# Prohibition of Non-European Online Collaborative Suites in French Schools TL;DR: *The document is a firm restatement of a ban on using services like Google Workspace and Microsoft 365 in French schools, citing data privacy, the sensitivity of student information, and the need for educational neutrality. It emphasizes the use of French and European alternatives.* ## Context * **Legal Background:** The document reiterates the legal complexities surrounding the use of non-European (specifically US-based) online collaborative suites like Microsoft 365 and Google Workspace in French schools. It refers to the invalidation of previous data transfer agreements (Safe Harbor and Privacy Shield) by the European Court of Justice (Schrems I & II cases). These rulings meant that transferring personal data to the US was prohibited unless "appropriate safeguards" (under GDPR Article 46) could be demonstrated. * (Note: Additionally, there are strong signs that the DPF is collapsing under the Trump administration, e.g. https://euro-stack.com/blog/2025/3/transatlantic-data-privacy-framework-imminent-collapse) * **SecNumCloud Requirement:** French government administrations, since 2023, are required to use SecNumCloud-certified (or equivalent) cloud services when handling sensitive data. This certification, issued by the French cybersecurity agency ANSSI, guarantees a high level of security, claims the Ministry. * **Data Privacy Framework:** Although a new "Data Privacy Framework" agreement between the EU and US came into effect in July 2023, allowing data transfers to certified US companies (including Google and Microsoft), the Ministry's position *has not changed*. * Similar concerns have been raised by other data authorities in Europe, notably Denmark and Spain. ## The Ministry's Unchanged Doctrine * **Ban on Non-Sovereign Solutions:** The Ministry of Education *strictly prohibits* the use of non-sovereign (non-European, and particularly US-based) online collaborative suites in schools and educational institutions. This applies to both administrative/school management uses and pedagogical (teaching) uses. * **Reasons for the Ban:** * **Sensitive Data:** The Ministry considers data handled in educational settings to be highly sensitive for several reasons: * Exchanges between teachers and families may contain health information or information about disabilities (sensitive under GDPR Article 9). * The content of communications (absence dates, homework, etc.) could indirectly reveal sensitive personal data (racial/ethnic origin, political opinions, religious beliefs). * Data related to students is inherently sensitive because most students are minors. * **Educational Neutrality:** Schools must remain neutral regarding commercial software. Students should be taught digital collaboration skills in a way that's independent of any specific commercial platform. This fosters critical thinking and responsible use of digital tools. **Recommendations:** * **Prioritize ENT and GAR:** The Ministry strongly recommends using the *Espaces Numériques de Travail* (ENT), which are digital learning environments provided by the French education system, and their associated digital services. They also recommend resources available through the "Gestionnaire d'Accès aux Ressources" (GAR), a secure access manager for educational software, which minimizes data transfers outside the EU. * **Sovereign Solutions:** The Ministry promotes the use of "sovereign" solutions (aligned with article 16 of the 2016 Digital Republic Law), prioritizing data protection of students and staff. **Enforcement:** * The Secretary General instructs regional and academic authorities to enforce this directive and inform local government partners. * The ministry will be enforcing its doctrine via the legally binding "doctrine technique du numérique pour l'éducation", recommending the use of ENT and GAR.