Microsoft Office 365 banned by schools in Germany over privacy fears

And Apple and Google are no better, warns the data protection registrar of the state of Hesse

The state of Hesse in Germany has banned the use of Microsoft Office 365, the cloud version of the Microsoft Office suite, over claims that it potentially enables surveillance.

The issue, according to the state, isn't necessarily the telemetry data that Microsoft routinely takes from individual users, but the level of telemetry that Office 365 engages in.

The General Data Privacy Regulation (GDPR) that came into force across the European Union in May 2018 requires organisations to gain informed consent from users before acquiring their data. However, under German law children aren't legally able to provide that consent, according to the state's interpretation of the law.

Microsoft had previously attempted to quell such fears by opening a cloud region in Germany, but closed it last summer.

"For years, regulators have been in discussion with Microsoft. The crucial aspect is whether the school as a public institution can store personal data (of children) in a (European) cloud, for example, potential access by US authorities," the Hesse Commissioner for Data Protection and Freedom of Information (HBDI) explained.

It continued: "Public institutions in Germany have a special responsibility regarding the admissibility and traceability of the processing of personal data. Also the digital sovereignty of state data processing must be guaranteed.

"In addition, there is another issue that the Federal Office for Information Security has pointed out to the public in autumn 2018. With the use of the Windows 10 operating system, a wealth of telemetry data is transmitted to Microsoft, whose content has not been finally clarified despite repeated inquiries at Microsoft. Such data is also transmitted when using Office 365."

While "the consent of the data subject in certain situations" is an acceptable solution, including parental consent for children, the lack of transparency by Microsoft over the data it exfiltrates in the name of telemetry remains an ongoing problem.

Furthermore, it adds: "What is true for Microsoft is also true for the Google and Apple cloud solutions. The cloud solutions of these providers have so far not been transparent and comprehensible set out. Therefore, it is also true that for schools the privacy-compliant use is currently not possible."

Office 365, meanwhile, was updated in May with new security features and privacy controls.