On July 9, the German state of Hesse warned its schools that they may not legally use Microsoft Office 365 as the data stored in the cloud, even if the data was held in European centres, could potentially be accessed in the US. Apple and Google cloud suits also do not satisfy German privacy regulation for use in schools, but the release targets Microsoft.

German state wants data locally stored

The Hessian commissioner for Data Protection and Freedom of Information (HBDI), Michael Ronellenfitsch, has declared it illegal to use Office 365 in schools. In August 2017, the HBDI had ruled that schools could legally use Office 365 as long as back-end data for the school accounts was stored in Microsoft’s German-located account, Ars Technica reported.

However, in 2018, Microsoft stopped offering the Microsoft Cloud Germany data trustee model, and school accounts were migrated to the European cloud, as per the HBDI ruling. HBDI has argued that because it is the European cloud, it may give access to American authorities and the German government has no way to monitor that access. HBDI’s notice said that Microsoft had not clarified if private data of German school children stored in the European cloud could be accessed by American investigators. In the absence of specific consent by users, use of European cloud is illegal.

Microsoft already offers Germany a differentiated Office 365 from rest of Europe that delivers services “from German data centers, with data residency in Germany and strict data access and control measures via a unique data trustee model governed under German law”.

Another sore issue for HBDI: Microsoft’s stance on telemetry

Telemetry in Office 365 and Windows 10 cannot be disabled by end users/organisations. According HBDI, the only legal way around this, and potential American state access to users’ data, is asking for consent of individual users. For that, individual students, and not school or parents on their behalf, will have to give consent as per GDPR.

HBDI is trying to pressure Microsoft into complying with German law by putting down the following conditions:

  1. Curtail all possible access of third parties to user data
  2. Reveal full contents of Windows 10 and Office 365 telemetry

Microsoft versus Germany isn’t a new fight

Between 2005 and 2006, the municipal government of Munich migrated all its 14,000 desktops from Windows NT 4 and Microsoft Office to open source Linux and OpenOffice.org. However, that shift has repeatedly run into problems because of interoperability issues as not all local governments have made the shift.