The noose is tightening for the Gafam. Following a parliamentary question tabled by the deputy (Modem) Philippe Latombe, an ardent defender of French digital sovereignty, the Ministry of National Education has come out against the use of Microsoft and Google in schools, colleges and high schools. Invoking compliance with the GDPR, but also with the “cloud at the center” doctrine of the State or the so-called Schrems 2 judgment delivered in 2020 by the European Court of Justice (CJEU), “ the ministry asked to stop any deployment or extension of the Microsoft solution as well as that of Google “, replied Pap N’Diaye, the Minister of National Education and Youth.
Non-compliant with GDPR and state cloud doctrine
National Education data being considered sensitive data, the State considers that the use of American software, which is subject to American extraterritorial law, violates the GDPR, as defined in the so-called Schrems 2 judgment of the July 16, 2020.
This landmark court ruling establishes that US extraterritorial laws, including the Cloud Act and the FISA Act, are deeply incompatible with the European GDPR. Consequently, the Schrems 2 judgment invalidated data transfers between Europe and the United States, deemed illegal (negotiations are currently taking place to define a new legal framework respecting Schrems 2). However, these transfers are daily and essential to the proper functioning of American companies operating in Europe, in particular for cloud and software publishers such as Google and Microsoft.
Since 2020, the consequences of Schrems 2 have led European data protection authorities and EU Member States to gradually advise against, or even ban, the use of American Gafam services for their businesses, administrations or public services.
Google and Microsoft, which offer many widely used web services and software, are particularly affected. Thus, after Austria and the Netherlands, the website traffic measurement tool Google Analytics has been declared illegal in France by the National Commission for Computing and Liberties (Cnil) in February 2022. In the field of National Education, the Cnil issued in May 2021 a warning notice institutions of higher education to use “US collaborative suites for education” by invoking Schrems 2 and the GDPR.
The publication, in 2021, of the “cloud at the center” doctrine, which defines the obligations in terms of personal data protection of cloud services used by French administrations, drives the point home, because it requires that the services used be labeled SecNumCloud or a European equivalent, that is to say that they have obtained the highest level of technical and legal data security. This is not the case for Microsoft or Google. In September 2021, a note from the Interministerial Digital Department (Dinum) also specified that the Microsoft Office 365 collaborative suite (Word, Excel, Power Point, etc.) does not comply with the “cloud at the center” doctrine. .
This response to MP Philippe Latombe is therefore in line with these previous decisions. The novelty is that the National Education officially extends the ban on Microsoft to schools, colleges and high schools in the future. The ministry even adds Google services to the list.
The French “Fab 8” ready to take over
This ban on Microsoft and Google services in National Education is godsend for French and European alternatives. Especially since they have been denouncing for years practices qualified as unfair competition, since Microsoft offers its Office software suite for free, and certain Google services are also free.
In a press release published on October 22, the self-proclaimed “Fab 8” – eight French software publishers capable of replacing the Microsoft 365 and Google Workplace office suites, namely Atolia, Jalios, Jamespot, Netframe, Talkspirit, Twake, Whaller and Wimi-, welcomed the acceleration of the dynamic towards a “ sovereign cloud and compliance with European laws “.
Above all, the “Fab 8” recall that their solutions “ meet the functional requirements to replace the actors in place, but also the requirements in terms of data security and legal certainty because 100% sovereign “. And to call on National Education to deploy the State’s cloud doctrine ” very quickly “since their solutions are already deployed with “ millions of users “.
Now remains the most difficult: changing mentalities in schools, colleges and high schools. Microsoft and Google enjoy a solid presence there, reinforced both by the quality of their services and the power of habits, which push teachers to ask for solutions perceived as the simplest and most practical because they have known them for a long time. .
French software and cloud players are also disadvantaged by the fact that they are the local authorities, and not the State, which decides on the hardware and software equipment of schools, which slows down change.