In Baden-Württemberg, in a trial run lasting several weeks, 20 to 30 Vocational schools clarify whether Microsoft Office 365 is used in the education sector in compliance with data protection regulations can. The state data protection officer Stefan Brink cleared the way for this on Friday and declared that he would like to take part in this voluntary pilot project of the Ministry of Culture in an advisory capacity. A “specially configured version for schools” of the US software company’s office package should be used.

Don’t miss any news! With our daily newsletter you will receive all the news from heise online from the past 24 hours every morning.

Data protection improved According to the ministry, the test for the planned educational platform in Ländle should include the open source solution Moodle with the video conference system Big Blue Button, the messenger service Threema for teachers and another learning management system, as well as cloud-based Microsoft Products include. In addition to a business e-mail address for teachers, this involves “classic office tools such as Word, PowerPoint, Excel”, a data storage device and teams as an additional video conference and collaboration system.

For Microsoft Components, the department worked with external partners on a data protection impact assessment (DPIA). The state data protection officer rejected the first version “because it had considerable deficits in data protection law, which did not appear acceptable in such a weighty and sensitive project”. In mid-October, the ministry presented a second, “considerably revised” DPIA. Although this still does not answer all data protection questions, it represents “a sufficient basis for the now upcoming pilot”.

Better staffing necessary “This remains, however – especially when using US service providers – Considerable imponderables, “warns Brink: With a view to the so-called Schrems II ruling of the European Court of Justice, it is currently unclear how future data transfers from the EU to the USA will be legally possible at all. This question must ultimately be decided at European level.

This is also an important reason for the inspector “why schools should always look at available and reliably usable alternatives for the software solutions used”. In addition to the open source offerings already included in the package, he refers to the video conference software Jitsi, the cloud service Nextcloud and the office software OnlyOffice. In order to be able to use these permanently, the ministry would have to significantly increase “the already completely inadequate staffing of the schools with data protection officers”. The state university network BelWü has also been offering specific e-mail addresses for educational institutions for a long time.

A somewhat “data-efficient” software version At the same time, the data protection activist reports successes in his talks with Microsoft. The ministry’s offer will be based on special “data-saving” software versions that restrict the outflow of telemetry data to the provider and the option to create user profiles. The company has pledged to improve encryption and “reduce its own processing purposes”.

According to Brink, Microsoft has also promised “a considerable strengthening of user rights in relation to access by US security authorities”, for which about “legal protection guarantees and compensation obligations” are provided. All information and measured values ​​are processed “exclusively in Germany”. In addition, the group will provide teachers with instructions on how to use the programs in a data-saving manner.

“School does not serve the provider” As part of the test, the head of the supervisory authority now wants to check “whether the promised deactivation of problematic processing has actually taken place” and Microsoft keeps the remaining promises. Otherwise real operation of the package is out of the question. Brink emphasized: “We want the software used to serve the school, and not the school for the provider when creating profiles or product offers.” All concerned should know “what data is created, where it is collected and how it is used”.

Previously, parent and teacher associations, the Alliance for Humane Education and the Chaos Computer Club had raged against this The Ministry of Culture’s plan to include Microsoft products in the educational platform. They referred, for example, to the end of the transatlantic Privacy Shield and the decision of the data protection conference of the federal and state governments, according to which the US provider was not yet able to fully meet the requirements of the General Data Protection Regulation (GDPR), at least in the first quarter.

The Baden-Württemberg Minister of Education, Susanne Eisenmann, recently received a Big Brother Award for her approach. In view of the temporary compromise, the CDU politician spoke of a “good signal for the schools and school authorities in the country”. The “extensive examination of all data protection issues” was worth it.

(tiw)