Data Protection and Digital Sovereignty in Schools

Quick Facts about the German Education System

• Sovereignity of eduation lies within each of the 16 federal states. Influence by the national level is strictly limited. 
• Schools are jointly run by municipal entities (responsible for "hardware" like buildings but also IT infrastructure) and the education administration (responsible for content and teachers)
• School principals are responsible data processing   

Unsere digitale Schule (Our Digital School)

An alliance of more than 20 organizations that promotes data privacy and digital sovereignty in schools, representing over 1 million people in the German federal state of Baden-Württemberg:

https://unsere-digitale.schule/

Main targets

• fully implement data protection in schools
• digital sovereignty
• leverage and strengthen existing solutions
• independent consumer education in media and IT

Activities

• first statement January 2021: https://unsere-digitale.schule/stellungnahme/stellungnahme-januar-2021/
• second statement April 2021: https://unsere-digitale.schule/stellungnahme/stellungnahme-april-2021/
• thesis paper on IT infrastructure for schools October 2021: https://unsere-digitale.schule/
• petition in the state parliament: https://unsere-digitale.schule/petition/
• various request for offiical documents on the platform for freedom of information (https://meinedaten-meinerechte.de/aktuelles/anfragen/)
• public presentations on the issue:
  • 2020: Geplante Einführung MS365 an Schulen in BaWü https://media.ccc.de/v/cccs-rc3-ms365bw
  • 2022: Wie viele Ellas braucht es für eine funktionierende Bildungsplattform? https://media.ccc.de/v/gpn20-88-wie-viele-ellas-braucht-es-fr-eine-funktionierende-bildungsplattform- 
  • 2022: How Microsoft 365 was banned in schools in the Land Baden-Württemberg, Germany  https://youtu.be/SUmyemNb4pY?t=14071

Timeline of events

2020

• March: Big chaos in schools with the first lockdown. Most schools did not have any infrastructure except for email to teach children remotely. A lot of schools starts to use the solutions provided by the Ministry of Sciences based on Open Source components (see infrastructure graphic below). After initial performance problems due to the high numbers of users these solutions were pretty much stable after the first weeks. Other schools started to use services like Zoom, Microsoft or Google at this time. There were no offiicial guidelines for schools which services the can/should use. 
• July: Ministry of Education announces that they plan to implement Microsoft 365 as a solution for all schools in Baden-Württemberg. Many organisations start protesting against these plans due to concerns regarding data protection and digital sovereignty. With the rising protests the Ministry of Education announces to include the Federal Data Protection Officer in the project to ensure compliance with the GDPR. In the same month the Schrems II decision is published which confirms the concerns as the legal basis for data transmissions outside the EU is no longer valid. 
• November: The next lockdown is ahead, and calls for an official digital solution for schools are on the rise again. Political attention at this time is primarily focused on the election campaign. Education Minister Eisenmann from the conservative party is running for prime minister. Our Digital School begins to meet regularly on a weekly basis to work on a joint statement.  

2021

• January: Our digital school published the first statement with a solid reception in the local press (for a list of articles see: https://unsere-digitale.schule/aktuelles/). Politics is still focused on the election in March.
• March: The conservative party in Baden-Württemberg loses votes and has to hand over the Ministry of Education to the Greens. The coalition agreement contains various commitments on data protection and digital sovereignty in schools (https://www.baden-wuerttemberg.de/fileadmin/redaktion/dateien/PDF/210506_Koalitionsvertrag_2021-2026.pdf).
• April: Ministry of Science informs schools that they will no longer be provided with digital services, such as Internet access, hardware, hosting (https://ask.linuxmuster.net/t/good-bye-belwue/7450) 
• Mai: Federal State Commissioner for Data Protection publishes statement: MS365 cannot be used in schools in Baden-Württemberg, risks for anybody involved in schools is too high: https://www.baden-wuerttemberg.datenschutz.de/lfdi-raet-aufgrund-hoher-datenschutzrechtlicher-risiken-von-der-nutzung-der-geprueften-version-von-microsoft-office-365-an-schulen-ab/
• July: Minstry of Education announces that plans for implementing MS365 are officially stopped: https://km-bw.de/,Lde/startseite/service/2021-07-22+Vorerst+keine+pauschale+Untersagung+von+Microsoft-Produkten
• December: Ministry of Education announces that the commercial solution itsLearning will be available for all schools in Banden-Württemberg as an education plattform (https://www.baden-wuerttemberg.de/de/service/presse/pressemitteilung/pid/lernmanagementsystem-itslearning-fuer-weitere-schulen-verfuegbar/). The High School Teachers Association opposes the use of this solution because not all data protection issues have been clarified (https://www.pressreader.com/germany/graenzbote/20211123/281496459546571).

