France shifts Health Data Hub to Scaleway, ending Microsoft Azure deal

France shifted its Health Data Hub to Scaleway, ending a long-running Microsoft Azure arrangement over one of the country’s most sensitive digital assets. The move handed the platform for health records and research data to a French cloud provider and turned a procurement decision into a sovereignty test for Europe’s public sector.

The Health Data Hub, officially the Plateforme des données de santé (PDS), was created by an arrêté on November 29, 2019 to facilitate the sharing of health data for research. The CNIL says the platform, jointly with CNAM, is responsible for storing and making available the main Système national des données de santé, or SNDS, database and related health datasets. That scope has made the platform a central piece of France’s health-data infrastructure, not just an administrative repository.

The Microsoft arrangement had been under pressure for years. On October 13, 2020, France’s Conseil d’État said it could not exclude a risk that Health Data Hub data could be transferred to U.S. intelligence services and ordered additional safeguards. The controversy deepened after Microsoft representatives told French lawmakers they could not resist a U.S. injunction or government order affecting French citizens’ data, even if the information was stored in France. A 2024 French legal framework then strengthened the political case for change by requiring sensitive data to be hosted on sovereign infrastructure not subject to U.S. jurisdiction.

The issue resurfaced around EMC2, a health-data warehouse that combines information from four hospitals, Hospices Civils de Lyon, Centre Léon Bérard, CHRU de Nancy and Hôpital Saint-Joseph, with the SNDS main database. The CNIL authorized EMC2 on December 21, 2023, and the authorization was published on January 31, 2024. In March 2024, France’s health-digital agency said the CNIL had asked several public bodies to assess whether EMC2 could be hosted in a sovereign European environment, and that review fed into the regulator’s decision.

Scaleway, which is a subsidiary of Iliad, gained more than a contract. The selection added to the company’s broader European momentum and followed other recent public-cloud wins across Europe. For France, the shift signals a harder line on where strategic data should live and who should be able to reach it. The Health Data Hub case now stands as a clear example of how cloud architecture has become a matter of legal control, industrial policy and national security, not just uptime and price.