What is happening: Two separate changes are occurring at the same time. The management of student data — grades, absences, orientation — is moving from GestIB, the Balearic Islands' own system, to Llull, a copy of the Andalusian system Séneca, implemented by the private company Ayesa for 5.4 million euros. At the same time, Google Workspace educational tools are being replaced by Microsoft 365. This is not an isolated case; it is a pattern repeating across the entire educational system.
Why it matters: These are two distinct issues, and we should not conflate them. With Llull, even though the data remains hosted here, the Balearics are relinquishing their own system, binding themselves to a single provider and to a model decided by another administration. This same system is already used in Andalusia to feed an artificial intelligence — developed by the same company, Ayesa — that profiles students. With Microsoft 365, the data passes to a US corporation, which is bound by its own national laws to hand over data without families ever knowing. Neither is a technical decision: it is a choice of who controls our children's information, and for how long.
What you can do: A single teacher can do very little; but teachers united, alongside families and organizations that have been fighting this for years, can do a great deal. At the end of this letter, you will find concrete, cost-free steps to get started.
The first three sections explain my personal journey to this point. If you are in a hurry, skip directly to what is happening right now.
I went to Mar del Plata to learn. It was an international Debian conference, and I was an apprentice among veterans. One of those veterans needed his interview translated from French to Spanish, and I was happy to help. That was all I had to do. What I did not expect was for someone to seek me out afterwards to interview me.
They asked me about Bulma, the Balearic association dedicated to free software. Its members were a group of enthusiasts from the Mediterranean islands who published everything they knew in Spanish and Catalan, each in the language they preferred: what free software meant, how to compile the Kernel, how to resolve day-to-day technical issues with GNU/Linux, and so on. Everything went on our blog and our mailing list, without a budget, without a corporate structure, and without any plan to get anywhere in particular. We were people with shared values and a desire to share what we knew. As it turned out, Bulma had become the global benchmark in Spanish for free software. This meant that across the globe, if anyone was looking for information in Spanish on the subject, they came to us.
I tell this story without nostalgia or pride. I tell it because it teaches an important lesson: the impact of what we do is rarely proportional to the resources used, our individual brilliance, or the plans we make. It has more to do with persistence, values, and creating something genuinely useful for others.
I was not one of Bulma's best writers, but I was one of the most persistent. And over time, that turned out to be enough for something significant.
During those years, I went to many conferences: Debian, KDE, free software meetings in South America, Europe, and Asia. I did not go as a star or a recognized expert, but as someone with a lot of curiosity who was lucky enough to be there.
What struck me most was not the technology. It was the people. There is a type of person who appears at these gatherings whom you do not easily find elsewhere. These are individuals who work on something for years without any significant financial reward and with no guarantee that their work will ever be useful. They are guided primarily by the conviction that certain things matter, that knowledge should be free, and that technology should serve people, not the other way around. They all believe that the digital infrastructure of a democratic society cannot be left in the hands of those who are not accountable to that society.
I returned from those trips with a head full of ideas and a difficulty I did not know how to resolve for years: how to convey, in the day-to-day, in the staffroom, in the school corridors, some of the urgency and clarity I felt there. It was not easy, and it was no one's fault. My colleagues are good teachers. They are committed to their students, carry a massive workload, face constant educational reforms, and have families to care for and lives to live. The fact that they were not thinking about software architectures and digital sovereignty was not a failing on their part. It was simply that nobody had trained them to critically analyze the digital infrastructures they used every day. It is paradoxical that while the curriculum speaks of shaping critical citizens, technological decisions are presented as inevitable or purely technical. They are not; they are also deeply pedagogical. Knowing how to decide and maintaining a critical spirit in the face of decisions handed down from above are among the best competencies we can teach.
For years, we fought against software patents in Europe. It was a technical and political battle: if software patents were allowed, as they are in the United States, any company could patent abstract ideas implemented in code and legally block any competitor, including free software projects.
