Just recently, I
heard about a very significant new decision from the Ontario Court ofJustice, where a judge in Ottawa ordered OVHcloud in France and its Canadian
subsidiary to hand over user data stored in France, the UK, and Australia.
While Canada is focusing a lot of attention on “data sovereignty”, this
decision should get a lot more attention, particularly because the Canadian
court is ordering the French company to violate a French law that is designed
to protect France’s data sovereignty.
I regularly deal
with situations like this in my law practice, where I assist companies in
responding to police demands for user data. But rarely does it get to this
point, and I’m afraid this sets a very negative precedent.
This case touches
on jurisdiction, cross-border data, foreign blocking statutes, and the limits
of Canadian investigative powers. It also relies heavily on the controversial Brecknell
decision from British Columbia — and I have some things to say about that.
Let’s walk through
the case, and then I’ll explain why I think the analysis in the decision goes
off the rails.
This case arises out of a national security investigation. The
RCMP obtained a Production Order under the Criminal Code s.
487.014, requiring two companies to produce customer information linked to four
IP addresses. The two companies are OVH Group SA (a French company that
provides cloud computing services globally, OVH’s Canadian subsidiary, Hebergement
OVH Inc.
All of the IP
addresses were hosted outside Canada — in France, the UK, and Australia.
The data sought included subscriber information and metadata, but not
the content of any communications.
They argued that
they did not have the data. It was held by the French parent company. They are
the operating company in Canada that apparently runs servers here for the
global business. They don’t manage global accounts or have access to the
records that the police were looking for. OVH Canada did not oppose the
order as it applied to OVH Canada on any jurisdictional basis. They are
a company that has offices, employees and facilities that operates within
Canada.
The real issue was
the attempt to compel the French parent company — a company with no
physical presence in Canada — to produce data stored entirely abroad, and that
is subject to foreign laws.
The parent company
said:
●
“We don’t operate in Canada.
●
We don’t store this data in
Canada.
●
OVH Canada doesn’t control this
data.
●
French law — specifically the French
blocking statute — prohibits us from producing it. (more about that
blocking statute later)
OVH also pointed
out that the proper, internationally-recognized channel for this type of
request is through Mutual Legal Assistance — the MLAT process — which
France said it would expedite. Yes, Canada and France have a treaty
under which both countries have agreed to manage situations like this. It’s
slower because it contains checks and balances. First Canada has to determine
if the request is appropriate, and then France reviews the request before
getting a French order to provide the data.
The Crown responded
that:
●
OVH Parent has
a “virtual presence” in Canada, and based on the Brecknell case from BC,
and cases following that, a “virtual presence” is enough.
●
The company
“presents itself” as a unified global enterprise on its website
●
OVH Canada has
previously responded to production orders about foreign IP addresses
●
The French
blocking law is rarely enforced
With those facts on
the table, the Court had to decide: Does a Canadian criminal court have
jurisdiction over OVH’s French parent? And even if it does, should the
order be revoked because of conflicting French law or because MLAT is the
proper mechanism?
- Did OVH Canada have “possession or control” of the data?
- Did the Court have jurisdiction over OVH
Parent?
- Would French law prohibit disclosure,
triggering s. 487.0193(4)(b) - which justifies varying or revoking a
production order where the data is “otherwise protected from disclosure by
law”?
- Should MLAT be required in these
circumstances?
- If French law applies, should the Court exercise its discretion
to revoke or vary the order?
The first Question is
whether OVH Canada has “Possession or Control” of the data
With respect to
possession or control, the Court found that OVH Canada had enough of a
connection to the information — including prior instances where it assisted
police, and the ability to preserve data — to justify the authorizing judge’s
conclusion that it had “possession or control.”
The second question was whether there was jurisdiction over OVH Parent
Regarding
jurisdiction over OVH Parent, relying heavily on the Brecknell, Love,
and textPlus decisions, the Court held that:
●
A company may be subject to
Canadian jurisdiction without physical presence
●
A “virtual presence” or “real and
substantial connection” can be enough
●
OVH operates data centres in
Canada
●
OVH’s website presents itself as a
unified global business
●
Therefore, the French parent was
sufficiently connected to Canada
The third question
was about the effect of the French Blocking Law
The Court accepted
French government statements that the French blocking law applied, but it found
it could be largely disregarded because (a) The law has been rarely enforced,
(b) There is no “real risk” of prosecution, and (c) Courts in other countries
have treated it as an “empty vessel”. Yup. It’s a law but let’s largely ignore
it.
