Office 365 declared illegal in German schools due to risks to privacy

Last week, the German state of Hesse said that its schools can not legally use the Office 365 cloud product. Hesse is one of the sixteen federal states of Germany, with a population of about six million inhabitants (about 83 million Germans). Although the press release specifically targets Office 365, it notes that the competing Apple and Google cloud suites also do not meet German privacy regulations for use in schools.

What is true for Microsoft is also true for Google and Apple cloud solutions. Cloud solutions from these providers have so far not been defined in a transparent and understandable way. Therefore, it is also true that for schools, the use consistent with confidentiality is currently not possible.

Hesse Commissioner for Data Protection and Freedom of Information

This is not the first time that part of Germany has publicly broken with Microsoft Office; In the early 2000s, some German cities, including Munich and Freiburg, had abandoned Microsoft Office applications for the benefit of OpenOffice. These open source adoption programs have experienced notable difficulties, with interoperability problems, simply because a city ​​changes its office applications does not mean that its neighboring cities, its country of origin or even its own citizens have. Municipalities have also been heavily targeted by Microsoft lobbying itself, including Steve Ballmer (then CEO of Microsoft), interrupting a ski holiday to travel to Munich in an attempt to personally close a pro-Microsoft deal.

However, the attempts made in the early 2000s to free Microsoft were a function of choice. This time, the Hessian Data Protection and Freedom of Information Commissioner (HBDI) does not just say that schools: prefer To not use Microsoft, it states that their use of Office 365 is totally illegal. In August 2017, the HBDI decided that Office 365 could be legally used by schools, provided that the back-end of their accounts was stored in Microsoft's German cloud. A year later, Microsoft closed its German cloud data center and schools migrated their accounts to the European cloud. Today, the HBDI indicates that the European cloud can offer access to US authorities. without any means for the German government to monitor this access; This makes use of this illegal cloud without specific consent of its individual users.

In addition to the physical geography of the cloud, HBDI is not satisfied with telemetry in Office 365 and Windows 10. End users and organizations can not be disabled either, and the content of both has not been revealed by Microsoft, despite repeated requests. According to the HBDI, the only legal way to circumvent the cloudy provenance of telemetry – and possible access of US states to user data – is to seek the consent of each user. This means that the schools themselves can not give their consent on behalf of the students, any more than their parents, according to the HBDI. (Article 8 of the EU RGPD provides for parental consent for information services for children under 16, but paragraph 3 expressly states that this does not invalidate contract law. of its Member States.)

It seems that the HBDI prefers not to drop Office, preferring to put pressure on Microsoft to make it comply with German law. The office defines the conditions under which schools can continue to use Office 365: it requires that any possible third-party access to user data be restricted – presumably by reopening a German data center – and that the content of Windows 10 and Office 365 telemetry to be revealed in full. According to HBDI, "until then, schools can use other tools, such as on-site licenses, on local systems."