Canadian data order risks blowing a hole in EU sovereignty

A Canadian court has ordered French cloud provider OVHcloud to hand over customer data stored in Europe, potentially undermining the provider's claims about digital sovereignty protections. According to documents seen by The Register, the Royal Canadian Mounted Police (RCMP) issued a Production Order in April 2024 demanding …

[Dan 55]

Hang on

OVH said here in July:

"OVH Group abides by local laws in the countries it operates in. As such, OVH US may be subject to requests from American authorities within the framework of the Cloud Act as long as these demands are connected to customers of OVH US and are strictly compliant with applicable American law. The French OVH entity (or its European subsidiaries) is not subject to the Cloud Act, the Patriot Act or the FISA."

Somehow Canada has the legal tools to force OVH's Canadian subsidiary to give up data in the EU but the US doesn't?

I think what we were told back then was not strictly the vérité.

[abend0c4]

Re: Hang on

Even if the legal tools did not presently exist, it would be possible to create them. I guess you could put protections into the MLATs to discourage this kind of end-around, but, if a jurisdiction is sufficiently motivated it will find the means to coerce one way or another.

[Doctor Syntax]

Re: Hang on

I'd guess that the end-run was attempted because the case didn't meet the protections in the MLAT.

I'm looking forward to hearing about the Canadian ambassador being called in to the French foreign ministry to explain why a Canadian court is trying to override French law or maybe a French court issuing an arrest warrant and request for extradition of the judge. If "sovereign" is to mean anything then it's got to be defended in this way if need be.

[John Brown (no body)]

Re: Hang on

" If "sovereign" is to mean anything then it's got to be defended in this way if need be."

And France are typically the ones to do it. They are very proud of being French and will defend their sovereignty.

[Claptrap314]

Re: Hang on

You owe me a keyboard. :P

Have one ------------------->

[Anonymous Coward]

Re: Hang on

It won't do much good, though. Canadian governments have no ability to compel the courts to do anything. As it should be in any functional democracy.

[Doctor Syntax]

Re: Hang on

I'd guess they do have considerable power to compel the RCMP to back off.

Alternatively to argue put in an amicus appearance to argue that the order should not be allowed on various grounds, one being that courts should not stray into matters which are properly the realm of international treaties and another being that they really do not want a precedent set which would allow their spray-tanned neighbour to delve into Canadian affairs.

[Fred Daggy]

Re: Hang on

If the treaty was properly enabled by law (or other legal framework), I guess that would/should be uncovered by an appeal?

If would be at least one of the methods OVH should be looking up to help CYA.

Or, is the RCMP very good at finding a loophole between treaty and law?

[Anonymous Coward]

Re: Canadian governments have no ability to compel the courts to do anything

Really? where do you think Laws come from? The Law Tree? The courts aren't controlled by government but the laws they implement are. A law saying "You cannot demand access to data that isn't hosted in this country" would force the courts hand, no?

[The man with a spanner]

Re: Hang on

Is it not the case that

The Canadian court goes to OVHC and demands the data.

OVHC say, sorry mate that data is the property of someone else (OVHF) and we have no physical access to it - go and talk to them.

Canadian court goes to OVHF and demands the data, and OVHF point out that the data is in France under French law and that thay can only release it if ordered by a French court.

The court can get stroppy with OVHC but ultimatly a subsidiary has no leverage over the parent that resides in a completly seperate juristiction. You cannot hold someone in contempt of court when they have no responsibility and no way of implementing the request even if they wanted to. The only circumstance a sovereign countries court can impose its will in this context is if the country (Canadal) is going to back the court up and bully OVHF and France.

That sort of approach is more the perogative of the good ol' USA under the Donald (Duck) Dictatorship..... (Sound of angry duck noise on the right.)

[Phil O'Sophical]

Re: Hang on

It sounds to me that the problem is that OVHC does have physical access to the data held in France, they're just being told by OVHF not to touch it because of internal sovereignty rules.The Canadian courts are ordering OVHC to reach in and grab it anyway.

One option might be for OVHF to firewall off the Canadian subsidiary's acces, if that can be done quickly and in a way that doesn't break their customers' applications. A big if.

[Dan 55]

Re: Hang on

This is exactly the set of circumstances which led to the CLOUD Act in the US. Perhaps an excuse for Canada to pass a similar law?

