Office 365 declared illegal in German schools due to privacy risks
Enlarge / Germany's government continues its history of principled Microsoft opposition. (credit: Flickr user fdecomite)
Last week, the German state of Hesse declared that its schools may not legally use the Office 365 cloud product. Hesse is one of the sixteen federal states of Germany, with a population of roughly six million (of roughly 83 million Germans). Although the press release specifically targets Office 365, it notes that competing Apple and Google cloud suites also do not satisfy German privacy regulations for use in schools.
This isn't the first time part of Germany has publicly broken up with Microsoft Office; some German cities including Munich and Freiburg famously ditched Microsoft Office applications in favor of OpenOffice in the early 2000s. Those open source adoption programs have had a notoriously rough ride, plagued with interoperability issues—just because one town changes its office applications doesn't mean its neighboring towns, parent state, or even its own citizens have. The municipalities have also been targeted heavily with lobbying from Microsoft itself, up to and including Steve Ballmer (then Microsoft's CEO) interrupting a ski vacation to fly to Munich to try to cut a pro-Microsoft deal in person.
However, the early-2000s attempts to break free of Microsoft were a function of choice. This time around, the Hessian commissioner for Data Protection and Freedom of Information (HBDI) isn't just saying that schools would prefer not to use Microsoft, he's stating that their use of Office 365 is outright illegal. In August 2017, the HBDI ruled that Office 365 could legally be used by schools so long as the back end for the school accounts was stored in Microsoft's German-located cloud. A year later, Microsoft closed its German cloud datacenter, and schools migrated their accounts to the European cloud. Now, the HBDI states that the European cloud may offer access to US authorities; with no way for the German government to monitor such access; this makes use of that cloud illegal without specific consent being granted by its individual users.