How OVH expand in the USA while preserving its European identity

Among the largest cloud providers in Europe, all are American, except one, OVH. This unique position on the European map means that OVH can guarantee that its customers are not subject to US law, most notably the Patriot Act. Accordingly, in 2011, OVH established itself in Quebec, Canada, in order to offer services in North America while remaining exempt from the Patriot Act. OVH is currently working on deploying new datacentres throughout the world. Among the new locations selected, the USA, the undisputed world leader of the cloud with an annual growth of 35%. OVH is working on a legal structure which will allow it to enter the US market, while keeping its unique positioning in Europe.

When we talk about US law, we think about the Digital Millennium Copyright Act (DMCA). But above all the Patriot Act comes to mind, under which, United States governmental agencies possess the power to access service provider user data.

The question of data protection

OVH has always been especially committed to protecting the data of its customers. If proof is required, the Wikileaks(1) affair can be cited as well as the appeal against the LCEN decree imposing the conservation of data, or the waiver obtained from ICANN for the disposition of RAA 2013 concerning data retention (2).
OVH also has a DPO (data protection officer) and has implemented internal rules (BCR-Binding Corporate Rules), according to EU regulation,related to the exchange of data between the companies within the group. Even more recently, OVH united with several other hosting providers to fight for changes to be made in the ‘loi renseignement3’ legislation which resulted in having the conditions of its application regulated and reduced in scope.

OVH US isolated from the other entities of the group

The OVH group has been working, for several months, on a way to best structure the group to make it possible to partition and isolate the future American entity and the other companies within the group. OVH's goal is to guarantee that their development in the United States does not impact the data of the group's current customers, under any circumstances.
This work highlights the need for a legal structuring of the OVH group to guarantee that no legal relationship exists between the European and Canadian commercial enterprises, and this future American entity.
At this stage, several implementation options are possible, whether it be the creation of a new entity, OVH US or through external growth by a rapprochement with an existing US actor. In all cases: tools, system information, and databases will not be shared between OVH US and the other companies of the OVH group.
No employee of the OVH group will have access to the American infrastructures except for OVH US employees. Similarly, US employees will not have access to any other infrastructures and information systems other than those of the US subsidiary. This will result in isolation, both in terms of geographic location and logical security.
Our European, African and Canadian entities will not permit customers to subscribe to services located in the USA; non-US OVH customers must go through OVH US. This is the only way that a European or Canadian customer, for example, may be subject to US law, as they will knowingly have subscribed to OVH US.
Non-US customers’ data will never be duplicated or mirrored in US territory and vice versa.

Learn more about how OVH will restrict the zone of application of the US law to the USA

In accordance to the US Constitution and article 14, in order for a US governmental agency to have the power to make a direct request to a company, it is necessary that that company be under US law.
It was the World-Wide Volkswagen Corp. v. Woodson case in 1980 which reaffirmed this point for non-US companies.
A company may be subject to US law if it is based in the US, if it has an office or a branch in US territory, or if it has sufficient 'minimum contacts' with the USA*.
To prevent a European or Canadian company from having 'minimum contacts', it has been decided that OVH US shall be the only company within the group to operate in US territory. The American company will also have its own executive committee, thus guaranteeing true autonomy in decision making when carrying out the group's ambitions within US territory. This particular choice is in line with the spirit of the decisions of the Supreme Court concerning Daimler AG v. Bauman, 134 S. Ct. 746, 759 (2014) and Volkswagenwerk Aktiengesellschaft v. Beech Aircraft Corp., 751 F.2d 117, 120 (2d Cir. 1984).
* Goodyear Dunlop Tires Operations, S.A. v. Brown 2011

1. Making headlines in December 2010, OVH was not notified by LCEN nor did it receive any legal requests ordering the suspension of the dedicated server hosting the Wikileaks site and thus maintained service despite the fact that several members of the French government, at that time, felt that such a site should not be hosted on French territory.
2. OVH, The First Registrar to Offer the New gTLDs in Compliance with EU Data Retention Law
New extensions and personal data protection (article in French)
3. Does the French government want to force French web hosting providers into exile?
Le point de vue d'OVH sur la loi renseignement

Previous article

OVH is ISO 27017 Compliant