[Ken Hagan]

Re: Hang on

A court ought to be willing to recognise the distinction between "I can do this." and "I am allowed to do this.".

[Anonymous Coward]

Re: Hang on

Legal folk are amongst the most technically illiterate I have every encountered. Would not be surprised that the court has not idea what it is actually asking

[Doctor Syntax]

Re: Hang on

It depends what legal folk you're looking at. That might apply to you local solicitor. OTOH you'll find counsel and judges handling extremely complex matters.

[DecyrptedGeek]

Re: Hang on

Doesn't GrapheneOS think otherwise. They are moving off of their Canadian OVH servers because French Police are trying to compel them to add a backdoor.

[rg287]

Re: Hang on

Somehow Canada has the legal tools to force OVH's Canadian subsidiary to give up data in the EU but the US doesn't?

...

I think what we were told back then was not strictly the vérité.

The US subsidiary is more technically and legally separated, presumably because of the PATRIOT/CLOUD acts.

IIRC an account on OVH US can only spin up services in their US regions. A regular OVH account anywhere else can spin up services in any region except the US. It's an entirely separate entity running parallel infrastructure.

I'm still surprised that an order against OVH Canada is met with anything other than "We do not have the technical ability to access data held by our parent company on another continent.", but it sounds like there's insufficient separation (either an internal policy matter, which the Canadian court is ordering them to ignore, or none at all). Any contempt of court prosecution would be contentious - every executive in every Canadian subsidiary of a foreign firm would suddenly be very nervous about potentially being ordered to leak information from their parent, or being prosecuted for "refusing" to hand over information they literally don't have access to. The business associations would riot.

As Charlie Clark mentions though, it doesn't need to go to full CoC charges. It's a matter of whether they can pressure OVHC/F with threats of sanctioning OVH in Canada.

[OhForF']

Re: Hang on

Giving technicians based in Canada access to other regions allows them to support those regions during normal working hours in Canada. OVH did probably not set up separate teams and infrastructure for Europe, North America, Africa, Singapore but tries to balance both work and other load between the regions.

While they do mention "enhanced compliance" and "Improved data compliance" ¹ for their Local Zones in Public Cloud they can probably not guarantee data sovereignity any more than Micros~1 can.

¹ What does "enhanced" or "improved" compliance mean? You are either compliant or you are not.

[FirstTangoInParis]

Re: Hang on

Guess there should be a difference between technicians accessing hosts for management purposes (eg move that instance from here to there) and techs accessing hosts to directly access customer data. This is where we find out what safeguards are in place.

One day someone is going to come up with a cloud image that is encrypted by default so no outsiders can access it unless you have the SSH keys or better.

[TotallyInfo]

Re: Hang on

"One day someone is going to come up with a cloud image that is encrypted by default so no outsiders can access it unless you have the SSH keys or better."

You can already do that in Azure at least. Customer held encryption keys are a service available to Azure.

[Strahd Ivarius]

Re: Hang on

And where are held the keys?

On a public GitHub repository, as per the current standards?

[jbrnd]

Re: Hang on

"cloud image that is encrypted by default": how would you expect that to work? More precisely, how are you planning on supplying the encryption key in a way that can't be intercepted by the host?

The only way I'm aware of is to use secure virtualization CPU functionality and that assumes that (a) the provider offers this in the first place and (b) that functionality doesn't have any vulnerabilities (which it does, at least for Intel and AMD).

[Doctor Syntax]

"But refusing the Canadian order risks contempt of court charges."

I'd have thought that that would be the easier alternative to defend. The Canadian arm can ask the French HQ for the information and can report refusal. It would surely be up to the prosecution to demonstrate that the local office has authority over HQ to do more, especially as a MLAT route exists.

[Charlie Clark]

It's more complicated than that with multinational companies and their subsidiaries. The courts in Canada know very well that they can apply pressure on the subsidiary to get the parent to comply. The threat of contempt is initially not that serious, but it could escalate to sanctioning the whole business.

However, the OVH as a French company must comply with French and EU law and France could easily turn this into a matter of "national sovereignty" in which case, the contempt case would be dropped. But nobody wants it to go that far. I suspect, some kind of fudge where a French judge is asked to decide on whether the data can be released, and under what conditions it is made available.

[Doctor Syntax]

"But nobody wants it to go that far."

