The French doctrine on the use of the cloud tested against free American solutions for education

France continues to strengthen its doctrine regarding the use of cloud solutions within its administration.

This particular position, embodied in circular n°6282-SG of July 5, 2021 on the doctrine for the use of cloud computing by the French State, known as the “cloud at the center” doctrine, identifies the cloud as one of the prioritary areas for the State’s digital transformation and encourages public actors to take advantage of it.

The French government’s passion with these decentralized computing technologies does not, however, go without concern for maintaining control over personal data. Sovereingnty and security issues are thus at the heart of the French State cloud doctrine.

In this context, Microsoft Office 365 and Google Workspace, which had been provided for free to schools, raise such issues.

If we understand the interest of these tools for the educational sector, in particular with the Covid crisis when schools were closed, the US-originating providers of such solutions pose a concrete problem to the French administration and to the objectives that it has set in its cloud at the center doctrine, particularly in terms of digital sovereignty and immunity from foreign, non European, jurisdiction.

Without rewriting the story countless times told of the European Court of Justice’s “Schrems II” ruling invalidating the transatlantic personal data transfer agreement between the European Union and the United States, the transfer, in the U.S, of the personal data necessarily present with such software indeed poses a serious problem of legality with regard to the rules enacted by Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the “GDPR”).

Already, in a publication dated May 27, 2021, the French supervisory authority (the “CNIL”) called for the identification of possible alternatives to the collaborative solutions for higher education proposed by US-originating providers.

In its wake, in a note sent on September 15, 2021 to the general secretaries of the ministries, the French Direction interministérielle du numérique (the “DINUM”), specifically considered that Microsoft’s Office 365 offering (i.e., the hosting of Microsoft applications on its Azure cloud infrastructure) did not comply with the cloud at the center doctrine.

More recently, on November 2022, the French Minister of Education and Youth, when asked by a Member of the Parliament about the massive deployment of the above-mentioned US-originating free solutions in French school, asked to stop deploying or extending them. The French system being highly decentralized on the subject of education, it is up to the local public authorities to apply this ban and to find alternative solutions… If any…

Given the political issue really at stake with the cloud at the center doctrine, one could think that this issue will be alleviated with the soon expected adoption of the new data transfer agreement between the United States and the European Union. Though, nothing could be less certain.

Article provided by INPLP members: Charlotte Barraco-David and Marie-Hélène Tonnellier (OYAT, France)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)