The noose is tightening for Gafam. Following a parliamentary question asked by Member of Parliament (modem) Philippe Latombe, an ardent defender of French digital sovereignty, the Ministry of National Education spoke out against the use of Microsoft and Google in schools, colleges and high schools. . Invoking compliance with the GDPR, but also with the “cloud at the center” doctrine of the state or the so-called Schrems 2 judgment handed down in 2020 by the Court of Justice of the European Union (CJEU), “ the ministry asked to halt any deployment or expansion of the Microsoft solution as well as Google’s ”, replied Pap N’Diaye, the Minister of National Education and Youth.
Non-compliant with GDPR and state cloud doctrine
Since National Education data is considered sensitive data, the state believes that the use of US software, which is subject to US extraterritorial law, is in violation of the GDPR, as defined in the so-called Schrems 2 judgment of July 16, 2020.
This landmark court decision finds that US extraterritorial laws, including the Cloud Act and the FISA Act, are deeply incompatible with the European GDPR. As a result, the Schrems 2 ruling invalidated data transfers between Europe and the US that were deemed illegal (negotiations are currently underway to define a new legal framework that respects Schrems 2). However, these transfers are daily and essential for the proper functioning of US companies operating in Europe, especially for cloud and software publishers such as Google and Microsoft.
Since 2020, the consequences of Schrems 2 have led European data protection authorities and EU member states to gradually discourage or even ban the use of American Gafam services for their companies, administrations or public services.
Google and Microsoft, which offer many widespread web services and software, are particularly affected. Following Austria and the Netherlands, the Google Analytics website traffic measurement tool was declared illegal in France by the National Commission for Computing and Liberties (Cnil) in February 2022. In national education, the CNIL issued an opinion in May 2021 advising higher education institutions to use “US Collaborative Suites for Education” by invoking Schrems 2 and GDPR.
The publication in 2021 of the “cloud at the center” doctrine, which defines the personal data protection obligations of cloud services used by French authorities, drives home the point because it requires the services used to be marked SecNumCloud or a European correspondingly, i.e. they have achieved the highest level of technical and legal data security. This is not the case for Microsoft or Google. In September 2021, a memo from the Interministerial Digital Department (Dinum) also specified that the Microsoft Office 365 collaboration suite (Word, Excel, Power Point, etc.) does not comply with the “cloud at the center” doctrine.
This response to MP Philippe Latombe is therefore consistent with these previous decisions. What’s new is that National Education is officially extending the ban on Microsoft to schools, colleges and universities in the future. The ministry even adds Google services to the list.
The French “Fab 8” ready to take over
This ban on Microsoft and Google services in National Education is a gift to French and European alternatives. Especially since for years they have condemned practices that qualify as unfair competition, since Microsoft offers its Office software suite for free, and certain Google services are also free.
In a press release published on October 22, the self-proclaimed “Fab 8” – eight French software publishers capable of replacing Microsoft 365 and Google Workplace office suites, namely Atolia, Jalios, Jamespot, Netframe, Talkspirit, Twake, Whaller and Wimi– welcomed the acceleration of the dynamics towards a “ sovereign cloud and compliance with European laws “.
Above all, “Fab 8” reminds that their solutions “ meet the functional requirements to replace the existing actors, but also the requirements for data security and legal certainty, because 100% sovereign “. And to urge National Education to implement the state’s cloud doctrine” very fast “since their solutions are already implemented with” millions of users “.
Now the most difficult thing: to change mentality in schools, colleges and high schools. Microsoft and Google enjoy a solid presence there, reinforced both by the quality of their services and the power of habit, which pushes teachers to ask for solutions that are perceived as the simplest and most practical because they have known them for a long time time. .
French software and cloud players are also disadvantaged by being local authorities, and not the state, making decisions about hardware and software equipment in schools, which slows down change.