The next question was whether the police should go through the mutual
legal assistance process instead of a production order. The judge held that the
MLAT is not mandatory, it can be slow and it is not mutually exclusive with
domestic orders. The police can choose door A or door B. Their call.
In the final step,
about discretion, the judge upheld the production order against both OVH Canada
and the French parent, concluding that: (a) OVH Parent has a real and
substantial presence through its “virtual presence” in Canada; (b) The risk
under French law is minimal, and (c) The national security interest outweighs
comity concerns.
In a nutshell,
that’s what the court decided. And I think it’s deeply flawed.
There are, in my humble opinion, major problems with this decision. And
they don’t just affect OVH Parent. It will have a big impact on Canada’s own
attempts to assert data sovereignty.
The first problem is following the BC Court of Appeal decision called Brecknell
The Court relies on
Brecknell as though it stands for a broad doctrine that Canadian courts
can compel any foreign service provider operating online to disclose
foreign-hosted data as long as the company is “virtually present” in Canada.
Brecknell is a 2018 case from the British Columbia Court of Appeal. In that
case, the police wanted some data from Craigslist. They contacted Craigslist,
who said “come back with a production order and we’ll happily give you the
data.” So the police go to the court to get their production order and the
court says that it can’t issue a production order directed at a company outside
of Canada. So the police go to another court and get the same answer. So the
police appeal that, and end up in the British Columbia court of appeal. The
British Columbia Court of Appeal said that Canadian courts can issue production
orders naming companies outside of Canada, as long as they have a “virtual
presence in Canada.”
But in the Brecknell
case, Craigslist — the target of the order — had already agreed it would comply
with Canadian court orders. Through counsel, Craigslist said: “If we get an
order, we will respond.”
This is not a small
detail. This is the very foundation of jurisdiction in that case.
In other words:
Craigslist voluntarily accepted Canadian jurisdiction.
With that fact,
jurisdiction really should not have been an issue. Craigslist said “we have the
data, just bring us a production order.”
This is not the
situation with OVHcloud. OVH France explicitly said:
●
We do not accept
jurisdiction
●
And we are prohibited by
foreign law from producing it
OVH Cloud also
said, we have the data and we will preserve it for you so you can get it
through the established, diplomatic, country-to-country channels.
I am of the view
that Brecknell was wrongly decided and this entire line of cases is
problematic. We’ve gotten here, I think, they are largely “ex parte” appeals.
Craigslist was not at the hearing for the production order. They were not at
any level of court. Until the court of appeal, it was just the cops and the
prosecution arguing for jurisdiction. At the court of appeal, an amicus was
appointed who did a commendable job.
This line of cases
also reaches the conclusion that this is the sort of situation that production
orders are designed to address. And they are partially right, but again they
suffer from generally only hearing from prosecutors on these questions.
The idea behind a
production order is that the court can order someone to hand over data or
produce data. It is distinct from a search warrant, where the court clearly has
to have jurisdiction over the place to be searched and the police need
authority as police officers to search the place. Places are physical. There is
no way under recognized international law for a judge in Ontario to give the
RCMP in Ontario a warrant to search premises in France for these records. If
they were to show up in Paris with their warrant, they’d likely be arrested by
French police for trespassing. And we’d have an international incident. It
would be the same as sending the RCMP to France to arrest someone without the
cooperation of the French government. It’s just not done.
Production orders
were created so that a person or entity within the court’s jurisdiction can be
ordered to produce a record that is under that person’s control. And that
generally operates regardless of where the record is. But this depends on the
person being within the court’s jurisdiction. It’s a great alternative to a
search warrant because it’s not based on the police searching for something,
but telling a person to provide data that they control.
A key principle of international law as applied in Canada is that Canadian law does not operate extraterritorially unless Parliament explicitly provides for it. The B.C. Court of Appeal in Brecknell did note this at paragraph 23, but failed to identify any parliamentary signal indicating that production orders were intended to have effect on persons wholly, physically outside of Canada.
