6 ms·

I am a UK college governor, and have bought up the GDPR issues that have come up with Google and Microsoft recently. Whilst I do get some nonsensical response,

I am a UK college governor, and have bought up the GDPR issues that have come up with Google and Microsoft recently. Whilst I do get some nonsensical response, that big tech have great security, it does feel really lainful that there is basically no alternative. I really want there to be, but there just isn't a viable alternative.

ChuckNorris89 4y ago
>I really want there to be, but there just isn't a viable alternative. There isn't? My Eastern European highschool had self hosted email since as far as I can remember hosted on some pentium PCs. The issue isn't that there's no alternative, the issue is that, schools are unable or unwilling to bother doing things themselves and instead just go with Apple, Google, Microsoft, because it's easy and almost free.
- yazzku 4y ago
  Almost free? Microsoft charges hefty licenses and basically re-sales the same product multiple times. I believe Google also charges schools and universities a hefty monthly fee for the services.
- googlryas 4y ago
  If student privacy is the concern, do you think going with something self hosted is a better idea than sticking with Google? In reality, the concern seems to be the law will not legally allow them to continue operating unless Google clarifies where the data is processed.
  - Rygian 4y ago
    Sticking with Google means students have no privacy, due to the US government being able to summarily monitor their Google data. Even if Google promises the processing happens in Europe. It's not "clarify where the data is processed" but rather "make sure it's not processed by an US-owned corp" (not to say that any other country is fine, their laws must be compatible with GDPR).
- almog 4y ago
  I guess that would work great even today for _internal_ emails, but as soon as they'll need to deliver emails to any address that's hosted behind gmail, outlook and probably other dominant players, there's a long list of configurations to make and maintain so that outgoing emails don't get bounced.
  - Aeolun 4y ago
    If I can do it, surely someone whose entire job is doing it should be able to?
    - AlchemistCamp 4y ago
      If only the world were like that.
    - fcatalan 4y ago
      My entire job was doing that for a university for a few years. You won't catch me doing it again even for 2x my current salary.
    - freeflight 4y ago
      That assumes schools have dedicated IT positions, when its very common for the school IT to be managed part-time by teachers themselves, as often there ain't enough money for a dedicated IT position.
      - Aeolun 4y ago
        I’ve never seen that tbh. Any school I’ve been at has had dedicated IT personnel. Fairly well paid too.
    - 2000UltraDeluxe 4y ago
      I, and many others do. We barely manage. Email deliverability is _hard_.
      - dijit 4y ago
- gidorah 4y ago
  Unfortunately, schools do have budget constraints, so "almost free" is very, very attractive.
ls15 4y ago
> but there just isn't a viable alternative. Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would seem like tax money being used as intended by the taxpayer.
- jeffbee 4y ago
  This kind of response always baffles me. Choose any of the common questions people have about cloud data privacy and ask the same question about Nextcloud. For example: when I delete a file does the cloud really delete it? Now read the Nextcloud source code. All it does is unlink files, and it doesn't even do that properly because it doesn't handle errors and races. Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.
  - cmroanirgo 4y ago
    The thing is, there's no gaurantee that google nor microsoft nor apple do anything more. With products like nextcloud, at least you can see exactly what's going on. We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements. So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
    - jeffbee 4y ago
      > at least I have a chance of knowing when my data's being monitored C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school? Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.
avianlyric 4y ago
Well good news! Our wonderful government has great plans to scrap GDPR and all the silly European bureaucracy slowing down business, and replace it with… checks notes …better British bureaucracy that will cost just as much, while eradicating our rights to privacy… It’s a Brexit benefit or something.
stjohnswarts 4y ago
Do GPDR rules even apply in Britain any longer given that it's split from the EU is 100% now?
- vinay427 4y ago
  As far as I can tell, yes. It was implemented in the UK (as in EU countries) by incorporating it into national law, but can be reviewed at a later date as some UK politicians have claimed to support. https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-and-the-eu-in-detail/the-uk-gdpr/ https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
  - M2Ys4U 4y ago
    >It was implemented in the UK (as in EU countries) by incorporating it into national law That's not how it worked. The GDPR is a regulation which means that it applies as-is in all EU member states without being incorporated in to national laws. It is only directives that need to be incorporated in to national law (a process known as "transposition"). As far as the UK goes, because the GDPR was in force at the time of Brexit it continued to apply (the same with almost all EU law), although it was amended so that it didn't reference EU institutions any more (like removing the bits that talked about the EDPB or collaboration with other EU supervisory authorities, replacing references to the Commission with the Secretary of State and other things like that).
    - vinay427 4y ago
      I believe you're mostly right, so I stand corrected; apologies for the error. However, the Data Protection Act 2018 [1] does complement and supplement the GDPR in UK national law, including certain data not covered by GDPR, and more specifically apparently "implements those parts of the GDPR which 'are to be determined by Member State law'". This was before Brexit took place, and it was later amended to reflect non-EU status at the start of 2021. [1] https://en.wikipedia.org/wiki/Data_Protection_Act_2018 https://en.wikipedia.org/wiki/Data_Protection_Act_2018
- 4y ago
sjamaan 4y ago
If self hosting is not an option, there are European mail providers, who must be GDPR compliant. The biggest one being ProtonMail.
pelasaco 4y ago
That was exactly my impression in Germany too. You can search my answer in this thread discussing my whole experience. It is depressing to see this whole argumentation as main blocker to a digital breakthrough. The funniest anecdote was one of the most zealous person against google in the set of meetings that I took place about this topic, used google maps to reach the building where we held the showcases and demos.

