If a foreign judge orders your data handed over, who tells you?

The bank that settles your dollar payments, the supplier that keeps your backups, the subsidiary that holds your archives: if a single one of them “resides or is found” in the United States, an ordinary procedure can compel it to hand your documents to a foreign court. The order does not reach you. The objection belongs to whoever holds the papers, not to whoever produced them, and nobody has the duty to warn you.

A filing of 23 September, not a decision

That day the United States filed, with the U.S. District Court for the Western District of Louisiana, Monroe Division, a memorandum of law in support of an ex parte application under 28 U.S.C. § 1782(a) (case 3:26-mc-00064). It serves to execute a Letter of Request from the 7th Commercial Court of First Instance of Anadolu in Istanbul, which in a bankruptcy proceeding — Taviller Hydraulic Shaft and Pipe Manufacturing Industry and Trade Inc. v. Türkiye Halk Bank Inc., foreign reference number 2024/470 — wants the financial records of the transactions between the two parties. JPMorgan Chase Bank is not a party to that case: it acted as the correspondent bank.

The request reached the Office of International Judicial Assistance at the Department of Justice on 4 September 2026; on 18 September it was transmitted to the federal prosecutor’s office for the district; on 23 September that office asked the judge to authorise its execution and to appoint an assistant prosecutor as commissioner. Nineteen days. The channel is the Hague Convention of 18 March 1970 on the Taking of Evidence Abroad in Civil or Commercial Matters, in force in both the United States and Türkiye.

And it is not diplomatic courtesy. Article 10 obliges the requested authority to apply “the appropriate measures of compulsion” in the same instances and to the same extent as its own internal law provides; Article 9 requires it to follow its own law “as to the methods and procedures to be followed” and to execute “expeditiously”. A demand born in Istanbul is carried out with the force of an American order.

Ex parte means the party is not there

The memorandum says as much in a footnote, citing a decision of 1976: “Letters Rogatory are customarily received and appropriate action taken with respect thereto ex parte. The witnesses can and have raised objections and exercised their due process rights by motions to quash the subpoenas”. In 2022 the Fifth Circuit observed that “it is not unusual for § 1782(a) applications to be made on an ex parte basis to the district court”.

The right of defence exists, but it sits with the recipient of the order — the holder of the documents — not with the people those documents concern. Further on, the point becomes explicit: a proportionality review would call for speculation “when, as here, none of the parties to the underlying litigation are before the Court”. Not even the parties to the Turkish case are before the American judge; a third party that appears only inside a transaction, still less.

The forum is fixed by the office that receives service

Section 1782 allows a district judge to order a person who “resides or is found” in the district to produce evidence “for use in a proceeding in a foreign or international tribunal”, and to appoint a commissioner to issue the subpoena. There are three requirements: the recipient is found in the district, the evidence is for use in a foreign proceeding, and the application comes from a foreign tribunal or from an interested person.

The first requirement deserves attention: for JPMorgan to be found in the Western District of Louisiana, the memorandum gives a single reason, “because the company’s subpoena processing center is located in Monroe, LA”. A footnote adds that internal Department of Justice policies require requests for financial records to be executed “in the district where the subpoena processing center is located for the particular financial institution”. The forum is not fixed by your data, nor by your registered office: it is fixed by the address the holder has chosen for receiving legal service. As with the data centres declared of strategic national interest, what counts is jurisdiction — and here an address alone settles it.

Another paragraph clears away the statute an account holder would expect to meet, the Right to Financial Privacy Act (12 U.S.C. §§ 3401-23): for the Government that Act “does not apply to this request under § 1782”, with two precedents from 1989 and 1987. The objection is anticipated and closed in advance.

The documents that were not filed

The most instructive detail sits in the second footnote. The Government removed the original Turkish documents of the Letter of Request, and its attachments, from the copy filed with the Court, and gives its reason: “it is difficult for our office to ensure that parties’ personal information is adequately protected in these foreign language documents”. Should the Court be unable to act without them, it offers to provide them under seal.

Read it from your end of the tube: the office handling the request states that it cannot establish what personal data are held in documents written in a language that is not its own. That is the condition of anyone who entrusts archives to a chain of parties that do not read them: the data travel, the understanding stays behind.

What can be done before it matters

The day the subpoena arrives is a day you do not see. It is governed beforehand, and it fits in four lines of a register.

Who holds. For each category of data — payments, contracts, mail, backups, logs — the legal entity that holds them and where it is incorporated. An Italian subsidiary and an American branch of the same group are two different answers.

Where it can be reached. Not where the servers sit: the address at which the supplier receives legal service, and in the name of which entity — the fact that fixed the forum in this file. It matters just as much when the parent company changes.

The duty to notify. The contract can require the supplier to tell you of every production order it receives, so far as the law allows it to, and to pursue the remedies available. Without that clause, silence is lawful.

The surface. Data that never leave the perimeter have no third-party holder to serve. It is the only measure that does not depend on somebody else’s diligence.

What we do not know

We do not have the Letter of Request or its attachments, which were left out of the filing: we do not know which transactions are sought, or over what period. We do not know whether the Court has acted: the document is on file, and nothing asserted in it has been tested. We do not know JPMorgan’s position — which, on the memorandum’s own account, may be put to the Court — nor that of the Turkish parties. We are reading one side’s filing: the argument of the party asking, not a finding. This is not legal advice.

The two axes, applied to this case

Complying. The control we put into service is a living register of holders: for each flow, the entity that holds the data, the jurisdiction in which it can be reached, the address for legal service, the notification clause and the date of the last check. It runs on your contracts and your systems and leaves a dated trail, one you can show to an inspection.

Deciding. The same installation holds payments, archives, management systems, sensors and documents in a single operating model, on which AI agents execute decisions with an operator in command — for large companies, defence, public administration and healthcare. On supervised machines inside your perimeter, or on a dedicated cloud with a data centre in Italy supervised by us, always with shared management: you need not already employ people who administer AI models. A model that runs on your own weights and your own hardware leaves no third party holding documents to produce on your behalf.

Could you say at which address, and in the name of which entity, your supplier receives legal service? Half an hour with one of our engineers is enough to start.