During the COVID pandemic, schools around the world rapidly switched to cloud services. Microsoft immediately offered "educational" products. At the same time, responsibility for privacy compliance was shifted to schools and national authorities. The fundamental tension came to light when a student requested access to his personal data. Microsoft simply referred him to the local educational institution, which in turn could only provide minimal information because it does not have access to data held by Microsoft. The result: no one could guarantee GDPR rights.