I'm not sure about this. There's considerable danger of setting a precedent, even if it's a precedent for the sort of fudges you suggest. At some point countries - and that includes Canada - need to defend their electronic borders or just accept that such borders don't exist. I doubt they - and again, that includes Canada - want the latter.

[Anonymous Coward]

Ah, but that's what they're demanding, isnt' it.

Also, the CLOUD act isn't worth the paper that was print on, outside of the US.

[Dan 55]

Of course it is, why do you think people are moving away from AWS, Google, Azure, and other US providers?

[Claptrap314]

Funny, though, how that move somehow only started after seven years.

Europeans wanted access to US-developed and provided cloud sweetness, but didn't want the US government to apply their rules.

Not really crying here...

[kmorwath]

Not surprisingly - in the past European could expect US would follow at least its own rules, and courts would review requests - now the "new" MAGA USA has shown that rules are only the ones Trump and his ilk decide day by day.

US developed and provided cloud didn't come nor free nor cheap.

[nobody who matters]

"why do you think people are moving away from AWS, Google, Azure, and other US providers?"

Because they are US providers storing data on US servers and therefore both they and the data they store in the US are subject the Cloud Act. Others outside the US are moving away from them because the Cloud Act has no jurisdiction outside US territory ie. for people outside the US and storing their data with non-US companies on non-US servers the Cloud Act is indeed "not worth the paper it is written on".

[Anonymous Coward]

Even if data is stored outside of the USA, as long as it is managed by a subsidiary of a company with its HQ under US jurisdiction it can be accessed under the CLOUD Act.

The orders go to the parent company.

This will be solved only when all US IT companies move their HQ in a fiscal paradise.

But of course then they won't be able to compete for US government contracts (the ones where you get money and don't have to deliver).

[TechnicalVault]

This is why gov clouds are requiring administration access restricted to their cleared nationals

The advantage of having your own nationals do it is that you can make them sign the Official Secrets Act. If they then hand data over to the US, even under orders from their company superiors, they can and will be charged with treason.

[Doctor Syntax]

"Ah, but that's what they're demanding, isnt' it."

It depends on who "they" are. An RCMP officer will have a narrow view of the issues and the court to whom they apply is unlikely to have a much wider view. If anyone starts thinking about the national security issues of setting a precedent it might not be something they want to demand.

It's a case of being careful fo what you wish for.

[VoiceOfTruth]

This sort of thing makes the law irrelevant

If I have a house in Canada, can the courts in Canada issue a search warrant for my house in France? I would say a big FU to the Canadian judge.

Next up, don't buy Canadian in Europe.

[TotallyInfo]

Re: This sort of thing makes the law irrelevant

They absolutely could - if they went through the correct international law enforcement cooperation channels. But not directly.

However, they could revoke your visa/residents permit or whatever so that you could be marched out of Canada, never to return.

[tmTM]

Treaties

What's the point in having treaties if local law enforcement think they can ignore them?

Seems like time Politicians got off their arse and spoke to each other to ensure these requests go via the agreed route?

[Joe W]

Re: Treaties

Exactly. We have these treaties, and the bureaucrats can and do talk to each other, and the paperwork can totally be filed for this.

Use. The. Bloody. Procedures.

[mevets]

Re: Treaties

Its not about treaties; it is about bad business behaviour.

If OVH capitulates, the story is over.

If OVH asserts that it has a spine ( which is why you are reading this ), the RCMP will have to do some actual investigation, rather than merely fishing.

Its a bit of an epidemic here; Canada has relatively tight rules about information, but that doesn't stop banks from handing over financial records without a shred of process.

[Decay]

Re: Treaties

Or freezing peoples bank accounts because the government is feeling aggrieved

https://www.forbes.com/sites/siladityaray/2022/02/23/canada-begins-to-release-frozen-bank-accounts-of-freedom-convoy-protestors/

"Isabelle Jacques, Canada’s assistant deputy minister of finance, told lawmakers on Tuesday that a vast majority of the locked accounts are now in the process of being released.

