Microsoft cloud banned from Hessian (Germany) schools due to data protection concerns

Photo by Element5 Digital on Unsplash


On July 9, 2019, the Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), the Hessian Commissioner for Data Protection and Freedom of Information, banned the use of Office 365 from Hessian schools because its cloud solution is not compliant with EU individuals’ data protection rights.

The HBDI’s concern is whether schools – acting as a public institution – can store children personal data in a European cloud exposed, for example, to access by US authorities.

Despite repeated inquiries to Microsoft, the HDBI was not fully satisfied how data is processed, stored and accessed when a school uses Office 365 or Windows 10 operating system.

The HBDI assured that as soon as the access of third parties to the data in the cloud, as well as the processing of biometric data is compliant with the EU data protection regulation, schools will be authorized to use Office 365 as a cloud solution.

The HBDI informed that the concern is applicable Google and Apple cloud solutions as well.



The statement by the Hessian Commissioner for Data Protection and Freedom of Information on the Use of Microsoft Office 365 in Hessian Schools is available (in German) at…



For more information on how your company could transfer data internationally in compliance with EU privacy rules: Francesca Giannoni-Crystal and Federica Romanelli