51 international companies who lost data when OVHcloud's SBG2 data center in Strasbourg burnt down in March 2021, have joined a class action claiming 'up to €1.9 million' in damages.
The legal action is being brought by Parisian legal firm Ziegler Associates, and is still open to new claimants, before an official letter goes to OVHcloud in March. The fire on March 10 destroyed the cloud operator's SBG2 data center, and crippled the SBG1 facility on the same site. Many international businesses suffered downtime and lost data.
OVHcloud has still not given any official information on the cause of the fire, claiming it cannot do this until later this year, for legal reasons, although initial reports suggested the blaze started in UPS systems, and reports have alleged the company had inadequate fire prevention systems.
Four arguments to shift the blame
Ziegler announced its class action in November with seven companies, and 20 companies had signed up by early December. Now that number has expanded, with Ziegler saying its clients are "seeking justice and compensation for all the damages they may have suffered as a result of this fire". It says its goal is "to compensate companies that lost data during the fire at OVH's data center in Strasbourg."
One of Ziegler's clients has shared OVHcloud's four legal arguments against compensation. These are;
- No fault would be attributable to OVH
- The disaster was "force majeure": (beyond OVHcloud's control)
- A limited liability clause in OVHcloud's contract
- OVHcloud's responsibility only includes direct damages - the hosting service - and does not include indirect damages such as loss of business
Ziegler will be arguing against all these points, saying that OVHcloud was at fault for not taking specific additional security measures, and because it kept backups on the same site as original data: "OVH has the obligation to put in place all the necessary means to deal with a possible security failure, for example a fire," says Ziegler. "However, its data centers in Strasbourg were not equipped with an automatic fire extinguishing system. For some companies having taken the backup option, the backups were carried out in the same data center. They have de facto lost everything."
The conditions for invoking force majeure were not met. Under clause 1218 of France's civil code, a force majeure defense requrires the event to have been unpredictable, irresistible, and outside the OVHcloud's control. Ziegler argues that because prevention measures were available, the damage was within OVHcloud's control.
Ziegler says OVHccloud's limited liability defense is invalid, because it essentially claims it is not responsible to provide the basic service its clients expect, to have data hosted securely. "As soon as the limiting clauses generate a significant imbalance between the parties, the judge may consider these clauses as invalid," says Ziegler, adding that OVHcloud's limited liability argument dispenses with its own purpose which is to host data in a secure manner".
Finally, Ziegler says OVHcloud is not legally able to limit its responsibility to direct damages only. The law firm says the judge should take into account other costs such as the cost of restoring and replacing data, loss of business, and even damage to an OVHcloud customer's brand image.
According to a report in Le Journal Du Net, Ziegler intends to add further confidential arguments to its letter before it is filed. "The objective is to demonstrate that the situation of OVH is no longer tenable, and that it will have to go through an amicable discussion if it does not want a lost trial", says Jocelyn Ziegler, according to that report.
OVHcloud has declined to comment on the Ziegler class action to DCD until the formal letter is received: "We cannot comment more, as the case is still not shared with the legal authorities nor with our lawyers/legal department who still have no access to its detailed elements," said an OVHcloud spokesperson, adding that OVHcloud has provided support and refunds for customers for impacted services.