Canadian Court: OVHcloud from France must hand over user data

Contents

A court in Ontario has ordered French cloud giant OVHcloud to hand over data stored on foreign servers to the Canadian police. The decision puts the company in a dilemma between Canadian justice and French criminal law – and has also alerted the French government. Ultimately, their plea also concerns the much-vaunted independence and data protection of European online providers.

This is a case that extends far beyond the boundaries of an ordinary criminal investigation and touches upon the core of digital sovereignty in the 21st century. At its heart is a seemingly simple order: the Royal Canadian Mounted Police (RCMP) is demanding access to inventory and metadata linked to four specific IP addresses. However, this subscriber information and connection data are not located in Canada but on servers in France, Great Britain, and Australia. The legal tug-of-war that has ensued threatens to escalate into a diplomatic conflict between Ottawa and Paris.

Trigger: An Order with Global Reach

It all began with a "Production Order" issued by the Ontario Court of Justice on April 19, 2024, based on Section 487.014(1) of the Canadian Criminal Code. The RCMP is investigating a criminal case related to serious crime and requires data from customers of OVH Group SA for this purpose.

The problem: The company is a French entity headquartered in Roubaix. While there is a Canadian subsidiary, Hebergement OVH Inc., in Montreal, it operates as an independent legal entity. As revealed in court documents obtained by heise online, the Canadian subsidiary has no technical access to the parent company's data, which is stored in European data centers.

Nevertheless, on September 25, the Ontario Court of Justice, presided over by Judge Heather Perkins-McVey, ruled that the French parent company must hand over the data to the Canadian authorities. Her reasoning is based on a broad interpretation of "virtual presence": since OVH operates globally and offers services in Canada, the company is subject to Canadian jurisdiction, regardless of where the physical servers are located.

Dilemma: Caught Between Two Laws

For OVHcloud, this ruling is more than just a bureaucratic annoyance; it is a legal trap. The largest French cloud provider vehemently invokes national law in its defense, particularly the so-called blocking statute (Loi nr. 68-678). This law from 1968, strengthened in 2022, prohibits French companies and citizens, under penalty of law, from disclosing economically sensitive information or data to foreign authorities – unless it is a request through official international legal channels.

In an affidavit, Xavier Barriere, corporate counsel at OVH in Paris, describes the dramatic situation: If the important proponent of European data sovereignty were to comply with the Canadian order, those responsible in France would be committing a criminal offense. They face up to six months in prison and fines of up to 90,000 euros per violation. However, if OVH ignores the Canadian court, it faces contempt of court proceedings in Ontario, which can also lead to severe sanctions.

Protest from Paris: Ministries Get Involved

The case has now reached the highest levels of the French administration. The French Ministry of Economy, specifically the Service de l'Information Stratégique et de la Sécurité Économiques (SISSE) located there, which monitors compliance with the blocking statute, has taken an unequivocal stance in two letters.

In the first letter from May 2024 and an even more detailed second letter from January 2025, the SISSE warned: Direct data disclosure to the RCMP would be illegal. The authority confirmed that the requested information falls under the scope of the law and that circumventing international treaties would constitute a violation of French sovereignty.

The French Ministry of Justice also intervened on February 21. In it, it assured its Canadian colleagues of "accelerated processing" if they chose the official route via a letter rogatory. Paris signaled its willingness to cooperate – while adhering to the rules of the game. OVH has already secured the data; it is ready. However, the RCMP and the Canadian prosecution insisted on direct disclosure – and the court in Ontario followed them.

Appeal: Fight for the Principle

OVH has appealed Perkins-McVey's decision to the Ontario Superior Court of Justice at the end of October through lawyers from the firm Miller Thomson. The application for judicial review reads like a lecture on international law. The lawyers argue that the lower court ignored fundamental principles: Canadian courts should avoid issuing orders that compel citizens of friendly states to commit criminal offenses in their country. This is especially true when a legal alternative exists through a mutual legal assistance treaty.

The Canadian subsidiary cannot simply be held liable for the data of the French parent company, the lawyers emphasize. The extension of Canadian powers to the relevant foreign servers overstretches national sovereign rights.

"The applicants would suffer irreparable harm before the Court of Appeal could even hear the case," the urgent application for a stay of execution states. This is because Perkins-McVey set the deadline for data disclosure as October 27. Without an immediate halt to the order, OVH would have to choose which law to break.

Precedent for the Cloud Industry

The outcome of this proceeding is being closely watched by the tech industry. If the Canadian legal interpretation prevails and "virtual presence" is sufficient to force direct access to data in Europe, it would call into question the business model of many international cloud providers. European companies often advertise protection from access by foreign authorities, such as through the US Cloud Act. A ruling that allows Canadian police direct "access" to France would undermine this promise.

The irony of the case is that both sides pursue the same goal: the clarification of criminal offenses. France has secured the data and wants to hand it over – but only through official channels. Canada wants the data quickly and without bureaucratic hurdles. Now the ball is in the court of the Ontario Superior Court. It must decide whether the efficiency of a police investigation outweighs the laws of a sovereign partner state and the integrity of international agreements. US hyperscalers like Amazon with AWS, Microsoft with Azure, and Google Cloud are laughing up their sleeves; this time, it's not them, but their European competitors, who are up against the wall regarding data sovereignty.

(fds)