22

From what I heard, in German universities there is a push against foreign cloud applications such as Microsoft Office 365, Google G Suite, Github, and even Doodle. The DFN offers some alternatives, encouraging (or forcing?) university staff to switch to them.

Could someone inside the German system describe the state of things in more detail? Are there web applications that one should steer clear from when working in a German university? Are those just recommendations? What platforms are affected? What are the alternatives suggested? Are they all self-hosted open source applications?

I tried googling, but I found little information about it around.

7
  • 5
    Sciebo might interest you. – Wrzlprmft Jan 1 at 11:20
  • 2
    Interesting, my German university subscribes to and encourages the use of Office 365. – GoodDeeds Jan 1 at 12:46
  • 1
    Thanks @GoodDeeds ; I'd welcome an answer about your experience, even if it does not confirm my understanding. – Federico Poloni Jan 1 at 13:14
  • 2
    As an example, I believe that e.g. most universities and research institutes will forbid to use gmail or other non-EU based webmail services for emails for employees/professors, who might receive confidential email. Not sure whether this falls in the category you think of. – user151413 Jan 1 at 23:12
  • 2
    @GoodDeeds There might be a difference whether they offer it/subscribe to it, or whether you are forced (maybe even unknowingly) to hand your data over to them. – user151413 Jan 2 at 0:00
10

A bit more background:

Teaching

There is a parallel discussion happening about schools and their teaching tools during lockdown/school closures. (Both schools and universities in Germany are owned by the Länder.)

One example that made it into the media quite prominently was a school in Berlin that got an official "Warning" by the Datenschutzbeauftragte (privacy protection office) who explained that they received a complaint and had no choice although they'd have liked to actually help the school to arrive at a working and privacy protection law compliant solution. The same would happen to any university if a student complains and the privacy protection office then finds that the "legal homework" was not done on the side of the university. Which is of course a possibility that scares administration.

There are lists available (the ones I've seen are all in German, though) with cloud services where the data protection offices wrote down their take on whether the particular service is compliant with German law (and in turn EU GDPR), can be made compliant (by adequate service contracts) or whether and which fundamental concerns they have. Maybe not too astonishing, the cloud service providers who most easily meet the German legal requirements tend to be Germany-based - I don't think it can be a surprise that companies tend to know the legislation in their home market very well.

The other legally easy option is for the universities to run these services themselves, this saves them from needing to put in place appropriate contractual agreements for 3rd party data with the service provider. And since universities have computation centers that are anyways in place to run IT services as infrastructure for the university and they are organized in the DFN which has R&D projects on such infrastructure, this is an obvious way for them to go.

In general, German legislation is very picky about abuse of power, and this reaches out here where students cannot refuse to use certain services the university (or school) prescribes. Universities are run as a public service, and they are held to the standards any governmental office must meet. "Agree to this tool's service terms or leave university" is not regarded as a fair choice.

All this applies mostly to teaching.


Research

In research, one may presume more liberty in a group of collaborators agreeing on which service they use. Which I think in turn allows more leeway in the choice of tools and services. Of course, your collaborators may prefer to not need yet another tool or service an addition to what is prescribed (or approved) by their university for their teaching duties.

A separate topic is the research institute's policy about their own data. I don't know whether German institutes tend to be more protective than others (and my experience could at best be anecdata anyway), but I've met increasing concerns about this, including restrictive policies which I'd have expected in industrial R&D rather than in public research.

  • The increase in concern may be spurious in the sense that the underlying concerns about when to share with whom may have been constant all the time and just haven't been relevant (and therefore not expressed) before sharing became so easy with free public cloud services.

  • On the other hand, IP protection and patents, licensing and generating spin-off companies have become more important for academia and public research also in Germany, so increasing concerns about uncontrolled sharing may reflect this development.

  • Germany has very hierarchical structures in academia, so these policies may be very much a matter of the personal opinion of the respective professor or institute director (whose power does include a whole lot of decisions to not share).

