German schools ban cloud suppliers - not compliant with EU GDPR

[TwistedHelixis]

So what do you all make of this - https://thenextweb.com/privacy/2019/07/15/german-schools-ban-microsoft-office-365-amid-privacy-concerns/

[localzuk]

Not sure why they are talking about consent - as consent is only 1 of the legal bases for processing of data. Also, Office 365 is covered by the new privacy shield, which has yet to be struck down... So, not really sure about this at all!

[tmoon-mint]

Not sure why they are talking about consent - as consent is only 1 of the legal bases for processing of data. Also, Office 365 is covered by the new privacy shield, which has yet to be struck down... So, not really sure about this at all!

 

Correct me if im wrong but would you not give your consent by accepting Microsoft's EULA?

[jthompson]

Not familiar enough with the telemetry aspect, but that seems to be the crux of the matter. They mention that the "standard configuration" poses a problem. Could it be that it's just a matter of schools having to configure things correctly in order to be compliant, but that they want MS to instead do that work for them (i.e. have the telemetry bits off by default)?

[Arthur]

www.zdnet.com/article/microsoft-office-365-banned-in-german-schools-over-privacy-fears

 

School pupils are usually not able to give consent, he points out. "And if data is sent to Microsoft in the US, it is subject to US mass-surveillance laws. This is illegal under EU law."

[GrumbleDook]

This is going to be an interesting one ... There has long been an arguement that there should be a standard set of things a school turns off ...

 

I've yet to see that though, and yet to see whether it is an issue with what is left.

 

The other side of things is whether the school is instructing MS in activities to improve its service ...

[Ditto]

www.zdnet.com/article/microsoft-office-365-banned-in-german-schools-over-privacy-fears

Would cloud based Gmail be equally unacceptable to the schools I wonder?

[steve_forbes]

Would cloud based Gmail be equally unacceptable to the schools I wonder?

Yup, they've openly said that both G Suite and Apple have the same issues. Therefore leaving schools with little choice on OS or cloud suites!

[DrCheese]

the Hesse commissioner has suggested schools to switch to similar applications with on-premise licenses on local systems.

 

and I'm sure the German government will totally be happy to fund the server upgrades that will now be required to go back to this model......

[localzuk]

This is going to be an interesting one ... There has long been an arguement that there should be a standard set of things a school turns off ...

I've yet to see that though, and yet to see whether it is an issue with what is left.

The other side of things is whether the school is instructing MS in activities to improve its service ...

I'm confused then. What's the point of Privacy Shield? I thought the whole point of it was that you could treat companies signed up to it as being deemed compliant with EU data protection rules for the purpose of handling data (obviously you'd then have to look at individual actions/behaviours on top but I'm talking in general).

 

Telemetry can be turned off, so a blanket determination seems rather OTT also? Surely a determination "schools should be looking at and disabling telemetry where necessary" would be more appropriate?

 

Office telemetry reg keys - https://docs.microsoft.com/en-us/deployoffice/compat/manage-the-privacy-of-data-monitored-by-telemetry-in-office

Windows 10 telemetry - https://github.com/adolfintel/Windows10-Privacy

 

Yup, they've openly said that both G Suite and Apple have the same issues. Therefore leaving schools with little choice on OS or cloud suites!

Fundamentally, the ruling seems to be against US companies, rather than platforms. G Suite in the EU hosts its data in the EU, so ultimately the issue would come back to the company being owned by a US company. If this is the line the Germans are taking with US companies, I'm not sure how any US company can provide services to the EU at all and be compliant.

Edited July 16, 2019 by localzuk

[jthompson]

Can you turn off telemetry, though? I thought that Ent and Edu variants of Windows allow you to limit it to security items only, but there's still some telemetry active. One of the issues in the German case is the lack of transparency about what the telemetry contains.

[enjay]

Seems like some scaremongering / misinformation / misunderstanding here too. They've stopped using Office365 because they don't like the telemetry in Windows 10, for example. Plus, as @localzuk pointed out, consent isn't relevant to a school's use of Office365 anyway.

[enjay]

G Suite in the EU hosts its data in the EU

 

Are you sure on that? I thought Google said they couldn't guarantee EU-localised storage, unlike Microsoft.

 

so ultimately the issue would come back to the company being owned by a US company. If this is the line the Germans are taking with US companies, I'm not sure how any US company can provide services to the EU at all and be compliant.[/font]

 

I think Germany's issue with Microsoft is not that they're US-based but that the US Government could still access data held on EU-based datacentres.

[TwistedHelixis]

These companies need to segregate Education data and say they will never access educational data unless the school consents.

[mthomas08]

Interesting

"The heart of the issue concerns the telemetry information sent by Windows 10 operating system and the company’s cloud solution back to the US."

 

"This information can include anything from regular software diagnostic data to user content from Office applications, such as email subject lines and sentences from documents where the company’s translation or spellchecker tools were used."