Jacques told a parliamentary committee that up to 210 bank accounts linked to the protestors—with cumulative holdings of C$7.8 million ($6.12 million)—had been frozen under the country’s emergencies act."

https://www.jurist.org/news/2024/01/canada-dispatch-federal-court-judge-rules-government-lacked-authority-to-invoke-emergencies-act-over-freedom-convoy-breached-charter-rights/

"Further, the court concluded government violated the Charter rights of convoy participants who had their bank accounts frozen. Mosley ruled that the federal government’s order empowering banks to freeze the accounts of those violating the emergency regulations and directing banks to provide violators’ information to the RCMP constituted an unreasonable search and seizure. The justice reasoned that the freezing of accounts constituted a “seizure” and that the order to provide the RCMP with blockade participants’ banking information was a “search.” Mosley held that the searches and seizures were unreasonable as they were not carried out according to an “objective standard.”".

[M.V. Lipvig]

Re: Treaties

Very nice set of paragraphs. Meaningless, unless followed by something along the lines of, "Joe Schmo, who ordered the accounts frozen, has been arrested and will be tried for exceeding his authority. If found guilty, the penalty is 20 years."

[Doctor Syntax]

Re: Treaties

"Seems like time Politicians got off their arse and spoke to each other to ensure these requests go via the agreed route?"

My guess is that it's probably rather like the case that brought about the US CLOUD Act, a fishing expedition which wouldn't be allowed under the treaties.

[Blue Shirt Guy]

Re: Treaties

"Seems like time Politicians got off their arse and spoke to each other"

Do Canadian and French politicians even speak the same language? :-)

[EnviableOne]

Re: Treaties

The French might, but they wouldn't admit to it in front of anyone.

They will do their usual and say "Je ne comprends pas le français que vous parlez."

followed by "Je ne parle pas anglais"

[Anonymous Coward]

Re: Treaties

Tabernacle!

[Potemkine!]

Re: Treaties

Pourquoi le Canadien ne parlerait-il pas français, tout simplement ?

[may_i]

A clear case of not doing your homework

Surely OVH's legal department should be aware of the risks of having subsidiaries in countries outside the EU?

This is a rather embarrassing case of not having thought things through and examined all the ramifications of opening a foreign subsidiary. There's also a distinct taste of a Canadian judge who likes to throw their weight around and who seems to think her commands should carry weight outside of Canada, just because.

The correct answer from OVH France is "Non", "Use the defined MLAT treaty" and possibly followed by shutting down their Canadian subsidiary.

[VoiceOfTruth]

Re: A clear case of not doing your homework

>> shutting down their Canadian subsidiary.

It may come to that. We need to do the same for every American and Canadian company in Europe too.

[Doctor Syntax]

Re: A clear case of not doing your homework

"Surely OVH's legal department should be aware of the risks of having subsidiaries in countries outside the EU?"

You could say the same about all the big US companies and the EU or anywhere else that has reasonable privacy laws.

[Anonymous Coward]

Re: A clear case of not doing your homework

No, there's an asymmetrical application of law there.

Under the US CLOUD Act (et al, there are in total something like 7 or 8 laws that can be used), you can be compelled to hand over data held in any EU entity as long as the US can prove even a tentative link to the US. If you have but a dog and a shed there, or even have any link to investment of US origin you can be compelled on pain of serious legal problems. If you want data kept safe, do not have any connection with the US or it's pretty much open season. That said, I know of companies whose US division run a completely separate data centre for US data so there's no provable technical link, but that's more to prevent creative intercept, I don't think it provides enough cover in the legal sense.

The EU does not have reciprocal arragements because they actually recognise the idea of sovereignity whereas the US has never done, even before the current Agent Orange got his hands on the controls.

That said, even if the US didn't make some laws that flat out ignore sovereignity, its government is not above pressure tactics to get what it wants, legal or not. Plenty of history there.

[Doctor Syntax]

Re: A clear case of not doing your homework

I follow your point about the asymmetry.

However, by having subsidiaries which are close enough to be affected by the CLOUD Act the US corporations are in a situation where their customers, particularly at Govt. level, are starting to get worried. This is the risk.

I've long thought that a better arrangement would have been to have used a franchise arrangement whereby an EU owned and operated company provides the service under licence and subject to a contract under EU law enforcing EU privacy legislation. Given where Microsoft and Amazon are based I'd have thought there would be a few local lawyers familiar with setting up franchise arrangements which would be well able to to extract good returns for the IP being licences.

[M.V. Lipvig]

Re: A clear case of not doing your homework

A franchise agreement would not work, as a franchise is legally tied to the franchisee and therefore can be compelled.

About the only way it could work is if the software were made open source, then forked. How likely is it that any of these US companies would be willing to do that? Face it, Europe will either have to grow their own or suck that d*** when their candy man says get on yer knees.