The European Parliament rejected the directive. It was a real, collective victory, built by thousands of Europeans who wrote to their MEPs to explain the problem and refused to give up the battle when it seemed impossible to win.
We won that battle by 648 votes to 14. And years later, the European Commission created a new entity to reintroduce, by administrative means and without parliamentary debate, what the Parliament had so overwhelmingly rejected.
I do not tell this story to discourage anyone. I tell it because it is the reality of the terrain we are on. Progress is not permanent, as we must defend every victory achieved, but setbacks are not permanent either if people are unwilling to give up.
Spain was a pioneer for years. For instance, Extremadura deployed LinEx, its own GNU/Linux distribution, across all schools and public administrations, with all that meant in terms of technological, social, and economic progress, as well as freedom. Meanwhile, Andalusia, Valencia, and other regions bet heavily on free software in public education. All of this made us a European benchmark, but we have been backsliding for a while now. And we are doing so so slowly, wrapped in technical and bureaucratic jargon, that it is hard to notice if you do not know where to look.
This school year, we were informed that GestIB, the educational management system we had been using, would be replaced by a new, mandatory tool: Llull, a replica of the Andalusian government's Séneca system, awarded through public contract to the private company Ayesa for 5.4 million euros. Additionally, the Google Workspace tools implemented during the pandemic would be replaced by Microsoft 365.
It is worth saying something about the pandemic, because many of us lived through it without fully naming what happened. With classrooms closed and students at home, rapid decisions were made. There were free alternatives: Jitsi for video calls and Moodle for classroom management. However, people with access and influence actively promoted Google's tools, and urgency was used as an argument to avoid opening a debate. Those of us who tried to propose other options found neither the time nor the space to be heard, and the result was that, in a matter of weeks, all educational activity, conversations, documents, and evaluations were stored on the servers of a private US corporation. The urgency passed, but the normalization remained.
Now this process is going further, and this time there is no emergency to serve as an excuse. The official justification for leaving Google is privacy: they claim Google cannot guarantee that student data remains in Europe. But this argument holds little water, because in its paid edition for schools, Google allows users to choose to store data in Europe, just as is paid for with Microsoft. And even if that were not the case, it would not change the core of the problem, because it is not about where the servers are located. Both Google and Microsoft are US companies, bound by their own national laws to hand over data without families ever knowing. On June 10, 2025, before the French Senate's commission of inquiry into public procurement, Anton Carniaux, Director of Public and Legal Affairs for Microsoft France, was asked under oath if he could guarantee that French citizens' data would never be handed over to the US government without the explicit agreement of French authorities. He replied that he could not guarantee it, though he added that it had not happened yet. His response must be taken seriously because it is a legal statement in a parliamentary hearing, not the opinion of an activist. And what he could not guarantee has already ceased to be hypothetical: in May 2026, as published by the Dutch magazine Vrij Nederland, Microsoft handed over emails, meeting minutes, and unanonymized names of Dutch civil servants in charge of enforcing European digital legislation to a US House of Representatives committee. The Dutch government has demanded explanations and is still investigating the exact scope of what was shared.
The changes being carried out offer no solutions. All that has been done is to exchange one US monopoly for another. The previous software was not perfect. I had my own reservations about GestIB because it centralized private student information, so I was not surprised when, in July 2024, it suffered a real security breach, with unauthorized access to student and family data. But at least it was software under public control; at least, in theory, we could know what was being done with that data and demand accountability from those who managed it. I am not alone in this view: the Official Association of Teachers of the Balearic Islands has formally requested to halt the process and reinforce our own management system, warning of the risk of technological dependency in managing sensitive educational data.
It is worth separating two changes that are announced together but are not the same. Llull is implemented by Ayesa, a Spanish company, and all indications are that the data remains where GestIB's was; here, the problem is not a foreign law — which is the case with Microsoft, not Llull. The problem is closer to home: we have swapped our own system, which we knew, for a copy of the Andalusian system decided and maintained by an external company. And we are living through this right now: since January, schools have been reporting that the tool is collapsing and financial management is almost paralyzed. When something fails, it is no longer up to us to fix it. We have paid 5.4 million euros to become more dependent.
