Just because there is a law saying you should have privacy doesn't mean you actually have privacy.
http://www.huffingtonpost.ca/2014/03/19/canadian-bitcoins-hacked-rogers_n_4995030.html
Who had more privacy in those cases?
The "wise" companies host with those who are capable and reliable. Whatever the laws in place, the threat of the US government "coming to get us" is low on the threat scale IMO. I'd rather the database be hosted with a reputable company with solid procedures to prevent unauthorized access rather than imagining things are secure "just because they are hosted in Canada".
These 2nd tier hosting companies are just not in the same league as the top tier providers when it comes to processes and procedures. The latter really have thought of everything and go to extreme lengths - the only way a disk leaves a cage at Amazon for instance is through a shredder and no one who has ever worked in billing and support can ever work at data centres and access servers (keeping separation).