France’s national education and youth minister said free versions of Microsoft Office 365 and Google Workspace should not be used in schools, reflecting European concerns about data sovereignty in the cloud, competition rules and confidentiality.
Philippe Ladombe, a member of the French National Assembly, reported the matter in August [PDF] National Education Minister Bob Ndiaye said the free copy of Microsoft Office 365 was a form of illegal dumping during the appeal. The education secretary asked what he intended to do, given the data sovereignty issues surrounding storing personal data in a US cloud service.
Last week, the Ministry of National Education published a written response to French public markets that requires “consideration” for affirmation – ownership.
“Offers of free services are, in principle, excluded from the scope of public procurement,” specifies the ministry’s press release, and this position is said to have been confirmed by Minister Ndiaye.
The same goes for other free offerings like Google Workspace for Education. If paid versions of these cloud services aren’t already allowed due to data security concerns, they may be an option.
French authorities consider that Microsoft and Google cloud services that store data in the United States do not comply with European data regulations such as the General Data Protection Regulation and Schrems II. Judgment of 2020 [PDF] The Court of Justice of the European Union governs cross-border data exchange.
The “Schrems II” decision invalidated the US-EU Privacy Shield Treaty, as the CJEU found that US law failed to meet Europe’s privacy standards.
On September 15, 2021, Nadi Bou Hanna, director of DINUM, the French multidisciplinary digital sector, said in a letter that French government agencies are studying cloud services to replace office products and email on government servers such as Exchange. Don’t use Office 365 [PDF] Because it is not in line with the French “cloud at the center” initiative.
Citing DINUM’s position, the Prime Minister’s “cloud at the center” policy and the May 2021 memorandum from the National Commission for Information and Freedoms (CNIL) requiring higher education institutions to use cloud collaboration services respecting the GDPR, the Department for National Education in October 2021 or Office 365 or academies recommended by Google to avoid using Workspace.
German data protection authorities came to a similar conclusion in 2019 that Microsoft Office 365 is not allowed to be used in classrooms in Hesse.
Google did not respond to a request for comment.
Microsoft declined to comment. However, in July the company announced Microsoft Cloud for Sovereignty, a service that allows public sector customers to use Microsoft’s cloud services on principles.
Microsoft plans to demarcate EU data, though it will be able to process customer data in the EU under data regulations by the end of 2022. Google has done so. It made similar efforts last year to meet EU data protection requirements.
Last month, President Biden signed the executive order directing US companies to implement the Transatlantic Data Privacy Framework, announced in March.
The EU must now take steps to adopt the rules, and this may take some time. Once that happens, data sharing between the US and the EU should become more manageable. Microsoft and Google could easily win cloud contracts with European governments. ®