France bans Office 365 and Google Workspace in schools

France bans Office 365 and Google Workspace in schools

The minister of Education says the two platforms do not meet current privacy requirements.

The French Ministry of National Education has urged educational institutions to stop using free versions of Google Workspace and Microsoft Office 365 for schools and students. The Ministry said the offerings are incompatible with the EU’s General Data Protection Regulation (GDPR), the Schrems II judgment of the European Court of Justice and France’s internal doctrines.

According to Minister Pap NDiaye, the ministry’s directions “invites various ministers to ensure that commercial cloud offers benefit from the SecNumCloud qualification or an equivalent European qualification”. This is not the case for the free offers of Microsoft Office 365 and Google Workspace, NDiaye claims.

US Cloud Act poses privacy threats

France’s privacy watchdog (CNIL) recommends that institutions use collaborative suites offered by service providers “exclusively subject to European law” which “host the data within the European Union and do not transfer it to the United States”.

The minister added that “the deployment of Office 365 is prohibited in French administrations“. In fact, France’s interministerial digital director issued a circular published in 2021, saying that data should no longer be hosted on Microsoft 365 cloud services to protect against possible security breaches and misuse by US intelligence services.

The circular was published in response to the US Cloud Act, which permits US authorities to view data held by any US entity, regardless of where the data is stored. As it stands, ministries may continue to use Microsoft’s software and applications (Word, Excel, etc.), but only as on-premises versions.

France is the second EU country to prohibit free versions of Microsoft Office 365 in education. Germany banned the software platform in 2019. Like France, Germany decided that the software suite gathers data from users’ machines and transfers it to US data centres in violation of GDPR guidelines.