discussion 2. Identity protection

Canada decides to enact legislation to protect the online information of Canadians from US intelligence services (which have been hoovering up online data wherever they can find it). The legislation states that all data about Canadians must be stored on servers in Canada. Assuming that this can be implemented perfectly and that US agencies respect the sovereignty of Canadian computers, this plan is still insufficient. Why? How might US agencies obtain some of the information of Canadians without accessing the servers? Be specific. What is a possible additional restriction that Canada could put in place to mitigate this issue?