France moves to cut reliance on Microsoft for health data

The French government has launched a programme aimed at reducing the health service’s reliance on software provided by US technology company Microsoft, in a significant shift driven by concerns over digital sovereignty and foreign control of critical infrastructure.

Central to the issue is the Plateforme des données de santé (PDS), a digital platform which, since its creation in 2019, has been hosted on Microsoft Azure, despite reservations expressed by France’s data protection authority, the CNIL.

The PDS contains records of almost every electronic interaction within the French health service. Security specialists say information that could identify patients or healthcare professionals has been removed, with the data retained in anonymised form to support medical research.

Growing concerns over data control

Opposition to entrusting such a sensitive system to a US company has been a recurring theme in French political debate, focusing on the implications of placing critical infrastructure under foreign legal and political control.

The issue has gained prominence amid wider geopolitical tensions, including during the second presidency of Donald Trump and under US Health Secretary Robert F. Kennedy Jr.

Particular concern followed US sanctions imposed on judges at the International Criminal Court in The Hague, which intensified European debate over the vulnerability of public institutions reliant on large US technology providers.

US legislation such as the Cloud Act and provisions under the Foreign Intelligence Surveillance Act (FISA) has further reinforced fears that US authorities could compel disclosure of data held by American cloud providers, even when stored in Europe.

Shift towards European providers

When Microsoft was selected to host the PDS, the government said no French provider matched its performance and security capabilities.

However, following sustained political and institutional pressure, a new tender process was launched in 2025 with a stronger emphasis on digital sovereignty.

The revised criteria effectively excluded Microsoft from contention.

In April, the government announced that Scaleway had been selected to operate the platform. The company is part of Groupe Iliad, best known for its telecoms brand Free.

Financial terms have not been disclosed, though industry estimates place the contract at around €6 million over four years.

The infrastructure will be hosted within Europe, although not necessarily in France itself, according to Scaleway.

Doctolib scrutiny

With the PDS transition underway, attention has turned to Doctolib, which operates France’s dominant medical appointment booking system.

Doctolib holds data relating to around 50 million people, approximately 70% of the French population, as well as information on 500,000 healthcare professionals. Its data is hosted by Amazon Web Services.

This arrangement places it under the same US legal frameworks — including the Cloud Act and FISA provisions — that prompted scrutiny of Microsoft’s role in the PDS system.

Doctolib has so far resisted calls to relocate its data hosting to a European provider, arguing that no domestic or European alternative currently matches the scale and reliability of US hyperscalers.

The company has also faced legal scrutiny in France over allegations of unauthorised data transfer abroad, but the case was ultimately resolved in its favour by the Conseil d’État, France’s highest administrative court.

Doctolib has made limited adjustments to its infrastructure strategy, including transferring some data to S3NS, a joint venture between Thales and Google, reflecting a hybrid model of compliance and risk diversification.

However, reliance on US-linked infrastructure remains central to its operations.

European and domestic sovereignty pressures

Digital sovereignty concerns are not limited to health data. The European Parliament has replaced Google with the French search engine Qwant on thousands of internal systems, although Qwant itself has faced criticism for reliance on Microsoft’s Bing infrastructure.

In France, similar concerns extend to government communication systems. The secure messaging platform Tchap, used by ministers and civil servants, was recently compromised after a hacker gained control of a user account. The Direction interministérielle du Numérique (DINUM) said no stored messages were accessed.

The government has also promoted adoption of the French-developed encrypted messaging app Olvid as an alternative to US-owned platforms such as WhatsApp, although uptake remains limited.

Despite the policy shift toward European providers, officials continue to face a structural dilemma: balancing sovereignty objectives with the performance, scale, and security capabilities of US hyperscale cloud providers, which still dominate global infrastructure markets.