 

Collecting such info is violating GDPR. M$ can't disable this function and students/staff generally don't have access to anything on "agreeing" to the terms etc. M$ hasn't been forthcoming? course not?

 

Is this another Facebook issue? Or is there no storm on this because M$ generally doesn't get involved in politics like a lot of other people seem to?

 

The work around is the school asking for consent but understand that technically kids can't consent to this? Can't the school type up a simple copy or even provide the terms in an online document for parents/students to read?

 

"This resulted in a migration of school accounts to a European data center, where they could be accessed by US officials upon request." I can completely understand this gripe.

 

At the end of the day we need to provide this system, replacing it isn't quick nor easy... and who says the rival products don't do the same thing? All seems a bit ... fussy to me..

[localzuk]

The thing is, if a company is wholly owned by a US company, we have the issue of US govt access to their assets. So, this affects basically all the big tech companies that the world now runs on. Its such a large issue that it is something that governments need to be discussing, not schools.

 

Hell, just using Windows 10 seems to breach GDPR if this ruling is true. Or just using Office at all, not Office 365.

 

So what are schools supposed to do? Switch to Linux?

[enjay]

Hell, just using Windows 10 seems to breach GDPR if this ruling is true. Or just using Office at all, not Office 365.

 

Isn't all the stuff which Windows sends back anonymised anyway, so not relevant to GDPR?

[dmj]

Isn't all the stuff which Windows sends back anonymised anyway, so not relevant to GDPR?

 

I think the issue is that Microsoft wouldn't divulge what the data contains: " wealth of telemetry data is transmitted to Microsoft, whose content has not been finally clarified despite repeated inquiries at Microsoft"

[GrumbleDook]

There are 3 issues that are within this ruling and why it has come up. Forget where it goes … that is only a small part of it.

 

1 - the issue within the telemetry data is collected based on what the company decides is needed, not the customer.

2 - if any of that data pertains to personal data (subject lines on emails, usernames, etc.) then the company is the data controller (*they* have made the decision) and so have a direct relationship with the data subject.

3 - As that is not the service delivered by the school, ISS rules come in so consent is needed … which cannot be given in most cases.

 

An instruction from the institute to improve services by making use of selected data gets around this … but the institute needs to know and agree what that data will be. This is the stumbling block. The mitigation of this is ensuring that data is protected within law from anyone outside of the DP and DC accessing that data … and once it is on US servers then yes, the US Govt can seize it. There is still the challenge that the US Govt can seize when overseas as well, but the EU and EDPB constantly reviewing Privacy Shield is keeping some of that at bay … so the removal of the service in Germany has sparked off this review again … and rightly so.

 

Turning telemetry off deals with that, but I have yet to see a seriously good guide about turning it all off … and does it turn *everything* off?

 

We don't have definitive guidance in the UK, and NCSC offer guidance on dealing with cloud services … so it becomes a risk assessment in my opinion. I expect to see a number of DPIAs being done on this in the autumn term.

[localzuk]

If the UK determines the same thing as Germany, that will cause the loss of millions of pounds of IT investment overnight, rendering Chromebooks unusable, for example. Not to mention most schools and LEAs using Office 365 or Google Apps now.

 

Then what about Windows 10 - as you say, can you turn off *all* telemetry? Or in Office? If we can't, does that not eliminate our ability to use the most popular operating system and productivity suite in the world? Rendering hundreds of millions, if not billions of pounds of IT investment worthless overnight?

 

Extend it further, what about Azure? Or AWS? Any cloud hosting platform. Or any company that schools use that themselves use those platforms? You're talking rather a lot of billions of pounds and euros effectively useless across the EU.

[DrCheese]

I'll be honest I'm not going to lose much sleep over this - Ultimately pragmaticism will reign & a solution will be put in place...

[jthompson]

Turning telemetry off deals with that, but I have yet to see a seriously good guide about turning it all off … and does it turn *everything* off?.

 

This is the official word on configuring telemetry in Windows 10 - https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization. Whilst it describes the various diagnostic levels available, turning it off completely doesn't appear to be an option that they entertain.

 

It perhaps speaks to the power of telemetry data that Microsoft are determined enough to keep it flowing as to risk losing customers.

Edited July 17, 2019 by jthompson

[enjay]

It perhaps speaks to the power of telemetry data that Microsoft are determined enough to keep it flowing as to risk losing customers.

 

I really can't see a mass loss of customers because of MS telemetry data. We happily give far more to Google and Facebook, after all.

[localzuk]

I suspect the end result will be a very quick release of an EU version of Office etc... Removing the telemetry data, or at least allowing us to entirely disable it.

[enjay]

I suspect the end result will be a very quick release of an EU version of Office etc... Removing the telemetry data, or at least allowing us to entirely disable it.

 

Or MS saying the telemetry is all anonymous, even if they don't say what it contains.