3 ms·

She'd probably prefer this route the most, since she'd ideally not have to move (the FSF-member in me be damned). Is this really a myth? I've heard of so many l

by nanna 6y ago

She'd probably prefer this route the most, since she'd ideally not have to move (the FSF-member in me be damned). Is this really a myth? I've heard of so many local councils and other public organisations flocking to Office365 for 'reasons of GDPR'.

DanBC 6y ago
> 'reasons of GDPR' This joins a long list of bullshit reasons to do things, that often isn't based in understanding of what The Thing is actually requiring. "Computer says no", "health and safety", "more than my jobsworth", "data protection", "safeguarding", "the regulator says", etc etc etc.
- adwww 6y ago
  Urgh I'm currently battling migrating a large SASS app from GCP to Azure for these same non reasons.
number6 6y ago
Office365 is not a solution under GDPR. I am in touch with other DPOs and our federal dpos - the big elefant in the room is Microsoft and Windows 10. Everybody knows that you can't use it if you follow the GDPR or at least you have to jump so many loops that it is practical impossible. The federal DPOs advice against Teams and OneDrive so Microsoft gets the message but if the CJEU looks at Windows from a GDPR perspective Everybody had to stop using it.
- mrweasel 6y ago
  Could you clarify what the issue with Microsoft and Windows 10 is? I have no reason to doubt you, I would just genuinely like to know what to look out for.
  - number6 6y ago
    If you use Windows 10 you accept the Terms and Services [0]. This also includes the Data Processing Addendum. So there is a legal basis for Microsoft to send Data to the US. Since Microsoft falls under FISA it has to give data to the authorities with no chance to appeal for the data subject. This violates the GDPR. Ok this is the legal stuff. Here is the technical stuff [1]. In short: Windows 10 sends all kind of data including whole documents to Microsoft USA and you can't stop it using the OS but have to apply Firewall rules and DPI. So if you really want to use Microsoft you have to make a Data protection impact assessment for each new version of windows 10. I know no one who does this. But if you ask the federal dpo they will tell you that they can't say if you can use windows 10 for this or that but you should asses it yourself using a data protection impact assessment. I just hope nobody will ever touch this sticky ball [0]https://www.microsoft.com/en-us/licensing/product-licensing/products https://www.microsoft.com/en-us/licensing/product-licensing/... [1]https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/SiSyPHuS_node.html;jsessionid=F899BCB1BC6CD1F43C3B8CC93EAB16C6.2_cid500 https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
    - nl 6y ago
      There is an explicit exemption in the GPDR for law enforcement and national security. See https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#:~:text=Law%20enforcement%20%E2%80%93%20the%20processing%20of,the%20Police%20investigating%20a%20crime https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
      - number6 6y ago
        EU Law Enforcment and EU national security and it has to be comliant with basic human rights. In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
- nl 6y ago
  This is incorrect. Windows is GDPR compliant. See section 3 of https://docs.microsoft.com/en-us/windows/privacy/windows-10-and-privacy-compliance https://docs.microsoft.com/en-us/windows/privacy/windows-10-... GRDP compliance isn't too bad for a company like Microsoft who has decent data auditing ability. It's pretty easy for them to give you your windows data and delete it if required, and that's what is required for basic GRDP compliance. If there is public advice otherwise a citation would be useful. Note that your subsequent comment claiming that FISA request make GPDR compliance impossible is also incorrect as they are explicitly excluded (as law enforcement) by the GPDR: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#:~:text=Law%20enforcement%20%E2%80%93%20the%20processing%20of,the%20Police%20investigating%20a%20crime https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
  - number6 6y ago
    So Microsoft states itself compliant? Ok... Official citation: Dutch DPA https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-microsoft-breaches-data-protection-law-windows-10 https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr... THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights: In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
    - nl 6y ago
      From an update on the very same site: "Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation." https://autoriteitpersoonsgegevens.nl/en/news/privacy-windows-users-greatly-improved-following-dutch-dpa-investigation https://autoriteitpersoonsgegevens.nl/en/news/privacy-window... "In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.

by nanna 6y ago

DanBC 6y ago

> 'reasons of GDPR' This joins a long list of bullshit reasons to do things, that often isn't based in understanding of what The Thing is actually requiring. "Computer says no", "health and safety", "more than my jobsworth", "data protection", "safeguarding", "the regulator says", etc etc etc.

adwww 6y ago
Urgh I'm currently battling migrating a large SASS app from GCP to Azure for these same non reasons.

number6 6y ago

Office365 is not a solution under GDPR. I am in touch with other DPOs and our federal dpos - the big elefant in the room is Microsoft and Windows 10. Everybody knows that you can't use it if you follow the GDPR or at least you have to jump so many loops that it is practical impossible. The federal DPOs advice against Teams and OneDrive so Microsoft gets the message but if the CJEU looks at Windows from a GDPR perspective Everybody had to stop using it.

mrweasel 6y ago
Could you clarify what the issue with Microsoft and Windows 10 is? I have no reason to doubt you, I would just genuinely like to know what to look out for.
- number6 6y ago
  If you use Windows 10 you accept the Terms and Services [0]. This also includes the Data Processing Addendum. So there is a legal basis for Microsoft to send Data to the US. Since Microsoft falls under FISA it has to give data to the authorities with no chance to appeal for the data subject. This violates the GDPR. Ok this is the legal stuff. Here is the technical stuff [1]. In short: Windows 10 sends all kind of data including whole documents to Microsoft USA and you can't stop it using the OS but have to apply Firewall rules and DPI. So if you really want to use Microsoft you have to make a Data protection impact assessment for each new version of windows 10. I know no one who does this. But if you ask the federal dpo they will tell you that they can't say if you can use windows 10 for this or that but you should asses it yourself using a data protection impact assessment. I just hope nobody will ever touch this sticky ball [0]https://www.microsoft.com/en-us/licensing/product-licensing/products https://www.microsoft.com/en-us/licensing/product-licensing/... [1]https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/SiSyPHuS_node.html;jsessionid=F899BCB1BC6CD1F43C3B8CC93EAB16C6.2_cid500 https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
  - nl 6y ago
    There is an explicit exemption in the GPDR for law enforcement and national security. See https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#:~:text=Law%20enforcement%20%E2%80%93%20the%20processing%20of,the%20Police%20investigating%20a%20crime https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
    - number6 6y ago
      EU Law Enforcment and EU national security and it has to be comliant with basic human rights. In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
nl 6y ago
This is incorrect. Windows is GDPR compliant. See section 3 of https://docs.microsoft.com/en-us/windows/privacy/windows-10-and-privacy-compliance https://docs.microsoft.com/en-us/windows/privacy/windows-10-... GRDP compliance isn't too bad for a company like Microsoft who has decent data auditing ability. It's pretty easy for them to give you your windows data and delete it if required, and that's what is required for basic GRDP compliance. If there is public advice otherwise a citation would be useful. Note that your subsequent comment claiming that FISA request make GPDR compliance impossible is also incorrect as they are explicitly excluded (as law enforcement) by the GPDR: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#:~:text=Law%20enforcement%20%E2%80%93%20the%20processing%20of,the%20Police%20investigating%20a%20crime https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
- number6 6y ago
  So Microsoft states itself compliant? Ok... Official citation: Dutch DPA https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-microsoft-breaches-data-protection-law-windows-10 https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr... THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights: In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
  - nl 6y ago
    From an update on the very same site: "Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation." https://autoriteitpersoonsgegevens.nl/en/news/privacy-windows-users-greatly-improved-following-dutch-dpa-investigation https://autoriteitpersoonsgegevens.nl/en/news/privacy-window... "In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.