And there is something about that data that deserves to be described more precisely than usual, because I am not just talking about grades and attendance. The management system obligatorily records counselor interventions: the content of sessions for which families signed a special authorization, with the expectation of privacy that such a signature implies. It includes, for example, the file on a bullying case, with the names and surnames of the bullied child and the bully. Information that families share with the school not because they want to, but because they need the system to help their children. When those families signed those authorizations, they placed their trust in us. They did not trust a private company's management system; they trusted us.
And we must look squarely at where this leads, without hypothesis, because it is already happening. The same Andalusian system we are now copying is used in Andalusia to feed an artificial intelligence — developed by the same Ayesa implementing Llull here — that crosses accumulated student data to predict, among other things, which students are going to drop out or skip class. That is to say: data collected "to manage" ends up serving to profile. And "profiling" is not alarmist rhetoric; it is exactly what GDPR Article 4(4) defines: the automated processing of personal data to evaluate or predict aspects of a person. And if someone replies that the contract prohibits using it for anything else, the answer is right next door: in Andalusia, with this very system, it is already being done. This is what should weigh heaviest on us: privacy, once lost, is almost impossible to reclaim. A contract can be terminated, a provider changed, or a law modified; what cannot be undone is that a minor's data has already been collected, copied, and accumulated, year after year. That is why it is wise to secure it before handing it over, not after.
You do not have to want things to go wrong for them to happen. It is enough just not to ask if they might (Arendt). And for too long, in too many staffrooms, that question has not been asked.
We must protect ourselves from executing without question what authorities decide for us. Social psychology has shown for decades that the impulse to obey authority is very strong in most people (Milgram). Knowing the mechanism is our best defense.
Our students' educational data — including therapeutic interventions and counseling reports — will pass to a system whose code is neither free nor accessible to the public: no one outside the administration can verify what is done with it. And it is not abstract: that same Séneca system already feeds an AI in Andalusia, Hipatia — also developed by Ayesa — that profiles students based on two decades of records. A minor's data does not expire; it can be saved forever and end up profiling them years later. This is not a technical decision: it is deciding who controls our children's information, and for what purposes.
This pattern is not exclusive to the Balearic Islands, nor is it limited to education. When administrations entrust the management of citizen data to proprietary platforms, they also cede part of their control over critical infrastructure. The debates in the United Kingdom over the use of private data analytics platforms in the National Health Service show how much these decisions affect the transparency and sovereignty of public institutions. When we talk about educational, health, or administrative data of an entire society, the control of those tools should not depend on the commercial interests of a private provider accountable to no one.
What is at stake has a name: technological sovereignty. It is the capacity of a society to decide about the tools and data on which it depends, rather than being bound to external corporations that can change terms, raise prices, or cut off access whenever it suits them.
And the fact that an alternative exists is not a theory. The Community of Madrid has maintained EducaMadrid for years: email, cloud storage, virtual classrooms, and materials for teachers and students run on their own platform based on free software, controlled by the administration itself, without ceding that data to Google or Microsoft. If they can do it there, we can do it here.
And the direction of travel in Europe is already the opposite of the one the Balearic Islands is taking. In the very week of June 2026 that this letter is circulating, the European Parliament replaced Google with a European search engine on all its computers, the Commission presented its legislative package on technological sovereignty, and a coalition of European companies released Euro-Office, a free office suite designed explicitly for administrations and educational systems. France, for its part, has ordered each ministry to draw up a plan to eliminate non-European technological dependencies, and its state videoconferencing platform is built on Jitsi: the very free tool discarded here due to the haste of 2020 is today the official infrastructure of a European state. While the Balearics are moving in, Europe is moving out.
That this is happening is not an accident. It is not that no one has thought about the consequences. What is happening is that there are those who benefit from administrations depending on proprietary software — that is, from their data being on infrastructures they do not control. As time goes on, the difficulty of escaping this dependency will only increase. No conspiracy or villains are needed. All that is required is for incentives to point in the wrong direction and for no one to make enough noise to change that direction.