I'm really hoping Europe grows their own before we all get Borged.

[Anonymous Coward]

Re: A clear case of not doing your homework

"I'm really hoping Europe grows their own before we all get Borged."

... or, at least, a pair.

[Anonymous Coward]

Re: A clear case of not doing your homework

I have a complete project plan and IP ready for that, but it has proven idiotically difficult to find decent safe investors for it without either having to hand over 90% of control (in which case it won't work because there are really a metric boatload of variables in company setup, management and required legal structures that needs to be controlled to set it up) or without discovering that prospective investors are fronts for US private equity setups that do see the potential but don't see that they themselves form the risk.

That's why there are so few startups in Europe. Even a project that has been analysed by a bank to have an ROI of about 100x in 3..5 years with going into the black when it hits 0,5% of its target audience doesn't get off the ground. Getting 5M to get a pretty normal bricks-and-mortar type setup that just works and sells is hard, getting 1B to waste on fashionable AI is easier.

Weird and annoying. It's a frigging open door if you know the whole picture and it's getting worse for Europe as a lot of security setups are bought out by US entities with leveraged capital (think of it as a chain of loans, a bit like how some real estate portfolios are built up). One failure and we'll be without EU companies to protect ourselves.

[Doctor Syntax]

Re: A clear case of not doing your homework

"a franchise is legally tied to the franchisee and therefore can be compelled."

The tie is defined by contract. In what way would a contract drawn up and signed in, say Germany, subject to German law for and limited to the use of Yankcorp IP in return for fees require the franchisee to do something not in the contract but demanded by someone outside of Germany?

[Anonymous Coward]

Re: A clear case of not doing your homework

The problem is that you're dealing with what is left of US law. It is not only partly dependent on who has the better lawyer or more money to blow on legislation, the main issue is that it tends to very much favour the US side of the discussion.

That's not how it's supposed to work, but that's the reality, especially if intelligence services are involved :(.

[M.V. Lipvig]

Re: A clear case of not doing your homework

Yeah, we are the 600lb gorilla in the room, aren't we?

[Strahd Ivarius]

Re: A clear case of not doing your homework

OVH was likely expecting that Canada would follow the existing treaties.

Not to go full Trump on the matter.

[Anonymous Coward]

Sovereignty??

.....but multiple state-based bad actors REGULARLY hack anything connected to the internet!

.....or anything connected to the mobile phone network! (Remember Jamal Khashoggi??)

This "sovereignty" chatter is simple misdirection! The operatives at Hubble Road (or Fort Meade) have

the tools to ignore all this "sovereignty" business!!

[alain williams]

Who can the Canadian courts make do things ?

A Canadian court can order someone in Canada to do things. This can include accessing data that their French bosses have told them to not look at.

So when a Canada resident tachie tries to access data but finds that s/he cannot access it (computer security systems say "no") then that techie has tried to fulfil the order to the best of his ability. That s/he could not get the data is not their fault.

Ball back to the Canadian court, what can it do ?

• Imprison the Canadian techie. But s/he tried his best to obey the order. I suspect that an appeal would get them out (Canada is not Trump's USA).

• Send an order to OVHcloud in France. That will simply say that French laws prevent it from obeying the order; anyway we are not subject to foreign court orders. Take us to court in France, this would go no where.

• Close down OVHcloud in Canada until OVHcloud in France obeys the order. This is likely to spark an international incident.

Me: I will stock up on popcorn until this is resolved.

[Doctor Syntax]

Re: Who can the Canadian courts make do things ?

"This is likely to spark an international incident."

Whether this particular case is the one that does it this needs to happen. Governments have allowed the whole issue to fester for far too long with privacy fig-leaves and the like. It needs to be sorted out by international agreements which bind national courts as to what they can and can't do.

[JimmyPage]

Any legal issues are secondary

to financial ones.

[Tron]

This should be judicial overreach.

This judge is ordering a Canadian entity to break French law. Judicial systems generally don't do that.

[Claptrap314]

Re: This should be judicial overreach.

Why on Earth not? If you are a Chinese entity, you are PRIMARILY subject to Chinese law. Why should a Latvian judge care about what a Maltese law says when ordering a Latvian entity?

You've got the concept of sovereignty backwards.

[wolfetone]

Ah now Canada, don't be acting like the Yanks.

