TL;DR
A Canadian court ordered OVHcloud’s Canadian arm to produce customer account data linked to IPs hosted on OVH servers in Europe and Australia, raising conflict with French law and European sovereignty claims. OVH has filed a judicial review after a judge refused to revoke the order; broader implications for cross-border access and cloud sovereignty are being debated.
What happened
In April 2024 the Royal Canadian Mounted Police issued a Production Order seeking subscriber and account information tied to four IP addresses on OVH servers located in France, the UK and Australia. Rather than using a Mutual Legal Assistance Treaty between Canada and France, investigators served the order through OVH’s Canadian subsidiary. French law bars transfer of certain data outside approved channels and carries penalties for noncompliance, putting the provider in a legal bind: comply with the Canadian order or risk violating French statutes. On September 25 a judge, Justice Heather Perkins-McVey, declined to revoke the order and set a deadline for disclosure; OVH consequently filed a judicial review arguing the company would face criminal liability in one jurisdiction or the other. The case has prompted customers and privacy-focused projects to reconsider hosting arrangements, and OVH had not provided a public response at the time of reporting.
Why it matters
- Could create a legal precedent allowing foreign authorities to reach data stored in other countries through a provider’s local subsidiaries.
- Challenges the effectiveness of local data storage as a guarantee of national or regional digital sovereignty.
- May force customers and vendors to evaluate corporate structure and legal separation, not just physical location, when seeking data protection.
- Raises questions about whether established international assistance channels (MLATs) are being bypassed in criminal investigations.
Key facts
- RCMP issued a Production Order in April 2024 targeting account and subscriber data linked to four IP addresses.
- Targeted IPs were hosted on OVH servers in France, the UK and Australia.
- Canadian investigators served the order via OVH’s Canadian subsidiary instead of pursuing MLAT channels with France.
- French law restricts sharing certain data abroad and carries penalties including fines and imprisonment for violations.
- On September 25 Justice Heather Perkins-McVey refused to revoke the Production Order and set an October 27 compliance deadline.
- OVH filed a judicial review arguing the company faces criminal liability under Canadian or French law depending on compliance.
- Privacy-focused project GrapheneOS said it was removing servers from OVH and exiting French infrastructure.
- OVH had indicated a response was forthcoming but had not provided one by the time of publication.
What to watch next
- Outcome of OVH’s judicial review and whether the Canadian court’s decision is upheld or overturned (not confirmed in the source).
- Whether OVH issues a formal public response clarifying how it will handle the conflicting legal obligations and data disclosure (pending at time of reporting).
- Any formal reaction or legal intervention from French or EU authorities addressing cross-border orders served through subsidiaries (not confirmed in the source).
Quick glossary
- Production Order: A court-issued demand requiring a party to produce documents, records or data to law enforcement as part of an investigation.
- Mutual Legal Assistance Treaty (MLAT): A formal international agreement that establishes procedures for countries to cooperate on criminal investigations and exchange evidence lawfully.
- Digital sovereignty: The principle that a state or region should have control over data, infrastructure and digital services affecting its citizens and economy.
- Subsidiary: A company that is owned or controlled by another company, often subject to the legal jurisdiction where it is incorporated.
- RCMP: Royal Canadian Mounted Police — Canada’s federal and national police service, responsible for national law enforcement and investigations.
Reader FAQ
Did Canadian authorities use an MLAT with France?
No — the RCMP served a Production Order through OVH’s Canadian subsidiary rather than using an MLAT, according to the source.
Has OVH handed over the European data?
Not confirmed in the source.
Could OVH be punished under French law for complying with the Canadian order?
The source reports French law includes fines and imprisonment for unlawful data transfers, and OVH argued it could face criminal liability, but specific enforcement outcomes are not provided.
Is this linked to the US CLOUD Act?
The source references concerns about the CLOUD Act as part of the broader debate on sovereignty, but does not say the CLOUD Act was invoked in this case.
PAAS + IAAS 90 Canadian data order risks blowing a hole in EU sovereignty OVH stuck between a rock and a hard place as investigators demand access Richard Speed Thu 27 Nov 2025…
Sources
- Canadian data order risks blowing a hole in EU sovereignty
- Canadian court may threaten European sovereignty
- Canadian Court: OVHcloud from France must hand over …
Related posts
- GrapheneOS abandons OVHcloud servers amid concerns over French privacy stance
- UK tech minister pledges more whole-government megadeals after £9bn Microsoft pact
- DJ Garman drops the ball instead of the bass in AWS re:Invent keynote