The debate around Microsoft 365 in schools should not be read only as an isolated German case. It is a warning for any school using cloud platforms with data relating to minors, teachers and families.
In this article we will discuss...
What happened in Germany
German data protection authorities questioned the use of Microsoft 365 in certain educational contexts due to concerns about transparency, international transfers, configuration and control of processing. The practical lesson is not to ban every tool, but to assess whether the school can comply with the GDPR using the available contract and configuration.
What schools should review
The Spanish Data Protection Authority provides a guide for schools and, together with other authorities, published a decalogue for contracting digital education platforms. These criteria are especially useful for cloud services.
- What data the platform processes and for what purpose.
- Who acts as controller and who acts as processor.
- Where data is hosted and whether international transfers occur.
- What security and access control measures exist.
- Whether contracts, subprocessors and documentation are sufficient.
Conclusion
Microsoft 365, Google Workspace and other education platforms should not be implemented by inertia. Schools and education authorities should review contracts, configuration, security, minimisation and transparency before using them.