Pape Ndiaye, Minister of National Education and Youth, reaffirmed that Microsoft Office 365 or Google WorkPlace solutions were not compatible with the GDPR, nor with the state’s “cloud at the center” doctrine. The ministry was responding to a question posed by Philippe Latombe, MoDem deputy for Vendée, concerning the cloud offers offered free of charge by US companies, and usable in education.
Far from being naive, the question evokes the commercial “trap” that these free offers constitute for the security of the data of the French. “At first glance, the proposition may seem attractive since it promises a single place for organization, access anytime, anywhere and from any device.explains the Vendée deputy. However, this free offer amounts to an ultimate form of dumping and unfair competition. It also appears that no call for tenders took place..
The member therefore asked the department to “tell him what he intends to do in the face of such commercial practices which, if they may seem attractive to the consumer, strongly penalize other economic players, pose a serious problem of sovereignty, due to the location of personal data on a cloud American law and the extraterritoriality of American law and give the very many teachers who are hostile to it the impression of an administration sold to Microsoft”.
Microsoft and Google banned from school?
Unsurprisingly, in its response to the deputy, the Ministry of National Education explained that “Prime Minister’s circular n°6282-SG relating to the cloud doctrine at the center, invites the various ministers to ensure that commercial cloud offers benefit from the SecNumCloud qualification or an equivalent European qualification” and that’“a note from the interministerial digital director dated September 15, 2021 specifies that the Microsoft Office 365 collaborative suite did not comply with the doctrine”.
The Ministry also mentions a letter from the Cnil of May 27, 2021 recommending that higher education establishments use collaborative suites offered by service providers exclusively subject to European law, which host the data within the European Union and do not do not transfer to the United States. The ministry says it informed the rectors of the academic region and academy in October 2021 of the “cloud in the center” doctrine, the position of the Dinum and the opinion of the Cnil on this subject.
“The ministry has thus requested to stop any deployment or extension of this solution as well as that of Google, which would be contrary to the GDPR”specifies the response published in Official newspaper on November 15, 2022.