[Groo The Wanderer - A Canuck]

If you have a subsidiary in a nation it is subject to that nation's legal system first and foremost. Being a foreign owned business does not escape liability. There's no need to go through treaties for the request because the request is being made of a legally-Canadian business.

[Doctor Syntax]

If the legally-Canadian business doesn't legally have access to data where it's held in a legally-French business it's not so simple.

[Excused Boots]

Or if they technically simply don’t have access to that data, because the parent company (in the EU) has removed the access to it from their Canadian subsidiaries. Then what can the Canadian Courts do?

[Claptrap314]

More-or-less anything they want--to the Canadian entity.

[Androgynous Cupboard]

You got a bunch of downvotes but you’re one of the few people here that get it.

Canada can get what they want by putting pressure on OVHC, which they will do on whichever way is most effective. The impact this has on OVH or France or anyone else is not their problem.

I don’t know what the short term answer is but the long term answer is use a different corporate structure.

[Doctor Syntax]

"Canada can get what they want by putting pressure on OVHC, which they will do on whichever way is most effective."

No amount of pressure gets blood out of a stone. If it more valuable to OVH to write off the Canadian venture than give in then they'll do that.

[stiine]

obvious solution

Just get the DGSE involved.

[Excused Boots]

Re: obvious solution

Just get the DGSE involved.

What sink a couple of Canadian ships in harbours?

[seven of five]

Re: obvious solution

British ones, privately owned. Because traditions have to start somewhere...

/s

[seldom]

Re: obvious solution

But where are they going to find agents so clever that they manage to get pregnant in a maximum security jail in New Caledonia.

[Strahd Ivarius]

Re: obvious solution

Go after the strategic maple supply!

Canada will fold before you can say "Maudit niaseux".

[M.V. Lipvig]

An issue...

... between Canada and France/EU. Why exactly was the US mentioned even once, much less have several paragraphs dedicated to it, when the US is not part of either side?

[Dinanziame]

Re: An issue...

Because a similar scenario has happened with the US before, and the issue of EU trying to protect the private data of its citizens from US judicial orders is a decade-long soap opera with way more ramifications and importance. The way this story turns out has implications for the larger story. It's important context.

[Claptrap314]

Be careful what you wish for indeed...

I'm always confused by these arguments.

A court in Mali is going to apply the law of Mali to any entity that has a presence in Mali. That would include fleeting presences, such as flying over in an airplane or sending a signal through some wires.

The government of Costa Rica is going to apply to the courts in Costa Rica in order to encourage a reluctant entity with a presence in Costa Rica to comply with the government's expectations.

The entire point of these national subsidiaries is to limit the blast radius of an adverse action by the national government to just that subsidiary.

Multinationals only bother with them if they suspect that they might do something that a national government doesn't agree with.

So why are people instinctively siding with a multinational money grubber over and against a limited popular government?

I do NOT see long-term good things happening if the multinationals are able to run over national governments.

And confused that others seem to disagree.

In this particular case, the courts are accepting the claim of national security. Yes, we can and should suspect these claims. But the court has accepted it in this same.

Just...confused.

[astaros]

Re: Be careful what you wish for indeed...

Maybe but that doesn't change the main point that Canadian subsidiary has no legal access to the data. Even if they technically could access it which is questionable at best it would probably be illegal even under Canadian law and certainly under French law. To me this sound like state sponsored mob tactics, commit a crime for us or else... The subsidiaries are there to limit liabilities for situations like this where one overreaching government thinks they rule the planet. Sadly most companies fold under pressure of financial loss in that country and governments get what they want, here at least the EU legislative wont let them just bend over openly because GDPR fines are also insanely large if the person of interest is EU citizen.

If I project the same situation on Canadian mother and Russian subsidiary you wont like the situation one bit. How would you like if for example Russian court ordered Canadian bank that also operates in Russia via a subsidiary to release all your personal data to them with dubious explanation of why they need them? Not very much I would imagine. Most people would be probably angry at the company and demand how could they give uncontrolled access to the subsidiary they as a client have no contractual relationship with, followed by screams about how that cant be legal.

For me at least this is the preferred outcome and the democratically elected government can go sulk in corner. I am by no means defending corporate interest only advocating for personal freedoms of citizens from overreaching foreign government apparatus.

[Claptrap314]

Re: Be careful what you wish for indeed...

