Image: HJBC / shutterstock.com
When judges request data across borders
What sounds like a dispute between corporations is actually an international political thriller. As reported by tech portal Heise, a Canadian court wants user data stored in France, the UK, and Australia from French cloud provider OVHcloud. The catch: French law prohibits exactly that. Now the cloud giant is in a real dilemma.
OVHcloud must decide: will the company violate French criminal law, or disregard Canadian justice? Regardless of its decision, it faces fines, imprisonment, or reputational damage.
Canada wants data, France says "Non"
The Royal Canadian Mounted Police (RCMP) is investigating a serious crime. To do so, it needs IP-related user data stored at OVHcloud. The Canadian judge argues that because OVHcloud operates in Canada, Canadian law applies there—even to servers located in Europe.
France sees things quite differently. The so-called blockade law prohibits French companies from passing on data to foreign authorities without legal proceedings. Not even when it comes to fighting crime. Only an official request for legal assistance through diplomatic channels is permitted.
The French government took prompt action: the Ministry of Economy and the Ministry of Justice expressly warned OVH against directly transferring data. Violations of the blocking law can result in up to six months' imprisonment and hefty fines.
One company, two laws, zero options?
OVHcloud is no small player: it is one of Europe's largest cloud providers – and now symbolizes a conflict of objectives that is simmering in the cloud industry: what happens when the laws of different countries contradict each other but concern the same data?
The fact that two democratic partner countries such as Canada and France are at loggerheads over this issue shows just how sensitive the topic of data sovereignty has become. The French cloud provider has already filed an appeal and is hoping for a court ruling to overturn the decision. But time is running out: a Canadian court ruling requires OVH to hand over the data immediately. Either Canada or France – but OVH cannot fully comply with either legal system.
The global cloud is under pressure
This case could set a precedent for the entire cloud industry. If courts insist on "virtual presence" and can therefore demand access to data stored worldwide, this will have consequences. Cloud providers could be forced to abandon their promises of data protection and location binding.
European providers such as OVHcloud in particular have been advertising for years that they are independent of the influence of foreign authorities, especially those in the US. But now it is becoming clear that the danger does not only come from overseas. Even friendly countries can become a problem.
Classification: No carte blanche for data access
If courts start treating digital presence like physical presence, data protection risks becoming a paper tiger. Anyone offering cloud services worldwide cannot comply with all laws in every country at the same time—especially when they contradict each other. Canada wants to investigate quickly, France wants legal certainty—both sides have understandable goals. However, a short official channel must not become a carte blanche for government access to data. Otherwise, the wonderful idea of European data sovereignty will soon be worth no more than an expired SSL certificate.
Source: heise.de