  • ... and due to the complex legal situation, said professor or director may have decided that the most economic way of dealing with all this is to err on the safe side and be very restrictive for everything but what is offered by their university IT services - which is implicitly safe because the blame would go to the university rather than to them.


What recommendations are out there

  • The official recommendation to use a privacy friendly meeting organization tool (such as the DFN one or the TU Dresden one) rather than doodle has been around for many (IIRC 10+) years.

  • Also orders to not to use Skype, Dropbox, Google Drive, whatnot have been a regular part of the data protection lectures/readings I've been required to attended at various German research institutions for many years (mostly not universities, but public research institutes).

  • Many universities have lists with more or less general/detailed recommendations out by now, the BSI (federal office for information security) as usual has general guidelines.

    However, almost all the documents I've seen in this context are in German.

    As an example, the university Duisburg-Essen (random find on the Internet, I have nothing to do with them) has an internal document with a table listing some popular but critical services and alternatives

  • GDPR/German data protection law compliant solutions exist, and sometimes the solution could also be saying "those who (and whose institution) are OK with using Doodle, go ahead. Everyone else, please email me your preferences"

6
  • 2
    Thanks! This is very detailed and useful, and answers all my questions. – Federico Poloni Jan 2 at 15:57
  • @FedericoPoloni: you're welcome! :-) – cbeleites unhappy with SX Jan 2 at 16:00
  • 3
    Relying on "free" services like google docs for regular school work is imo indeed problematic. The government should provide IT, as it provides rooms, chalk boards and teachers. Why not then a Nike-sponsored gym, Amazon-sponsored schoolbooks and a Bayer-sponsored chemistry lab? No. Public schools are a public enterprise, funded by taxes and run by public employees. We don't want to immerse children from school day 1 into a corporate ecosystem. Privacy concerns are only a facet of a much more general blurring of public and private services. – Peter - Reinstate Monica Jan 3 at 10:11
  • 1
    @Peter-ReinstateMonica: Fully agree, IMHO this needs a more thorough (political) discussion, and gets off topic here. (My personal preference would be rather than a flat ban on sponsorship to think why and what exactly we'd like to avoid, and then tackle those points. I'm saying this also due to a recent discussion about prescribing/*buying* (no sponsorship) class sets of tablets of an expensive brand for school. There were good technical arguments in favor, but IMHO the "soft vendor lock in" aspect of the kids getting used to a particular brand vs. neutrality needs more thorough consideration – cbeleites unhappy with SX Jan 3 at 12:23
  • I'm not sure why you call this "sponsorship". I believe schools and universities pay Google, Microsoft and Zoom big money. – Federico Poloni Jan 3 at 14:53
17

It not surprising that there is little good information on this issue available.

As has already been written, this is all about the European data protection directive GDPR ("DSGVO" in German). It contains a number of measures that should enable users to protect their personal data.

The law defines some guidelines that include the right of users to only have their necessary data processed. As a relatively trivial example, it would be problematic to require students to submit their date of birth with their exercise sheet solutions. The law also defines minimum requirements for offloading data processing tasks to subcontractors and the right of all users whose data is being processed to demand to know what data of them is stored. Also, data needs to be protected according to the state of the art. In case of violations, fines can be issued by federal(?) authorities.

Now while these rules seem useful, they are highly problematic when requiring students to use certain services: There is normally no contract between the university and doodle.com about data protection in place, so asking the students to use doodle.com is probably problematic....but I'm not aware of any court ruling on this. Then, the Safe Harbor agreement between the EU and the US is not currently seen as sufficient to guarantee that the European rules are met. Oh, and is data protected according to the state of the art? That's pretty hard to tell.

All in all, the situation is complex enough such that universities try to insource as much as possible, at least to DFN level (German research network - essentially the network service provider of the universities). However, when other options proved to be infeasible, some universities decided to use Zoom and the like anyway, which bears a certain risk. The Microsoft Cloud may be unproblematic, depending on what level of data protection Microsoft guarantees.