Again, why are the multinationals the good guys & the governments the bad guys?

Certainly, the purpose of the subsidiary is to firewall off the parent corp from the demands of the nation in question--doesn't mean it's going to work.

Like it or not, if I chose to do my banking with a company that has a presence (directly or not) in some place whose de facto legal system is objectionably, I'm not naive enough to think that I'm immune. People can be nasty. Governments very, very nasty. Corporations very, very nasty. I try to choose wisely.

[Doctor Syntax]

Re: Be careful what you wish for indeed...

"So why are people instinctively siding with a multinational money grubber over and against a limited popular government?"

Because it's about due process of law. There is a process whereby the RCMP can try and get the information. They haven't done. They've tried to take a short cut.* They're trying coercion.

I do not believe short cuts and coercion in law enforcement are a good thing.

It's also about data and trust in suppliers to safeguard customers' data that they're paid to look after.

Put those two things together and they're trying to crate a precedent that could, in the end, be harmful to any one of us if the protection of due process of law is weakened. They're trying to put what remains of Magna Carta in the shredder.

* I suspect this is because they don't have a case that meets the criteria for access. There will be safeguards built in.

[JimmyPage]

With all of this pantomime

Why are firms not encrypting the data themselves ?

Yes, it may need some work. But if it's beyond the wit of people reading this then frankly what is the point of IT ?

[el_seg]

I wish the article had more on what reasons the RCMP gave for not going through the established treaties to get the data they're after. The fact that the judge went along with it implies there was some reasonable justification, though the only one that comes to mind is that their request would have been rejected according to the terms of the treaty. Though, even then, why isn't there some route where the mounties cooperate with the gendarmerie, keep French data in France, and still create a legal case in Canada.

This whole attempt seems to be as much against the long term interests of Canadian sovereignty as it is for French sovereignty.

[Doctor Syntax]

"This whole attempt seems to be as much against the long term interests of Canadian sovereignty as it is for French sovereignty."

Nailed it. We don't even know what the Canadian govt. thinks of the actions of it.

[vekkq]

Nothing to worry about

OVH has to follow the EU rules and the EU rules also come with 'protection against the effects of the extra-territorial application of legislation adopted by a third country. Whatever fine the Canadian branch may have to pay, the EU fine will be even larger.

[Locomotion69]

The RCMP got it wrong to start with.

They should have asked the French police to take over the request for data within the investigation, the French police could acquire such information in a legal matter. That is how this is supposed to work anyway, crime does not stop at the borders and neither does criminal investigation.

I do not think there is any legilation on either side of the Atlantic that states that the government can force anyone to break the law.

[Roland6]

Re: The RCMP got it wrong to start with.

Definitely.

There seems to be a presumption that "subscriber and account data linked to four IP addresses on OVH servers " are static and have been static over time. Given the way we know hosting companiies work, there is a reasonable chance the requested IP addresses are or have been shared between multiple subscribers.

It would thus make sense for the Canadian police to not only directly request information from the French police but more probably involve Interpol, given their investigation also (at the time of reporting) involves systems and data located in the UK and Australia.

[EnviableOne]

according to co-pilot

Canadian Law: Under the Criminal Code and PIPEDA, our obligation is limited to providing records in our possession or control. We cannot compel a foreign entity to disclose data outside Canadian jurisdiction.

French & EU Law: The parent company is subject to the GDPR and French law, which require strict safeguards for international data transfers and prohibit disclosure without a lawful basis or treaty mechanism.

International Cooperation: Requests for data held abroad must proceed through the Mutual Legal Assistance Treaty (MLAT) between Canada and France or other recognised diplomatic channels.

[CorwinX]

Seems like data sovereignty...

... needs to be backed up by stronger European law as well as techical separation.

If the user is, say, French and that user's data is in a French datacentre - then the fact that said company also operates in America, or even is incorporated there, should have no relevance outside official treaties.

[Herby]

Ahh, the cloud...

Yes, someone else's computer that you have no control over. Subject to the whims of places where the wires extend.

Trans-border data flow is a really interesting business, and I suspect (given this story) that not everyone has come to an agreement as to who is in charge. I have doubts that anyone will.

So, the fraudsters in India (or other notorious countries) will continue to peddle their scams upon all of us. One of these days, it will come down to someone (or government) saying NO MORE.

(*SIGH*)