Collecting personal information and documenting them in an electronic or other form without the person's consent is ilegal in Canada. The related legislation is here: http://www.privcom.gc.ca/legislation/index_e.asp. Jurisdiction is the residence of the person(s) who collected the info electronically or otherwise, not the location of the hardware that stores the data. Now that you are aware of this legislation, in a court of law the argument that you didn't know is inadmissible.
In a related issue, I have information about someone who has collected data about me. There is someone with executive authority who is looking into this. Hint: some crooks who have been released on parole, may soon find that freedom short lived.
-you know who.