The Ministry of National Education confirms that it does not want free offers of Microsoft Office 365 and Google Workspace in schools. According to Pap NDiaye, the Minister of National Education, these two solutions are neither compatible with the GDPR nor with the doctrine “ cloud at the center ».
National Education takes a position on the cloud
In its response to MP Philippe Latombe (MoDem), the Ministry of National Education explains that ” the Prime Minister’s circular n° 6282-SG relating to the “cloud at the center” doctrine, invites the various ministers to ensure that commercial cloud offers benefit from the SecNumCloud qualification or an equivalent European qualification “. This is not the case for the free offers of Microsoft Office 365 and Google Workspace.
The CNIL recommends that institutions use the collaborative suites offered by providers exclusively subject to European law and ” that host the data within the European Union and do not transfer it to the United States “. The centrist MP had asked Pap NDiaye’s ministry to find out if Microsoft’s free offer in schools does not ” did not amount to a form of dumping and unfair competition “. No call for tenders and this is a real problem of national sovereignty raised by Philippe Latombe.
As the Ministry explains in its response, in the Dinum circular, it is clearly stated that “ the deployment of Office 365 is prohibited in French administrations “. The State’s interministerial digital director decided to intervene to protect the sensitive data » available to many public officials. According to the circular published in 2021, it is written that data should no longer be hosted on Microsoft 365 cloud services, to protect it from a possible security breach or even misuse by US intelligence services.
In its decision, the Ministry of National Education also takes into account the 2020 judgment known as “Schrems II” of the Court of Justice of the European Union. This text invalidated the transatlantic framework for transferring personal data of European users to the United States. A device that is not sufficiently effective according to the magistrates, but its successor is on track: an agreement in principle has been reached.
Institutions are therefore asked, and more specifically to local authoritieswhose role it is, to select service providers exclusively subject to European law which host the data within the European Union and do not transfer it to the United States. The communities are in charge of the equipment, the operation, but also of ” acquisition and maintenance of infrastructure and equipment “.