Colleagues confer on teams, girlfriends meet at Jitsi, people flirt on Zoom. In the past nine months, a large part of professional and social life has shifted to video conferencing – with one exception: Since spring, data protection officers and large corporations like Microsoft have been arguing whether schools should be allowed to use their software. Lawyers warn, parents plead, teachers want pragmatism, and schools resort to unconventional solutions – with risks and side effects.
The IT lawyer Chan-jo Jun believes that data protection does not stand in the way of distance learning. Homeschooling does not fail because of the General Data Protection Regulation (GDPR), but because of “wandering data protectionists,” he said recently in a YouTube video. On the European Data Protection Day the question arises: what exactly does he mean by that?
SZ: Digital learning often means that teachers send out work assignments by email. You also hold data protection officers responsible for this. Can you explain that?
Chan-jo Jun: Of course, the failure has several causes. But where privacy is listed as an obstacle to live communication, it is based on an error at best, or a lazy deception at worst. Data protection law does set conditions, but these can be fulfilled both with open-source conference software such as Big Blue Button and with Microsoft Teams. School principals confuse the whimsy of privacy advocates, who would prefer to shut Google, Microsoft and the US off the internet, with the much lower requirements of the GDPR. Some principals have become data protection fundamentalists but have no viable alternative. It’s like trying to give up meat without growing plants.
This series of interviews is devoted to current topics and appears Monday through Friday by 7:30 a.m. at the latest on SZ.de. All interviews here.
Schools and teachers avoid US providers such as Zoom or Microsoft because they believe that the GDPR prohibits their use. Is that correct?
No, otherwise I wouldn’t be allowed to write this email with Outlook either. The requirements are only slightly higher, as the ECJ last year declared the Privacy Shield as the most important basis for US data transfer to be inadmissible. Schools can still use US services, but must take technical and organizational precautions. For example, pseudonymize and encrypt student data, choose European servers, delete completed homework at short notice and educate users. These are standard measures
Zoom now encrypts content end-to-end. But security is only one aspect. What about metadata that ends up with a US provider?
In the case of video conferences, personal metadata can be avoided by using pseudonyms and eliminating accounts. It becomes more difficult when you want to use functions on platforms such as teams that require log-in and then voluntary consent.
Many schools are not just desperately looking for a stable, simple and privacy-friendly solution for video conferencing. They also need chat and office software and often end up at Microsoft. What do you think about teaching using Teams and Microsoft 365?
I can understand the concerns of privacy advocates who distrust Microsoft and American intelligence. But this is not a legal prohibition, but a question of taste or conscience. Where consent is required, an alternative would have to exist in the event of refusal, such as e-mail. At the schools in Würzburg I know, students and parents have given the necessary consent.
In a guest post at Network policy A high school student from Hessen does not demand less, but more data protection. He doesn’t want to have to use Microsoft products to be taught. Can students be asked to use software that they reject?
A student can refuse data processing where voluntary consent is required for data processing. However, consent is often not necessary at all. Some countries have created a legal basis for pandemic distance learning where consent is not required.
Why is Germany doing so badly in an international comparison when it comes to digital education?
We have a greater cultural distance from data processing. The legal basis in data protection is not an obstacle, as it is harmonized across Europe. In the summer, teachers needed a lot of persuasion to stand in front of a camera. Some of them feared being watched. Committed school principals were able to overcome this resentment, so we are now catching up.
The schools will remain closed at least until mid-February. What has to happen in order to be able to offer as much digital lessons as possible as quickly as possible?
We have to prepare today for the hybrid lessons, which are sure to come as an interim solution. But then the next major failure becomes immediately apparent. Classrooms now need online connections, if necessary via LTE routers and hardware for the classroom. In Würzburg, we organized this through parents in autumn, when there were constant new quarantines. But after Mardi Gras, no school authorities can talk their way out of having been surprised by the pandemic and unable to prepare.