A Canadian court has ordered OVHcloud to hand over customer data from Europe. This happened despite the French cloud provider positioning itself as a protector of European data sovereignty.
This is according to The Register, based on documents it has seen. In April 2024, the Royal Canadian Mounted Police (RCMP) issued a production order demanding subscriber and account data from four IP addresses on OVH servers in France, the United Kingdom, and Australia. This was done as part of a criminal investigation. The order targeted OVHcloud’s Canadian subsidiary, even though OVH Group is a French company.
Instead of using established mutual legal assistance treaties (MLATs) between Canada and France, the RCMP sought direct disclosure through the Canadian subsidiary. This placed OVHcloud in an impossible position. French law prohibits the sharing of data outside official treaties, with penalties of up to €90,000 and six months in prison. But refusing the Canadian order carried the risk of contempt of court.
Judge rejects objection
On September 25, a decision on the production order was published. Justice Heather Perkins-McVey rejected a request to withdraw it. “The Court must balance the interests of the state and the respondent,” the judge said. The national security nature of the investigation outweighed other concerns.
OVHcloud had to hand over the data by October 27. An application for judicial review was therefore filed. It states that OVHcloud “will be forced to choose between the risks of criminal liability in Canada and/or France, including imprisonment and fines.”
Broader implications
Concerns about the US CLOUD Act are growing. This legislation allows US authorities to demand access to data from US companies via a warrant or subpoena, regardless of where that data is stored. Hyperscalers claim not to have received such requests regarding European customers. However, the risk remains.
European cloud providers have used this as a selling point by emphasizing that the digital information they store is protected. In the OVH case, the consequences could be serious if Canadian authorities can force access to data on European servers without using official channels.