What is the status of foreign cloud apps in German universities?
It not surprising that there is little good information on this issue available.
As has already been written, this is all about the European data protection directive GDPR (&quot;DSGVO&quot; in German). It contains a number of measures that should enable users to protect their personal data.
The law defines some guidelines that include the right of users to only have their necessary data processed. As a relatively trivial example, it would be problematic to require students to submit their date of birth with their exercise sheet solutions. The law also defines minimum requirements for offloading data processing tasks to subcontractors and the right of all users whose data is being processed to demand to know what data of them is stored. Also, data needs to be protected according to the state of the art. In case of violations, fines can be issued by federal(?) authorities.
Now while these rules seem useful, they are highly problematic when requiring students to use certain services: There is normally no contract between the university and doodle.com about data protection in place, so asking the students to use doodle.com is probably problematic....but I'm not aware of any court ruling on this. Then, the Safe Harbor agreement between the EU and the US is not currently seen as sufficient to guarantee that the European rules are met. Oh, and is data protected according to the state of the art? That's pretty hard to tell.
All in all, the situation is complex enough such that universities try to insource as much as possible, at least to DFN level (German research network - essentially the network service provider of the universities). However, when other options proved to be infeasible, some universities decided to use Zoom and the like anyway, which bears a certain risk. The Microsoft Cloud may be unproblematic, depending on what level of data protection Microsoft guarantees.
In a less-than-100% legally clear situation when there is a lot at stake (Corona led to a need for teleconferencing/lectures), some may decide to take some risks when the alternatives do not seem to work. And this leads to a very fragmented landscape.