They are adamant about using "Canadian resident" cloud services, that are provided by US controlled cloud service providers. In these cases, data sits in "Canadian" data centers, at least partially, but is effectively controlled, and accessible by, US companies. Data residency doesn't prevent the data from being processed, accessed or used by foreign countries, it just means you need to save a copy on a Canadian server. But even data on foreign servers (to the USA), if/when accessible by US companies, the USA government, through the patriot act and cloud act, has established such data is very much within their scope.

Consider a company like Telus. Telus offers email, but it's actually just gmail or O365. Gmail and O365 are both US controlled companies. The servers are generally within US-based cloud service providers. Telus offers Business Connect for VOIP services. That service is actually just Ring Central. They even route all your traffic through US-based Ring Central servers. That data is exposed to US companies. That's one of Canada's major telcos, shoveling everyone's data over to the USA.

Even the Canadian government has stated that having your data in a US-company controlled tech stack means you have no data sovereignty. The most likely reason the Canadian govt is trying to build a bunch of data centers, is because they want to make sure they have the infrastructure for a 'sovereign' public cloud service provider, as an alternative to USA's AWS/Azure -- similar to setups you see in the EU. In the white paper linked above, they effectively admit that the data residency requirements in Privacy legislation is insufficient for protecting Canada's data / systems -- but they can't realistically think about pushing privacy legislation to change from 'residency' to 'sovereignty' until they have the infrastructure to support most critical industries in a sovereign space.

Having access to this data, to use however they want, is also something that Rubio explicitly ordered the US Govt wings to fight to maintain access to in foreign nations. They're actively integrating any data they can touch into their AI surveillance programs, and view other nations taking back control of their data as a "national security threat" to the USA. And they explicitly want to challenge any legislation, such as bill c-22, as part of that initiative.

*made some edits to clarify some bits a little.