Carney’s EU Tech Push Could Come With Major Strings Attached, Expert Warns

Prime Minister Mark Carney’s push to build closer digital ties with the European Union could come with some major conditions for Canadian cloud companies and government policy, according to University of Ottawa law professor Michael Geist.

Geist points to the EU’s proposed Cloud and AI Development Act, or CADA, which would set four security levels for cloud services used by European public agencies. A leaked draft of a joint statement for this month’s Canada-EU summit in Montreal reportedly says the two sides want to pursue “associated country status for Canada” under the law.

That could open the door for some Canadian-owned cloud companies to bid on higher-security European government contracts, but Geist says the upside may be smaller than it sounds.

Canada would need to keep an EU privacy approval, allow European cloud companies into its market and give them similar access to government contracts. It would also need rules limiting foreign government control or access that goes against EU requirements.

For higher-security cloud services, Canadian companies would still need to set up operations in Europe. Their infrastructure, customer data and staff would need to be based in the EU, and technical support would also have to be handled there.

Geist says that means the deal may not lead to much new investment in Canadian data centres or jobs. The proposal could also create problems for Canadian policy. “Buy Canadian” rules for cloud contracts could face pressure if European companies must be given equal access.

There is also the issue of Bill C-22, Ottawa’s controversial lawful-access legislation. Canadian VPN and cybersecurity companies have warned the bill could push tech firms out of the country, while Apple and Meta have also raised concerns about its impact on encryption and privacy.

Signal has also said it would leave Canada rather than weaken its privacy protections.

CADA is not law yet and still has to move through the European Parliament and Council of the EU. Any special status for Canada would also need approval from the European Commission and could later be changed or removed.

Geist’s main point is that Canada’s effort to rely less on U.S. technology could end up tying the country more closely to European rules instead. “Digital sovereignty is fundamentally about choice, including the ability to ensure that Canadian law governs the services Canadians use,” he wrote Monday.

For Canadians, this could affect where their data is stored, what privacy rules apply and which companies can win government cloud contracts. It could also force Ottawa to deal with the tension between its own surveillance plans and the stricter privacy rules Canada may need to keep closer ties with Europe.