French Government thoughts on the use of US Cloud based software in Education

This article (in French) appeared on my timeline with the implication that the use of MS Office and Google Docs was illegal in schools as they don't follow GDPR...

Turns out (with the ironical caveat that I used Google Translate) the response was a bit more circumspect than that... as in not quite illegal but 'deals' like that offered by US Cloud services should certainly be scrutinised for full compliance with local laws.

The same can actually be said for the NZ Government and use of US Cloud services but as we have noted before, some agencies put all that in the 'too hard' basket and default to one company in particular to the ongoing detriment of the NZ IT Industry, not that they will ever admit that...

Translation follows (Highlights are mine):

Text of the question - Mr. Philippe Latombe alerts the Minister of National Education and Youth to the free use of Office 365 for students and teachers. Indeed, as the Microsoft site announces, "students and teachers at eligible schools can subscribe to Microsoft Office 365 for free, which integrates Word, Excel, PowerPoint, OneNote and now Microsoft Teams, as well as many other classroom tools. At first glance, the proposition may seem attractive since it promises a single place for organization, access anytime, anywhere and from any device. However, this free offer amounts to an ultimate form of dumping and unfair competition. It also appears that no call for tenders took place. He asks him if he can tell him what he intends to do in the face of such commercial practices which, if they may seem attractive to the consumer, strongly penalize other economic players, pose a serious problem of sovereignty, because of the localization personal data on an American cloud and the extraterritoriality of American law and give the very many teachers who are hostile to it the impression of an administration sold to Microsoft.

Text of the response - The publisher Microsoft has a global policy for education consisting of offering the basic version of its online collaborative suite free of charge. Article L. 2 of the Public Procurement Code provides that public procurement contracts are contracts entered into for consideration to meet the needs of the public entity in terms of works, supplies or services. Free service offers are therefore, in principle, excluded from the scope of public procurement. While it is likely that the provision of a free office suite to schools is intended to encourage a public that has been accustomed to using these tools to subsequently subscribe to the paid version of its offer, this advantage indirect is not of a nature, on its own, to regard this service as having an onerous nature (ministerial response no. 00604 published in the Official Journal of the Senate on May 10, 2018, p. 2263). However, the Ministry responsible for the economy and finance indicated in this ministerial response that "for the sake of good administration and insofar as such contracts may have an impact on competition in the long term, public persons will nevertheless take care to circumscribe the object of these contracts, to limit their duration and not to grant exclusivity to the economic operator in order to allow other competitors to benefit from the resulting image gains, in particular. In addition, the Prime Minister's Circular No. 6282-SG relating to the doctrine for the use of cloud computing by the State ("cloud at the center") invites the various ministers to ensure that the offers of commercial cloud used by the services and public organizations placed under its authority are immunized against any extra-Community regulation and benefit from the SecNumCloud qualification or an equivalent European qualification. In this regard, a note from the interministerial digital director dated September 15, 2021 specifies that the Microsoft Office 365 collaborative suite did not comply with the “cloud at the center” doctrine. The Government's policy is in line with the judgment of July 16, 2020 known as "Schrems II" of the Court of Justice of the European Union and the position of the supervisory authorities of the Member States. In a letter dated May 27, 2021, the National Commission for Computing and Liberties (CNIL) thus recommended that higher education establishments, in the absence of additional measures likely to ensure an adequate level of protection, to use to collaborative suites offered by providers exclusively subject to European law who host the data within the European Union and do not transfer it to the United States. Regarding the use of the Microsoft Office 365 solution, the Ministry of National Education and Youth informed the rectors of academic regions and academies in October 2021 of the "cloud at the center" doctrine (circular of the Prime Minister cited above), the position of the Dinum (note of September 15, 2021 cited above) and the opinion of the CNIL on this subject. The ministry thus asked to stop any deployment or extension of this solution as well as that of Google, which would be contrary to the GDPR. Finally, it should be recalled that the Education Code provides that the local authorities to which schools are attached are responsible for "equipment and operation" and that as such, "the acquisition and maintenance of infrastructure and equipment , including the computer equipment and software provided for their commissioning, necessary for teaching and exchanges between the members of the educational community are at [their] expense” (articles L. 213-2 and L. 214-6 ). Local authorities can thus provide digital work environment (ENT) solutions to establishments that offer communication and collaboration functionalities respecting the principles of the GDPR and digital sovereignty, thus making it possible to do without US collaborative offers not immune to extraterritorial law.