[23] The need to interpret the section in light of restrictions placed on extraterritorial effects is uncontroversial. The fundamental principles were canvassed in R. v. Hape, 2007 SCC 26. There, Justice LeBel identified a number of settled but important principles. First, customary international law, which has been adopted domestically, limits the actions a state may legitimately take outside its borders. Customary international law is based on respect for the sovereignty and equality of foreign states. Sovereign equality commands non‑intervention and respect for the territorial sovereignty of foreign states. Nonetheless, Parliament may legislate “extraterritorially” in violation of those principles provided it does so expressly: see paras. 35‑46.
...
[30] The section is silent on issues to do with extraterritoriality, and it is silent on any question dealing with the location of the documents. Section 487.019(2) may offer some assistance by stipulating that, unlike search warrants, the order has effect throughout Canada without requiring endorsement if executed in another jurisdiction. The section reads:
487.019(2) The order has effect throughout Canada and, for greater certainty, no endorsement is needed for the order to be effective in a territorial division that is not the one in which the order is made.
It appears to me that this section is addressing a difference between search warrants and production orders. It does not directly deal with extraterritorial issues.
The Brecknell court wrongly disregarded the inability to enforce the order against a company like Craigslist. The issuance of a production order extending outside Canada is an exercise of enforcement jurisdiction, which violates international law and Canadian domestic law absent clear authority from Parliament. The difference between an “order” and a “request” is the ability to put someone in the defendant’s dock for not following it. A Canadian production order directed at a non-Canadian company has a real potential to offend comity and the other country’s sovereignty.
So what about
Mutual Legal Assistance Treaties (called MLATs)? These are the existing,
agreed-upon mechanism for Canadian police to obtain data from non-Canadian
companies. In circumstances where an order might offend comity and sovereignty,
MLATs are how countries decide to deal with the issue.
The effect of
privacy laws or blocking laws were not at issue and were not considered – but
probably should have been – by the Brecknell court.
In the OVH case,
the court refers to the case of The Queen and Love from the Alberta Court of
Appeal (R v Love, 2022 ABCA 269), which was a case dealing with the
admissibility of data that had been produced by Facebook from the US pursuant
to a production order. It was not an application to vary or revoke an active
production order. The Love court followed Brecknell. Again, what’s
missing is the fact that Facebook provided the data pursuant to that order.
Their policy – like most big US tech companies – is that they will follow
Canadian legal processes voluntarily where they can do so consistent with their
obligations under US law. By and large, Facebook’s voluntary cooperation should
have made jurisdiction a non-issue in that case.
The OVH judge also
refers to a case involving TD Bank from Quebec (Banque Toronto Dominion c. Cour
du Québec, 2025 QCCS 2094). In that case, a big issue was whether TD Bank in
Canada could be ordered to produce records held by one of its foreign subsidiaries.
The Court concluded it had sufficient control over the subsidiary to require
the production of the records. That’s the inverse of the relationship between
OVH Canada and OVH Parent. A subsidiary does not control the parent company.
So to use Brecknell
as if it resolved this question is — frankly — a misreading of the case.
Problem 2 — The Court Treats Ordinary Corporate Structure as a Legal
Fiction
In addition, the
decision disregards the fundamentals of second year law school “Business
Associations” to treat OVH as effectively one entity, leaning heavily on:
●
OVH’s branding
●
The fact “it” has data centres in
Canada
●
The “collaborative language” on
its website
●
Shared legal services
●
The appearance of a global
enterprise
But this
misunderstands how multinational cloud companies operate and how corporate law
applies.
I sometimes think
that some practitioners who spend all their time focused on criminal law forget
the fundamentals of corporate law.
Corporations are
separate legal persons. Subsidiaries are not
automatically global agents of the parent company. And cloud marketing — “our
global infrastructure,” “our data centers around the world” — is not a legal
admission of control. It’s marketing.
Corporations are
separate legal persons and this corporate separateness is generally only
disregarded where there is actual fraud going on.
If courts treat
branding copy as determinative of “control,” then:
●
Any cloud provider operating in
Canada
●
With foreign infrastructure
●
Could be compelled to produce
foreign data
●
Regardless of its actual legal
authority to do so
This collapses
corporate separateness in a way that is deeply inconsistent with both Canadian
corporate law and international norms. Which leads directly to the next
problem.
The Court points to a previous investigation where OVH Canada provided subscriber information for a German-hosted IP address to suggest that OVH Canada effectively has access and control over it.
But OVH explained —
and this is common across the industry — that:
● The Canadian subsidiary assisted because doing so was legally safe
● There was no blocking law that stood in the way
● The foreign affiliate voluntarily cooperated
This demonstrates cooperation,
not control.