What can a computer science teacher do against the Regional Ministry of Education?
Honestly, if you are alone, you can do very little or almost nothing. I have voted against technological decisions in staff meetings where mine was the sole dissenting vote; I have had to endure joking remarks; I have published articles in engineering and educational journals that reached those they needed to reach, but failed to bring about any significant change; and I have watched decisions that seemed immovable forge ahead regardless.
I do not tell this story to complain. It is the necessary context for what comes next.
Because the conclusion is not that it is not worth trying. The conclusion is that the individual is the wrong unit of action.
Any teacher from the Balearic Islands could tell this story. Each will have had their own conferences where they went to learn, their own battles won and lost, their own moments of raising their hand when no one else did. Our paths have been different, but the situation we are in now is the same for all of us. And what at first seems to be merely a shared problem is, in reality, our most important resource.
If I learned anything in those years, it was not technical.
Movements do not need brilliance. They need persistence and shared values. They do not need everyone to be an activist. They need whoever sees the problem to name it, whoever has energy to contribute it, and whoever has technical knowledge to put it at the service of those who do not. Each person in the place they can occupy, without anyone having to take the place of another.
A single teacher alone against the Regional Ministry can do nothing. However, the teachers of all Balearic schools, backed by families who understand what is at stake, supported by organizations that have been in these battles for years, and aided by European legislation, which is on our side, present a common front that is much harder to ignore.
I am not asking you to become an activist. I am not asking you to vote alone in meetings where no one else does. I am not asking you to do anything that does not fit who you are and what you have to offer.
I only ask that you understand what is happening; that when someone explains it to you, you listen; that when you have the opportunity to add your voice to others, you add it; that when someone around you has doubts about whether it is worth getting involved, you tell them yes, it is worth it, even if the result is not immediate or guaranteed.
We all need each other. Some have had access to information and experiences that not everyone has; others act because they have the necessary energy and willingness. Some bring technical, legal, or relational knowledge that others lack, and some are simply present, making our numbers greater.
In Argentina, when they asked me about Bulma, I did not expect us to become a benchmark for anything. I had only gone to learn, and I helped a colleague to be understood. But what we built in the Balearic Islands went further than any of us expected when we started, and we achieved it because we were persistent and because what we did was genuinely useful.
I do not know how far what we do from now on can go, but I know that if we do nothing, we will get no results at all.
My own students asked me to write for them and their families too. They are already here: an open letter to families and an open letter to students, designed so anyone can print and distribute them.
If this has resonated with you and you want to ensure it does not end up as a flash in the pan, you can take concrete, cost-free steps:
- Share this letter with other teachers at your school.
- Bring it to the staff meeting: share it by email as a reference and propose discussing the issue at the next staff meeting to see if the school is willing to take a stance.
- Take a stand as a school: a motion or a digital sovereignty and privacy clause in the School Council is something that can actually be passed.
- Demand guarantees: ask the Regional Ministry, in writing, for a commitment that student data will not feed artificial intelligence systems, whether governmental or corporate, and for the publication of the impact assessment required by GDPR Article 35 for large-scale profiling of minors. A school cannot prevent the handover of data that regulations oblige it to upload, but it can demand guarantees and leave a paper trail.
- Inform families and students, who are the most directly affected and have a right to know: there is a letter prepared for each.
- Protect the data you handle professionally right now by uploading only what is strictly necessary to the system.
- Join in: write to eldeinformatica@pm.me. We will use these emails to create a list to coordinate, keep sharing information, and keep track of those who want to help.
Public money must produce public code. What is built with everyone's resources must belong to everyone. And our students' data is not a commercial asset; it is private information of people who have been entrusted to us.
Computer science teacher · Balearic Islands
h @ saberlibre.net or @ReneMerou
Member of Bulma (H in the free software community)
Published under Creative Commons CC BY-SA 4.0 license
Share, adapt, distribute.
saberlibre.net · LibreEdu