How OVH Will Balance Development in the USA while Preserving its European Identity

Among the largest cloud providers in Europe, all are American, except one, OVH. This unique position on the European map allows OVH to guarantee its customers that they are not subject to US jurisdiction, most notably the Patriot Act. It was under this logic, that in 2011, OVH established itself in Quebec, Canada, to offer services in North America while remaining non-subject to the Patriot Act. OVH is currently working on deploying new datacenters throughout the world. Among the new locations selected, the USA, the undisputed world leader of the cloud with an annual growth of 35%. OVH is working on a legal structure which will allow it to enter the US market, while keeping its unique positioning in Europe.

When we speak of US law, the Digital Millennium Copyright Act (DMCA) comes to mind, but above all the Patriot Act and the possibilities under which United States governmental agencies possess the power to access service provider user data.

The question of data protection

OVH has always been especially committed to protecting the data of its customers. If proof is required, the Wikileaks1 affair can be cited, as well as the appeal against the LCEN decree imposing the conservation of data, or the waiver obtained from ICANN for the disposition of RAA 2013 concerning data retention2. OVH has a DPO (data protection officer) and has implemented internal rules (BCR-Binding Corporate Rules), according to EU regulation, concerning the exchange of data between the companies within the group. Even more recently, OVH united with several other hosting providers to fight for changes to be made in the ‘loi renseignement3’ legislation which resulted in having the conditions of its application regulated and reduced in scope.

OVH US isolated from the other entities of the group

The OVH group has been working, for several months, on a way to best structure the group to make possible the partitioning and isolation between the future American entity and the other companies of the group. OVH's goal is to guarantee that under no circumstance will the data of the group's current customers be impacted by its development in the United States.
This work highlights the need for a legal structuring of the OVH group to guarantee that no legal relationship exists between the European and Canadian commercial enterprises with this future American entity.
At this stage, several implementation options are possible, whether it be the creation of a new entity, OVH US or through external growth by a rapprochement with an existing US actor. In all cases: tools, system information, and databases will not be shared between OVH US and the other companies of the OVH group.
No employee of the OVH group will have access to the American infrastructures except for OVH US employees. Similarly, US employees will not have access to any other infrastructures and information systems other than those of the US subsidiary. This will result in isolation, both in terms of geographic location and logical security.
Our European, African and Canadian entities will not permit customers to subscribe to services located in the USA; non-US OVH customers must go through OVH US. This is the only way that a European or Canadian customer, for example, may be subject to US law, as they will knowingly have subscribed to OVH US.
Non-US customers’ data will never be duplicated or mirrored in US territory and vice versa.

Learn more about how OVH will restrict the zone of ​​application of the US law to the USA

In accordance to the US Constitution and article 14, in order for a US governmental agency to have the power to make a direct request to a company, it is necessary that that company be under US law.
Notably, the case between World-Wide Volkswagen Corp. v. Woodson in 1980 reaffirmed this point for non-US companies. A company may be subject to US law if it is based in the US, if it has an office or a branch in US territory, or if it has sufficient 'minimum contacts' with the USA*. To prevent a European or Canadian company from having 'minimum contacts', it has been decided that OVH US shall be the only company within the group to operate in US territory. The American company will also have its own executive committee, thus guaranteeing true autonomy in decision making when carrying out the group's ambitions within US territory. This particular choice falls within the spirit of the decisions of the Supreme Court concerning Daimler AG v. Bauman, 134 S. Ct. 746, 759 (2014) and Volkswagenwerk Aktiengesellschaft v. Beech Aircraft Corp., 751 F.2d 117, 120 (2d Cir. 1984).
* Goodyear Dunlop Tires Operations, S.A. v. Brown 2011

1. Making headlines in December 2010, OVH was not notified by LCEN nor received any legal requests ordering the suspension of the dedicated server hosting the Wikileaks site and thus maintained service despite the fact that several members of the French government, at that time, had the opinion that such a site should not be hosted on French territory.
2. OVH, the first registrar to offer new extensions with respect to the data retention law (article in French)
New extensions and protection of personal data (article in French)
3. Le point de vue d’ sur la loi renseignement (article in French)