3 ms·

So Microsoft states itself compliant? Ok... Official citation: Dutch DPA https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-microsoft-breaches-data-prot

So Microsoft states itself compliant? Ok... Official citation: Dutch DPA https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-microsoft-breaches-data-protection-law-windows-10 https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr... THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights: In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.

nl 6y ago
From an update on the very same site: "Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation." https://autoriteitpersoonsgegevens.nl/en/news/privacy-windows-users-greatly-improved-following-dutch-dpa-investigation https://autoriteitpersoonsgegevens.nl/en/news/privacy-window... "In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.
- number6 6y ago
  This is true for all US basee Companies who fall under FISA not just Microsoft. As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied. I have more citations and also newer but they are in German. Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stellungnahme-zum-einsatz-von-microsoft-office-365-hessischen-schulen https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/orientierungshilfen/2020-BlnBDI-Hinweise_Berliner_Verantwortliche_zu_Anbietern_Videokonferenz-Dienste.pdf https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/... And on the technical side: https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/SiSyPHuS_node.html;jsessionid=1EEB5B5ECE76A93E791579FF0EED2CE0.1_cid501 https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat... The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller. Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service. Thats the consequence from the CJEU ruling.
  - nl 6y ago
    I didn't read all these and I don't speak German but the gist of https://datenschutz.hessen.de/pressemitteilungen/zweite-stellungnahme-zum-einsatz-von-microsoft-office-365-hessischen-schulen https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... is close to the opposite of what you claim. It says they will allow the use of Office 365 in schools.
    - number6 6y ago
      Yeah sorry for the german sources. It's not as much as allow but tollerate if certain prerequirements are met e.g. not sending any diagnosis data to Microsoft. And it sounds more like they are somewhat pressured into it. Intensive talks...

nl 6y ago

From an update on the very same site: "Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation." https://autoriteitpersoonsgegevens.nl/en/news/privacy-windows-users-greatly-improved-following-dutch-dpa-investigation https://autoriteitpersoonsgegevens.nl/en/news/privacy-window... "In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.

number6 6y ago
This is true for all US basee Companies who fall under FISA not just Microsoft. As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied. I have more citations and also newer but they are in German. Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stellungnahme-zum-einsatz-von-microsoft-office-365-hessischen-schulen https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/orientierungshilfen/2020-BlnBDI-Hinweise_Berliner_Verantwortliche_zu_Anbietern_Videokonferenz-Dienste.pdf https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/... And on the technical side: https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/SiSyPHuS_node.html;jsessionid=1EEB5B5ECE76A93E791579FF0EED2CE0.1_cid501 https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat... The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller. Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service. Thats the consequence from the CJEU ruling.
- nl 6y ago
  I didn't read all these and I don't speak German but the gist of https://datenschutz.hessen.de/pressemitteilungen/zweite-stellungnahme-zum-einsatz-von-microsoft-office-365-hessischen-schulen https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... is close to the opposite of what you claim. It says they will allow the use of Office 365 in schools.
  - number6 6y ago
    Yeah sorry for the german sources. It's not as much as allow but tollerate if certain prerequirements are met e.g. not sending any diagnosis data to Microsoft. And it sounds more like they are somewhat pressured into it. Intensive talks...