Access that is permitted
by a foreign affiliate is not evidence of legal authority to compel access.
If you need a
particular tool for a project, and I don’t have one but my parents do, I may
facilitate YOUR borrowing it from MY parents. That doesn’t mean I have control
over that tool.
OVH Canada receives
a production order for data that is under the control of its parent company.
Rather than say “go to France”, OVH Canada facilitates the parent company
producing the data in circumstances where it is lawfully able to do so. It’s
called being helpful, and should not lead to the conclusion that the subsidiary
has any possession or control of data that’s entirely in the possession and
control of the parent company.
By treating
occasional past cooperation as proof of control, the Court dramatically expands
what “possession or control” means. After this, it would be prudent for the
Canadian subsidiary of a foreign corporation to tell Canadian police to just go
pound sand, rather than facilitate matters through internal channels.
This is perhaps the most troubling aspect of the decision: The Court
Minimizes Foreign Law Because It’s “Not Enforced”
The Court
acknowledges that the French blocking law applies. The French government —
through the “Service de l’information stratégique et de la sécurité
économiques” (SISSE) — which administers and enforces this French law explicitly
said so.
But the judge
concluded it doesn’t really matter because the French law is apparently rarely
enforced, the Canadian prosecutors said there’s no “real risk” of prosecution
and other courts have treated it as an “empty vessel”.
I think this
approach is dangerous.
The rule of law
depends on courts respecting what the law is, not how often a prosecutor
decides to enforce it. A foreign state’s policy choices about enforcement:
●
Do not change the meaning
of the statute
●
Do not change OVH’s legal
obligations under French law
●
Do not give Canadian courts
authority to override foreign legislation
A law is a law. I
know dozens of Canadian laws that are rarely enforced, but they still need to
be followed. Remember, this is a Canadian court shrugging off a law duly
enacted by an allied country, France.
If Canada wants
foreign law to bend, the proper channel is MLAT — a mechanism built
through mutual consent — not unilateral judicial action.
International comity is built on reciprocity. If Canada orders French
companies to violate French law, then:
●
Other countries may order Canadian
companies to violate Canadian law
●
Canada will have no principled
basis to object
●
Global cloud providers will face
impossible conflicts
●
And privacy for Canadians abroad
will be weakened
Remember, this is
happening at the exact time that the Canadian government is focused on Canadian
“Digital Sovereignty”. We would find it incredibly offensive if a French or
Chinese court were to order a Canadian company, in Toronto, to violate Canadian
law.
MLAT exists precisely
for situations where:
●
The data is located abroad
●
A foreign statute prohibits
disclosure
●
And the foreign state must
authorize or supervise the production
France explicitly
told Canada it would expedite the MLAT request. Refusing to use MLAT
because it might be slow is not a justification for disregarding foreign law.
In this case, there is no doubt that the data exists, that France will provide
it via the MLAT and will do so speedily. Ordering OVH in France to break French
law is unnecessary, unreasonable and – in my view – gratuitous.
This decision is important, but in my view, it’s also misguided.
By stretching Brecknell
beyond its facts, by treating global branding as evidence of legal control by a
local subsidiary, by using past cooperation as proof of present authority, and
by dismissing binding French law because it’s “not vigorously enforced,” the
Court has weakened the principles of comity, corporate separateness, and legal
certainty.
While Canada is
getting excited about “digital sovereignty”, the RCMP, these prosecutors and
the court are disregarding France’s explicit law about its own “digital
sovereignty.” This is a dangerous precedent to set. After this, why would
France give a toss about Canadian laws designed to protect Canadian data?
There is a
lawful path — MLAT, letters rogatory, diplomatic channels — and international
cooperation depends on states using those channels rather than overriding each
other’s laws.
And one important
thing to remember: OVH is not suspected of committing any crime. It simply has
records about someone that may be relevant for a Canadian investigation. It is
not hiding behind a veil of French law to shield itself from liability. It is an
entirely innocent third party that is getting dragged into a Canadian
investigation, and is now being ordered to violate the law in the country where
they are based. And that order is entirely unnecessary, since France and Canada
have already negotiated a clear path to get access to this data without
violating anyone’s laws.
I understand the
case is being appealed – and rightly so. I’ll be keeping an eye on it.
No comments:
Post a Comment