A ban on the use of Office 365 products in German schools has been temporarily lifted following a series of talks between Microsoft and the Hessian Data Protection Commissioner, according to an updated statement released today.
The German state of Hesse imposed restrictions on the use of Microsoft software in July after ruling Office 365 exposed information on students and teachers to potential access from US officials, and was therefore in breach of the EU’s General Data Protection Regulation.
The decision followed several years of debate around whether German public authorities should use such cloud software at all, given that a large chunk of data is funnelled back to the US.
Office 365 was largely tolerated so long as Microsoft continued to invest in a local German cloud service, removing the need to send data back to the US. However, last August the company decided to shutter this service, leading officials to eventually conclude last month that Office 365 use no longer complied with data laws.
Yet, in another twist, the Hessian Data Protection Commissioner, Professor Michael Ronellenfitsch has now decided to “provisionally tolerate” the use of Office 365 in German schools, provided a series of conditions are met.
“The legality of using Office 365 is not yet fully understood,” said Ronellenfitsch, in a statement. “In my opinion dated 09.07.2019 I have drawn the conclusion and explained that according to the state of the checks, the use of Office 365 in Hessian schools can not be tolerated.
“Since then, there have been intensive discussions with Microsoft about the privacy compliance of Office 365’s use in the school, which has led to a privacy-related assessment and has invalidated a significant proportion of the concerns.”
The ruling allows schools that have already purchased version 1904 of Office 365 and its various apps to continue using the software “until further notice”.
However, those schools are also required block the transmission of any kind of diagnostic data themselves, although Microsoft is required to provide support with this – that is until the data protection authorities are able to provide a more permanent solution.
The Hessian data authority has also promised to conduct an audit of the current arrangement over the next few months, and will deliver a more permanent data protection assessment for the school sector, the statement added.
The decision appears to be something of an attempt to limit any potential disruption an outright Office 365 ban might have. However, it’s likely that the ban will return unless Microsoft comes up with a way of preventing diagnostic data from leaving the country.