Microsoft and Google expelled from school by National Education

The noose is tightening for the Gafam. Following a parliamentary question tabled by (Modem) MP Philippe Latombe, an ardent defender of French digital sovereignty, the Ministry of Education spoke out against the use of Microsoft and Google in schools, colleges and high schools. Invoking the respect of the GDPR, but also of the “cloud at the center” doctrine of the State or of the so-called Schrems 2 sentence pronounced in 2020 by the European Court of Justice (CJEU), “ the ministry has asked to stop any distribution or extension of the Microsoft solution as well as that of Google “, replied Pap N’Diaye, the minister of national education and youth.

Cloud: Oodrive, Tixeo and Olvid join forces to create a French “team” from 2023

Not compliant with GDPR and state cloud doctrine

Since National Education data is considered sensitive data, the State believes that the use of American software, subject to American extraterritorial law, violates the GDPR, as defined in the so-called Schrems 2 sentence of 16 July 2020.

This landmark court ruling establishes that US extraterritorial laws, including the Cloud Act and the FISA Act, are deeply incompatible with the European GDPR. As a result, the Schrems 2 ruling invalidated data transfers between Europe and the United States, which were deemed illegal (negotiations are currently underway to define a new regulatory framework with respect to Schrems 2). However, these transfers are daily and essential for the proper functioning of American companies operating in Europe, especially cloud and software publishers such as Google and Microsoft.

Since 2020, the consequences of Schrems 2 have led European data protection authorities and EU member states to gradually advise against, or even ban, the use of American Gafam’s services for their companies, administrations or services public.

Google and Microsoft, which offer many widely used web services and software, are particularly affected. Thus, after Austria and the Netherlands, the Google Analytics website traffic measurement tool was declared illegal in France by the National Commission for Informatics and Liberties (Cnil) in February 2022. In the field of national education, the CNIL issued an opinion in May 2021 advising higher education institutions not to use “US Collaborative Suites for Education” invoking Schrems 2 and the GDPR.

The publication, in 2021, of the “cloud at the center” doctrine, which defines the obligations in terms of personal data protection for the cloud services used by French administrations, drives home the point, because it requires that the services used be labeled SecNumCloud or a European equivalent, i.e. they have obtained the highest level of technical and legal data security. This is not the case with Microsoft or Google. In September 2021, a note from the Interministerial Digital Department (Dinum) also specified that the Microsoft Office 365 collaborative suite (Word, Excel, Power Point, etc.) does not comply with the “cloud at the centre” doctrine.

This response to MEP Philippe Latombe is therefore in line with these previous decisions. What’s new is that National Education officially extends Microsoft’s ban to schools, colleges and high schools going forward. The ministry even adds Google services to the list.

Sovereign cloud: the strategy of chaos

The French “Fab 8” ready to take over

This ban on Microsoft and Google services in national education is a godsend for French and European alternatives. Especially since they have been denouncing practices qualified as unfair competition for years, given that Microsoft offers its Office software suite free of charge, and even some Google services are free.

In a press release published Oct. 22, the self-proclaimed “Fab 8” – eight French software publishers capable of replacing the office suites Microsoft 365 and Google Workplace, namely Atolia, Jalios, Jamespot, Netframe, Talkspirit, Twake, Whaller and Wimi-, welcomed the acceleration of the dynamic towards a “ sovereign cloud and compliance with European laws “.

Especially the “Fab 8” remember that their solutions “ meet the functional requirements to replace the existing players, but also the requirements in terms of data security and legal certainty because it is 100% sovereign “. And call on National Education to deploy the state cloud doctrine ” very quickly “because their solutions are already implemented with ” million users “.

Now the hardest thing remains: to change mindsets in schools, colleges and high schools. Microsoft and Google enjoy a solid presence there, reinforced both by the quality of their services and by the power of habits, which push teachers to ask for solutions that are perceived as the simplest and most practical because they have known about them for a long time. .

French software and cloud players are also disadvantaged by the fact that they are the local authorities, and not the State, which decides on the hardware and software equipment of schools, which slows down change.

Bleu, S3ns: Why trusted cloud offerings will definitely be subject to the Cloud Act