Key Takeaways
- An Ontario court has ordered French cloud provider OVHcloud to hand over user data stored in France, the UK, and Australia to Canadian police.
- The ruling relies on a broad interpretation of “virtual presence,” asserting jurisdiction over the French parent company via its Canadian subsidiary.
- OVHcloud faces a legal trap: complying violates France’s blocking statute, while refusing risks contempt charges in Canada.
- The French government has intervened, warning that direct disclosure is illegal and offering an expedited mutual legal assistance treaty (MLAT) process.
- The case sets a significant precedent for the global cloud industry, potentially undermining European providers’ promises of data protection from foreign authorities.
Introduction
A recent ruling by the Ontario Court of Justice has ignited a transatlantic legal conflict, ordering French cloud provider OVHcloud to hand over user data stored on servers in France, Great Britain, and Australia to Canadian police. The decision threatens to escalate into a diplomatic clash between Ottawa and Paris, raising profound questions about digital sovereignty and the limits of international jurisdiction in the 21st century. The case has quickly garnered international attention, with privacy advocates and industry watchers highlighting its far-reaching implications[^1].
Trigger: An Order with Global Reach
The conflict began with a “Production Order” issued by the Ontario Court of Justice on April 19, 2024, under Section 487.014(1) of the Canadian Criminal Code. The Royal Canadian Mounted Police (RCMP), investigating a serious crime related to national security, demanded access to subscriber information and metadata linked to four specific IP addresses. However, this data is not located in Canada but on servers in France, the UK, and Australia[^1][^3].
While OVH Group SA is a French entity headquartered in Roubaix, it operates a Canadian subsidiary, Hebergement OVH Inc., in Montreal. The subsidiary functions as an independent legal entity with no technical access to the parent company’s data. Despite this, on September 25, Justice Heather Perkins-McVey ruled that the French parent company must hand over the data. Her reasoning hinged on a broad interpretation of “virtual presence,” concluding that because OVH operates globally and offers services in Canada, the company is subject to Canadian jurisdiction regardless of where the physical servers are located[^1].
Dilemma: Caught Between Two Laws
For OVHcloud, the ruling creates an impossible legal trap. Complying with the Canadian order would directly violate France’s blocking statute (Loi nr. 68-678), a law strengthened in 2022 that prohibits French companies from disclosing economically sensitive information or data to foreign authorities outside of official international legal channels. Violating this statute carries severe criminal penalties for executives, including up to six months in prison and fines of up to 90,000 euros per violation. Conversely, ignoring the Canadian court’s order risks contempt of court proceedings in Ontario, which can also lead to severe sanctions[^1][^4].
The case has escalated to the highest levels of the French administration. The French Ministry of Economy, specifically the Service de l’Information Stratégique et de la Sécurité Économiques (SISSE), has explicitly warned in official letters that direct data disclosure to the RCMP would be illegal and would constitute a violation of French sovereignty. The French Ministry of Justice has also intervened, assuring its Canadian counterparts of “accelerated processing” if they utilize the proper mutual legal assistance treaty (MLAT) channels, such as a letter rogatory. Paris has signaled its willingness to cooperate within the bounds of established international law, but the RCMP and Canadian prosecution have insisted on direct disclosure[^1][^3].
Appeal: Fight for the Principle
OVHcloud has appealed the decision to the Ontario Superior Court of Justice, arguing that the lower court ignored fundamental principles of international law. The company’s legal team asserts that Canadian courts should not issue orders compelling citizens of friendly states to commit criminal offenses in their home country, especially when a legal alternative exists through MLAT[^1].
Legal experts have heavily criticized the decision. David Fraser, a Canadian privacy lawyer, published a detailed analysis describing the ruling as deeply flawed.
The court wrongly stretched the precedent set by the Brecknell case—which dealt with a company that had voluntarily agreed to comply—to force compliance from a company explicitly prohibited by its home country’s laws from doing so.
Fraser argues that the decision disregards the fundamental corporate separateness between a parent company and its subsidiary, treating global branding as evidence of legal control. By dismissing the French blocking statute as an “empty vessel” because it is rarely enforced, the court has weakened principles of international comity and legal certainty[^5][^8].
Industry observers in technology forums have also questioned the RCMP’s approach, noting that Canadian courts can order a local entity to attempt access, but cannot force a technical outcome if the subsidiary genuinely lacks the capability to retrieve the data without the parent company’s authorization[^9].
Precedent for the Cloud Industry
The outcome of this proceeding is being closely watched by the global tech industry. If the Canadian legal interpretation prevails, it could severely undermine the business models of international cloud providers. European companies frequently advertise protection from access by foreign authorities, a key selling point against US hyperscalers like Amazon AWS, Microsoft Azure, and Google Cloud, which are subject to the US CLOUD Act[^1][^4].
However, the OVH case demonstrates that European providers with global operations are not immune to foreign court orders. The ruling suggests that a provider’s foreign operations may inherently create jurisdictional exposure, weakening the assurances of data residency and sovereignty that many providers offer their clients. If a Canadian court can assert authority over data held in France, it calls into question the viability of “data residency” guarantees altogether, forcing a reassessment of how sovereignty risk is understood in practice[^5].
Conclusion
The Ontario Superior Court must now weigh whether the efficiency of a police investigation outweighs the laws of a sovereign partner state and the integrity of international agreements. The irony of the case is that both sides seek the same goal: the clarification of criminal offenses. France has secured the data and is willing to hand it over through official channels, but Canada is demanding direct and immediate access. As the appeal unfolds, the decision will have far-reaching implications for how cross-border data flows are governed, the viability of corporate structures designed to protect data, and the future of digital sovereignty worldwide[^3][^4].
References
- [^1]: Frank Schräer (2025-11-26). “Canadian Court: OVHcloud from France must hand over user data“. heise online. Retrieved May 16, 2024.
- [^3]: Berry Zwets (2025-11-27). “Canadian court may threaten European sovereignty“. Techzine Global. Retrieved May 16, 2024.
- [^4]: Sebastian Deck (2025-11-18). “European data sovereignty in court“. SecureCloud. Retrieved May 16, 2024.
- [^5]: David Fraser (2025-12-05). “What digital sovereignty? How a Canadian Court is forcing a French company to break French law“. PrivacyLawyer. Retrieved May 16, 2024.
- [^8]: The Register Forums (2025-11-27). “Canadian data order risks blowing a hole in EU sovereignty • The Register Forums“. The Register. Retrieved May 16, 2024.
- [^9]: Joshua van Es (2026-01-29). “Canadian Court Expands Jurisdiction Over Foreign Data | Joshua van Es posted on the topic | LinkedIn“. LinkedIn. Retrieved May 16, 2024.
