France says non to Office 365 and Google Workspace in school

The French minister of national education and youth has said that free versions of Microsoft Office 365 and Google Workspace should not be used in schools – a position that reflects ongoing European concerns about cloud data sovereignty, competition, and privacy rules.

In August, Philippe Latombe, a member of the French National Assembly, advised [PDF] Pap Ndiaye, the minister of national education, that the free version of Microsoft Office 365, while appealing, amounts to a form of illegal dumping. He asked the education minister what he intends to do, given the data sovereignty issues involved with storing personal data in an American cloud service.

Last week, the Ministry of National Education published a written reply to confirm that French public procurement contracts require "consideration" – payment.

"Free service offers are therefore, in principle, excluded from the scope of public procurement," the Ministry statement says, and minister Ndiaye has reportedly confirmed this position.

This applies to other free offerings like Google Workspace for Education. Paid versions of these cloud services might be an option if they hadn't already been disallowed based on worries about data safety.

French authorities consider Microsoft and Google cloud services that store data in the US to be non-compliant with European data regulations like GDPR and with "Schrems II" – a 2020 ruling [PDF] from the Court of Justice of the European Union governing data sharing across borders.

The "Schrems II" decision invalidated the US-EU Privacy Shield Agreement because the CJEU found that US law fell short of the privacy standards in Europe.

• Germany says nein to Qatari World Cup spyware, err, apps
• Instagram fined in Ireland for violating children's privacy
• EU puts smart device manufacturers on the hook for cyber security
• Country that still uses fax machines wants to lead the world on data standards at G7

On September 15, 2021, Nadi Bou Hanna, director of DINUM, France's interministerial digital department, said in a letter that French government agencies considering cloud services to replace office and messaging products on government servers like Exchange should not use Office 365 [PDF] because it does not comply with France's "Cloud at the Center" initiative.

Citing the position of DINUM, the prime minister's "Cloud at the Center" policy, and a May 2021 note from the National Commission for Computing and Liberties (CNIL) advising higher education institutions to use GDPR-respecting cloud collaboration services, the Ministry of Education in October 2021 said it advised academies to avoid any deployment of Office 365 or Google Workspace.

German data protection authorities came to a similar conclusion in 2019 when they disallowed Microsoft Office 365 in classrooms in the state of Hessen.

Google did not respond to a request for comment.

Microsoft declined to comment. However, the company in July announced Microsoft Cloud for Sovereignty, a service that will allow public sector customers to use Microsoft cloud services in a way that's consistent with policies.

Microsoft also plans to deploy its EU Data Boundary, though which EU customer data can be processed in compliance with data regulations, by the end of 2022. And Google last year undertook a similar initiative to meet EU data protection demands.

Last month, president Biden signed an executive order directing US agencies to implement the Trans-Atlantic Data Privacy Framework, announced in March.

The EU now has to take steps to adopt the rules, which could take some time. Once that happens, data transfers between the US and the EU should become more manageable. And Microsoft and Google may find it easier to win European government cloud contracts. ®