A data privacy authority for the German State of Hesse says Office 365 cannot be used in schools because it’s unclear what Microsoft does with the data it gathers.
A data authority in the German State of Hesse has warned Microsoft’s Office 365 cannot be used in schools. Michael Ronellenfitsch, Hesse’s data protection commissioner, says the standard Office 365 configuration creates privacy issues.
He warned this week that data stored in the cloud by the productivity suite could be accessed in the United States. Specifically, personal information from teachers and students would be in the cloud. Ronellenfitsch says even if the data was held in centers in Europe, it is still “exposed to possible access by US authorities”.
The commissioner says public intuitions in Hesse and across Germany “have a special responsibility with regard to the permissibility and traceability of the processing of personal data.”
Furthermore, the Federal Office for Information Security (BSI) added that Windows 10 also transmits “a wealth of telemetry data to Microsoft”. BSI officials say they have reached out to Microsoft to see what data it takes from its services by have received no reply.
It is worth noting that Ronellenfitsch previously endorsed the use of Office 365 in schools. Back in 2017, he said schools can use the suite under certain conditions that match Germany’s data protection compliancy laws. At the time, Microsoft was partnered with Deutsche Telekom and offering the “Germany Cloud” initiative that is now depreciated.
Hesse’s data protection authority has decided to clarify its position after school authorities recently heavily promoted Office 365 as a workable tool in institutions. Ronellenfitsch says it is not enough for users to simply consent to using the suite in the cloud. He argues the data remains compromised because its security and traceability are uncertain.
The ball is now in Microsoft’s court.
“As soon as, in particular, the possible third-party access to the data in the cloud and the issue of telemetry data have been resolved in a comprehensible and data protection-compliant manner, Office 365 can be used as a cloud solution by schools,” he says.
Office 365 Germany was released by Microsoft in 2017. Collaboration services and the full Office 365 suite are now held in German located datacenters. This alternative version of the suite allows users to have an Office 365 version that is held within German datacenters.
Ronellenfitsch does not make mention of Office 365 Germany, but it seems likely it falls under the same conditions. While data is held in German datacenters, it is still unclear what data Microsoft can see and leverage from other regions.