A Canadian court has ordered French cloud provider OVH to hand over user data stored in France, the UK, and Australia—despite a French law that forbids it. The French government is objecting, but the Canadian government doesn't seem to care. What does this mean for digital sovereignty, cross-border investigations, and the limits of Canadian court jurisdiction? Lots.

This episode unpacks a recent Ontario Court of Justice decision involving OVHcloud and a national security investigation, discussing the facts, the legal issues, the court’s reasoning, and why—in my view—the decision is deeply flawed.

OVH is not accused of wrongdoing. It’s simply being ordered by a Canadian court to violate the law of the country where it is based—even though France offered to expedite a lawful country-to-country process. That should concern anyone who deals with cross-border data, law enforcement requests, or cloud infrastructure.

The decision can be found here: https://drive.google.com/file/d/1QVwO9lPmxuDSQsGd9fHH3QN_ToXs2LQ8/view?usp=drive_link

Cases referred to in the episode:

► British Columbia (Attorney General) v. Brecknell, 2018 BCCA 5 https://canlii.ca/t/hplpj

► R v Love, 2022 ABCA 269 https://canlii.ca/t/jrflw

► Toronto-Dominion Bank v. Court of Quebec, 2025 QCCS 2094 https://canlii.ca/t/kcvtw

Where you can find me

► Privacylawyer blog: https://blog.privacylawyer.ca

► My law firm: https://www.mcinnescooper.com/people/david-fraser

► Twitter: https://twitter.com/privacylawyer

► LinkedIn: https://www.linkedin.com/in/davidtsfraser

Disclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel.

All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.