Office 365 declared illegal in German schools in the State of Hessen

They declare Microsoft Office 365 illegal in the schools of the State of Hessen.  The measure was taken by the highest state authority on data protection. On your opinion it is established that using standard settings of the popular cloud platform exposes the personal information of students and teachers "to possible access by US officials."

The decision is due to the fact that Microsoft's cloud office solution stores student and teacher data in your European cloud

Why is Office 365 illegal?

The discussion about whether the use of Microsoft Office 365 complies with German and European privacy legislation has been going on for some time.  It is a very popular tool in German schools. In principle, the opinion of the regulator of the State of Hesse had been favorable to Microsoft. The use of the office solution was compatible with data protection legislation. But with one condition, "As long as the schools use the tools provided by Microsoft correctly" (for example, the configuration of roles, authorizations, and registration).

What changed is that when the resolution was issued, Microsoft was hosting the data in a cloud located in Germany. However you now have a cloud solution for all of Europe.

The problem does not go through the storage of data in the cloud. Many schools in Hessen are already using cloud solutions. Be it, for example, the learning platform or the electronic class record: schools can use digital applications that comply with data protection regulations, provided that the security of data processing and student participation are guaranteed .

The heart of the matter is whether German schools have the right as a public institution to store personal data (of children) in a (European) cloud which, for example, is exposed to possible access by the US authorities. (I wonder if they have a problem with the German authorities accessing that data without a warrant)
According to German law, public institutions in Germany have a special responsibility with regard to the permissibility and traceability of the processing of personal data. The digital sovereignty of the State's data processing must also be guaranteed. In fall 2018, the Federal Office for Information Security brought another issue to the public's attention. Using the Windows 10 operating system transmits a large amount of telemetry data to Microsoft, the content of which has not been conclusively clarified despite repeated inquiries to Microsoft. This data is also transmitted when you use Office 365. Some time ago I wrote in Linux Adictos what data is transmitted when we use MIcrosoft Office 365.

What happens if the user consents?

Most users do not read the license and click OK. Others, as in my case, understand that giving up privacy in part is a price to pay for having access to certain benefits. I wrote this article in Microsoft Office 365 Word online. Of course, if I had to write something that I don't want the CIA (or Microsoft) to know, I would use LibreOffice. Anyway, in the case of Office 365 in the cloud, consent does not offer a solution because the security and traceability of data processing processes cannot be guaranteed.

What about the competition?

According to the regulatory body:

What applies to Microsoft also applies to Google and Apple cloud solutions. The cloud solutions from these providers have also not been presented in a transparent and understandable way. For this reason, it is also true here that use in accordance with data protection is currently not feasible for schools.

Anyway, they do not close the doors to Microsoft

As soon as the possible third party access to data stored in the cloud and the telemetry data issue have been resolved in an understandable and data protection compliant way, Office 365 can be used as a cloud solution by schools . Until then, however, schools can use other instruments such as local licenses in local systems.

0, I add, they can use LibreOffice on Owncloud / Nextcloud.