Now, I think I know how this would be handled if the shoe were on the other foot, if US law prohibited airlines from giving names to the Canadians while overflying their territory.
We'd be shamed and hectored for our unilateralism. We'd be reminded that the restriction was a direct violation of international law, that the 1944 Chicago Convention says in article 1 that "every state has complete and exclusive sovereignty over airspace above its territory."
Then the lawsuits would fly, arguing that the US restriction had to be squared with international law by, well, eliminating the restriction. And the judges, fresh from seminars in Innsbruck, would nod sagely and dump the restriction.
But of course the shoe isn't on the other foot. We're talking about US security weighed against the right of Canadians to fly over the remains of the World Trade Center without letting a nosy US government learn their (gasp!) name, gender, and birthdate.
So naturally the US requirement has been suspended while some other solution is found. Not the flights, of course, just the security requirement. Well it shouldn't take long to find a simple solution for airlines that want to protect Canadian privacy while observing the US right to control US airspace.
Here's one: Honor Canadian law. Keep the data. And take the long way 'round.