As the Hessian Commissioner for Data Protection and Freedom of Information states in a second statement on the use of Office 365 in Hessian schools, the use under certain conditions and subject to reservation is currently possible. Even if he only refers to Hesse, his concerns apply throughout Germany.
Accordingly, it was after intensive discussions with Microsoft decided to temporarily condone the use of the cloud application Office 365 in the version from 1904 (Office365 ProPlus, Office365 Online and Office365 Apps), despite the loss of the Germany cloud initially, if the facilities have already purchased a corresponding Office 365 package. Initially, such institutions can also appeal to this tolerance, in which the acquisition of an Office 365 license is already guaranteed under budgetary law. The toleration is based on trust considerations. Schools, which still intend the acquisition, can also rely on the toleration, but carry the financial risk, if the further review by the Hessian data protection officer Michael Ronellenfitsch should lead to the inadmissibility of the use of Office 365 in Hessian schools. Mistrust considerations are not considered here.
He also did not want to prejudge the opinions of the competent committees of the Conference of Data Protection Commissioners of the Federation and the Länder, but kept an independent review of the use of Office 365 in Hessian schools.
Microsoft was able to refute many concerns
Since this review proves to be very protracted and is not completed by the beginning of the new school year, the admissibility or inadmissibility has not yet been finalized. Intense discussions with Microsoft on the privacy of Office 365's school application, while respecting the principle of proportionality, have now led it to mitigate its July 2019 statement as it led to a privacy-related assessment and a significant proportion of Microsoft's concerns could be invalidated.
Data transmission must be stopped
In addition, the use of Office 365 in schools requires an obligation for schools to provisionally prevent the transmission of any kind of diagnostic data. The Hessian Commissioner for Data Protection and Freedom of Information will in due course make further stipulations regarding the parameters that must be implemented as a basis for the use of the cloud. Microsoft will provide schools with instructions for action.