The Ministry of Education confirms that it does not want free offers for Microsoft Office 365 and Google Workspace in schools. According to Pap NDiaye, the Minister of National Education, these are two solutions are neither compatible with the GDPR nor with the doctrine ” the cloud in the center ».
National Education takes a position on the cloud
In its response to MP Philippe Latombe (MoDem), the Ministry of National Education explains that “ Prime Minister’s Circular No. 6282-SG regarding the “cloud at the center” doctrine calls on the various ministers to ensure that commercial cloud offerings benefit from the SecNumCloud qualification or an equivalent European qualification “. This is not the case for the free offerings of Microsoft Office 365 and Google Workspace.
CNIL recommends that institutions use the collaboration suites offered by providers that are exclusively subject to European legislation and ” which hosts the data within the EU and does not transfer it to the US “. The middle MP had asked Pap NDiaye’s ministry to find out if Microsoft’s free offer in schools does not ” did not constitute a form of dumping and unfair competition “. No tender and this is a real issue of national sovereignty, raised by Philippe Latombe.
As the ministry explains in its response, the Dinum circular clearly states that “ rollout of Office 365 is prohibited in French administrations “. The state’s interministerial digital director decided to intervene to protect sensitive data » available to many public officials. According to the circular published in 2021, it is written that data should no longer be hosted on Microsoft 365 cloud services, to protect them from a possible security breach or even misuse by US intelligence services.
In its decision, the Ministry of National Education also takes into account the judgment from 2020 known as “Schrems II” from the European Court of Justice. This text invalidated the transatlantic transfer framework personal data of European users to the United States. A device which, according to the judges, is not sufficiently effective, but its successor is on the way: an agreement in principle has been concluded.
Institutions are therefore asked, and more specifically to local authoritieswhose role it is to select service providers exclusively subject to European legislation which hosts the data within the EU and does not transfer it to the US. The societies are responsible for the equipment, the operation, but also for ” acquisition and maintenance of infrastructure and equipment “.