In a less-than-100% legally clear situation when there is a lot at stake (Corona led to a need for teleconferencing/lectures), some may decide to take some risks when the alternatives do not seem to work. And this leads to a very fragmented landscape.

2
  • 3
    +1 because I generally agree with what you say. However, to my understanding it is not entirely correct to say that it is all about data protection in Europe. The concept of data sovereignty goes both ways, doesn't it? So it might also be problematic to store certain data on a server in a certain country because it is illegal to have such data there. Especially difficult if you have no idea where the data is stored/handled and which jurisdictions are relevant. – Snijderfrey Jan 1 at 22:18
  • 7
    The 99% of users who don't speak German wouldn't understand that "DSGVO" is just the German acronym for GDPR. Also it's misleading to say "the data protection directive, which was started as a European initiative". There are tons of data protection directives in various countries, GDPR isn't the only one, and it wasn't the first; but it is the most comprehensive. As for EU-US Safe Harbor agreement, the legislation was struck down and is being replaced with Privacy Shield 2, but I can't find link to the differences. – smci Jan 2 at 2:36
12

I am not aware of any official guideline to avoid using foreign cloud applications at German universities. However, I only know what is correct for my university. The federal system in Germany makes it unlikely that any such general guideline will exist.

What is true however is that most universities offer a lot of locally maintained services as alternatives to external solutions. There may be a file hosting system, a git server etc. in fact making the external stuff obsolete. But you are still allowed to use them most of the time. At my university, the service description often reads like: "...is meant as an alternative to XYZ" (with XYZ as some external cloud service), but the use of other services is explicitly not excluded. However, university staff automatically has access to the local tools and they can usually be used when cooperating with external people, so I see a widespread use of the local tools.

The external services often are of foreign origin. And yes, this is not totally irrelevant. "Data sovereignty" is the term used at my university. Local support is another aspect quite helpful when problems arise.

9

It's mostly about DSGVO (the Datenschutz-Grundverordnung). I don't know too much about it, but, if I understood correctly, it forbids that university staff stores data which affects their students on any service that is not under control of the university. As a consequence, many universities host their own services or buy services with special conditions such that they are "DSGVO konform". My university, for example, hosts a cloud storage and groupware and we are encouraged to use DFN services.

9
  • 2
    Though I understand that DSGVO is a realization of EU law, so the comparable rules should exist in other EU countries? – user151413 Jan 1 at 23:59
  • 1
    @user151413: yes. The conclusion is that at least research collaborations should in first approximation be fine with using the services officially provided by any of the collaborating universities. Anything related to teaching may be more sensitive, though. And, as DCTlib points out, some universities/institutes have now with the urgent Corona-needs chosen to use also services that are known to not be compliant due to performance issues with the compliant alternatives they tried. Zoom is probably the most prominent example: I've been in a video meetings where one participant said "sorry, my... – cbeleites unhappy with SX Jan 2 at 16:12
  • 2
    ... institution [a research institute attached to a federal ministry] does not allow me to participate in zoom meetings - but I can offer you our on-premises jitsi-server." We did move over to the jitsi server and all was well. In the end, there may also be different takes on the necessary trade-offs and risks of being compliant vs. being able to work. – cbeleites unhappy with SX Jan 2 at 16:14
  • 2
    @cbeleitesunhappywithSX "there may also be different takes on the necessary trade-offs and risks of being compliant vs. being able to work": Indeed, I guess that's one main point: The university will not be able to officially endorse products which go against the data protection laws, but probably most of them will tolerate using them, just as free email services. (Then, on the other hand, some universities do have zoom licences.) – user151413 Jan 2 at 17:15
  • 1
    @O.R.Mapper I know of German universities which have a university-wide zoom licence for everyone. From which I conclude that at least those places don't recommend against using zoom (though I'd have to double-check). – user151413 Jan 3 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.