14 DAY TRIAL // Microsoft’s Office 365 is no longer allowed in the schools in the central German state of Hesse, after the local authorities have decided to ban the software due to a series of privacy concerns.
In an announcement (in German) on the official website, the Hesse Office for Data Protection and Information Freedom explains that Microsoft Office 365 collects telemetry and sends information to servers located in the United States, making all the data available to the local government.
The saga started several years ago when Microsoft decided to address all concerns by setting up a dedicated German cloud service specifically for storing data from customers in the country.
In 2017, the Hesse authorities officially offered their go-ahead for Microsoft products to be used in local schools as long as the data was indeed stored on the servers in Germany.
Google and Apple also causing privacy concerns
It all changed in 2018 when for some reason, Microsoft gave up on its partnership with Deutsche Telekom, which was formed as part of the Microsoft Trustee Model. However, the company continues to operate data centers in Germany.
In this context, using Office 365 in Hesse schools is no longer allowed, as the US government can thus access information belonging to German customers, the local authorities claim. Similar concerns target Windows 10, the office says in its statement.
“With the use of the Windows 10 operating system, a large amount of telemetry data is transmitted to Microsoft. This content hasn’t been clarified despite repeated inquiries, and such content is also transmitted when using Office 365,” the watchdog says.
Similar solutions from Google and Apple could also pose similar risks of data being accessible by other governments, officials explain calling for more transparency from these tech giants.
Microsoft says it’s working with Hesse authorities on resolving these concerns, albeit for the time being, it’s not yet clear if the company is willing to restore its German server to store customer data locally.
Microsoft has also provided us with the following statement on this:
"We routinely work to address customer concerns by clarifying our policies and data protection practices, and we look forward to working with the Hessian Commissioner to better understand their concerns. When Office 365 is connected to a work or school account, administrators have a range of options to limit features that are enabled by sending data to Microsoft.
We recently announced (here and here), based on customer feedback, new steps towards even greater transparency and control for these organizations when it comes to sharing this data. In our service terms we document the steps we take to protect customer data, and we’ve even successfully sued the U.S. government over access to customer data in Europe. In short, we’re thankful the Commissioner raised these concerns and we look forward to engaging further with the Commissioner on its questions and concerns related to Microsoft’s offerings.”
The article incorrectly stated that Microsoft shut down its German data center in 2018, when in fact it only ended its partnership with Deutsche Telekom. The story was updated with the correct information and with the official statement provided by Microsoft.