France no longer controls its data: Microsoft will give it to the United States “if we are forced”
Headquarters from Microsoft France to Issy-les-Moulineaux, seen through a foliage, symbol of a less transparent cloud than it seems. © HJBC
On June 10, 2025, the senatorial commission of inquiry on public procurement received Microsoft France for a much awaited hearing. What said there has left no room for ambiguity: American law is essential, even when the data is hosted in Paris or Marseille. And the confession did not come from an activist or an external expert, but from the legal director of Microsoft France himself.
Advertisement
Cloud Act: Microsoft cannot prevent US government access to French data
Faced with senators, Anton Carniaux, legal director of Microsoft France, did not revolve around the pot. To the question of whether Microsoft could protect French data from an American injunction, he replied, without detour:
If we are forced by an American court decision, we must hand over the data.
Microsoft tools like Word, Outlook or Onedrive are massively used in public services. They are directly affected by American judicial injunctions, as soon as Microsoft remains the operator. © Shutershock
The Cloud Act, adopted in the United States in 2018, obliges any American company to respond to a legal requisition, including for data stored abroad. Microsoft, although with centers in France, remains legally subject to this framework. The storage place therefore does not make a barrier to the right.
What troubles more is that the French state continues to massively buy Microsoft services via UGAP, in particular by the “Multi-editor-editor” market, in which Microsoft Ireland acts as a supplier. Thousands of administrations, hospitals or communities thus use Microsoft 365 or Azure, often without conscience of legal consequences. Even if the accommodation is local, the risk remains transatlantic.
And the problem does not only come from Microsoft. During the same hearing, the Dinum (inter -ministerial digital direction) recognized that the requirements of sovereignty defined by the State are not yet applied completely. In other words, public procurement continues to go through non -compliant solutions, despite the official doctrine.
The conditions of sovereignty, as they have been defined in state doctrine, are not yet fully applied.
Microsoft, for its part, highlights safeguards: dispute of abusive requests, transparency reports, advanced encryption, sovereign cloud project with European governance. But even these devices, as serious as they are, are erased as soon as an American court pronounces an injunction.
Lyon: acting for digital sovereignty
In response to these flaws, The city of Lyon has decided to break with the Microsoft Office suite. According to the town hall, this decision is registered “In a context of increasing awareness of the challenges of digital sovereignty”. It adopts the open digital territory suite, developed with Sitiv, hosted in regional data centers, and gradually replacing Microsoft by Onlyoffice, Linux and PostgreSql.
Lyon acts as a school case: a public community which implements localized, free and controlled solutions, in order to escape the weight of extraterritorial laws.
Advertisement
Want to save even more? Discover Our promo codes Selected for you.