2022

• January: As there are still no plans published how the Ministry of Education is going to implement an education platform, Our Digital School publishes a thesis paper on IT infrastructure for schools, trying to create awareness for the topic. We also try to get answers on the concrete plans via a parliament petition which remained unanswered until today. 
• April: Federal State Commissioner for Data Protection announces that his authority will investigate any compaint that will be filed in by people affected by abuse of data protection in schools due to the use of Microsoft 365 beginning in September 2022 (https://www.baden-wuerttemberg.datenschutz.de/nutzung-von-ms-365-an-schulen/).

Proposed Infrastructure

Since we already had a solid digital infrastructure for schools in Baden-Württemberg, one of our core demands was to maintain and expand these solutions instead of creating new ones from scratch. Yellow components were already available for schools, only grey ones were lacking:

In spring 2021 the Ministry of Education announced that even the yellow services will soon no longer be available for schools. The ministry offered schools the commercial learning plattform itslearning instead, without taking care of all the other services. So schools had to look for new Internet Service Providers and alternative solutions on their own. 

Resources for Technical Aspects of Education Plattforms  

• Network for German schools helping each other with technical questions: https://digitalcourage.de/netzwerk-freie-schulsoftware
• List of Open Source Solutions for schools: https://digitalcourage.de/blog/2020/freie-software-fuer-schulen
• Examples: IT infrastructure of a German High School: https://meinedaten-meinerechte.de/echte-alternativen/it-selbstgemacht/ and of an elementary school https://meinedaten-meinerechte.de/echte-alternativen/schul-it-an-einer-grundschule/

Samples of Open Source Solutions for Schools

• AlekSIS: is an integrated information system for school organisation (identity management, timetables,...) https://aleksis.org/
• Debian Edu (Skolelinux): Debian based operating system for schools (network setup,  integration of a large number of educational software) https://blends.debian.org/
• DiLer: learning managment system, also offering solutions for classes with special needs https://www.digitale-lernumgebung.de/
• Herrmannpost: a Matrix based chat client https://hermannschule.de/hermannpost.html
• Linuxmuster: a solution for operating school IT infrastructure, developed by teachers and service providers https://www.linuxmuster.net/ 
• Moodle: learning management system https://moodle.org/

Meine Daten meine Rechte (My Data My Rights)

Page set up to inform families and teachers about data protection in schools.

https://meinedaten-meinerechte.de/ 

On the website you find:

• list of all news articles on the topic since 2018 https://meinedaten-meinerechte.de/aktuelles/
• list of all requests via the information freedom platform on education platform topics: https://meinedaten-meinerechte.de/aktuelles/anfragen/
• basic information on the topic for families: https://meinedaten-meinerechte.de/information/
• basic information on data protection: https://meinedaten-meinerechte.de/mehr-erfahren/
• IT basics for families and teachers: https://meinedaten-meinerechte.de/echte-alternativen/

We also started to work on a portal to help schools and teachers to understand and manage data protection but this is still work in progress: https://daten-schuetzen.schule/

EU Network of Organizations

Organizations we are in contact with in other EU countries to raise awareness for the topic:

• Austria: Epicenter.works 
• Belgium: https://wiki.educode.be/doku.php/en/cours-libres/accueil
• Netherlands: https://eerlijkdigitaalonderwijs.petities.nl/?locale=en 
• Spain: xnet (who organized the first congress on this topic: 1st International Congress on Democratic Digital Education and Open EdTech)