How secure is your data?

The Desjardins affair, Bill 25 and U.S. laws revive the debate on digital sovereignty

By Pierre-Étienne Côté

MONTREAL | In 2025, a good password isn't enough to protect your data. In a context where cyberthreats are multiplying and major powers are extending their digital power, the question of where our data is stored takes on a whole new importance.

And in Quebec, the Desjardins affair is still fresh in the memory.

Desjardins: the tipping point

In 2019, nearly 9.7 million members of the Desjardins cooperative had their personal information - names, addresses, social insurance numbers - exposed following a massive data leak.

This scandal, caused by a malicious employee, has highlighted an inconvenient truth: our data is vulnerable, even internally.

Since then, the Quebec government has passed Bill 25, a major reform in privacy protection. Companies must now ensure better control, inform users and avoid international transfers without rigorous risk analysis.

Foreign laws invade our servers

But the danger doesn't only come from here. In the USA, the controversial Patriot Act allows federal agencies to force any American company to hand over data - even if it's stored in Canada, Europe or elsewhere.

"What many people don't know is that by using certain cloud services such as Microsoft, Google or Amazon, your data becomes accessible to U.S. authorities, even if it's hosted in Montreal or Toronto," explains a cybersecurity expert.

In Europe, the RGPD (General Data Protection Regulation) imposes strict rules: European citizens' data must enjoy the same protection, no matter where it travels.

Rézau: a local choice, an asserted sovereignty

Faced with this legal and geopolitical complexity, some Quebec companies have decided to take control. This is the case of Rézau, a Drummondville-based technology company, which has chosen to host all its data locally, in a data center located in Beauharnois, operated by OVHcloud, a European player independent of U.S. laws.

✅ Data stored in Quebec
✅ Compliance with Bill 25 and the RGPD
✅ No exposure to the Patriot Act

"Our customers want transparency. They want to know that their data stays here, that it doesn't cross borders without their consent," explains Rézau's Pierre-Étienne Côté.

Hosting here also means investing here

Beyond legal issues, digital sovereignty is also economic.

"Every dollar invested in local hosting supports IT jobs, strengthens our technological autonomy and stimulates innovation in regions like ours," emphasizes Côté.

In a province rich in talent, green electricity and infrastructure, Quebec has everything it takes to build a sovereign cloud. It's just a question of making the right choices.

What's next? Ask yourself the right question

The Desjardins case has shown that leaks are not inevitable: they can be avoided. And often, the first step is to ask yourself this simple question:

"Where does my data sleep?"

🔍 Doubting whether your infrastructure is compliant?
Rézau offers a 15-minute, no-obligation lightning appointment to take stock.
📍 Based in Drummondville, they support you in a responsible, local digital shift.

‍