ChuckNorris89 4y ago

>I really want there to be, but there just isn't a viable alternative. There isn't? My Eastern European highschool had self hosted email since as far as I can remember hosted on some pentium PCs. The issue isn't that there's no alternative, the issue is that, schools are unable or unwilling to bother doing things themselves and instead just go with Apple, Google, Microsoft, because it's easy and almost free.

yazzku 4y ago
Almost free? Microsoft charges hefty licenses and basically re-sales the same product multiple times. I believe Google also charges schools and universities a hefty monthly fee for the services.
googlryas 4y ago
If student privacy is the concern, do you think going with something self hosted is a better idea than sticking with Google? In reality, the concern seems to be the law will not legally allow them to continue operating unless Google clarifies where the data is processed.
- Rygian 4y ago
  Sticking with Google means students have no privacy, due to the US government being able to summarily monitor their Google data. Even if Google promises the processing happens in Europe. It's not "clarify where the data is processed" but rather "make sure it's not processed by an US-owned corp" (not to say that any other country is fine, their laws must be compatible with GDPR).
almog 4y ago
I guess that would work great even today for _internal_ emails, but as soon as they'll need to deliver emails to any address that's hosted behind gmail, outlook and probably other dominant players, there's a long list of configurations to make and maintain so that outgoing emails don't get bounced.
- Aeolun 4y ago
  If I can do it, surely someone whose entire job is doing it should be able to?
  - AlchemistCamp 4y ago
    If only the world were like that.
  - fcatalan 4y ago
    My entire job was doing that for a university for a few years. You won't catch me doing it again even for 2x my current salary.
  - freeflight 4y ago
    That assumes schools have dedicated IT positions, when its very common for the school IT to be managed part-time by teachers themselves, as often there ain't enough money for a dedicated IT position.
    - Aeolun 4y ago
      I’ve never seen that tbh. Any school I’ve been at has had dedicated IT personnel. Fairly well paid too.
  - 2000UltraDeluxe 4y ago
    I, and many others do. We barely manage. Email deliverability is _hard_.
    - dijit 4y ago
gidorah 4y ago
Unfortunately, schools do have budget constraints, so "almost free" is very, very attractive.

ls15 4y ago

> but there just isn't a viable alternative. Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would seem like tax money being used as intended by the taxpayer.

jeffbee 4y ago
This kind of response always baffles me. Choose any of the common questions people have about cloud data privacy and ask the same question about Nextcloud. For example: when I delete a file does the cloud really delete it? Now read the Nextcloud source code. All it does is unlink files, and it doesn't even do that properly because it doesn't handle errors and races. Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.
- cmroanirgo 4y ago
  The thing is, there's no gaurantee that google nor microsoft nor apple do anything more. With products like nextcloud, at least you can see exactly what's going on. We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements. So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
  - jeffbee 4y ago
    > at least I have a chance of knowing when my data's being monitored C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school? Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.

avianlyric 4y ago

Well good news! Our wonderful government has great plans to scrap GDPR and all the silly European bureaucracy slowing down business, and replace it with… checks notes …better British bureaucracy that will cost just as much, while eradicating our rights to privacy… It’s a Brexit benefit or something.

stjohnswarts 4y ago

Do GPDR rules even apply in Britain any longer given that it's split from the EU is 100% now?

vinay427 4y ago
As far as I can tell, yes. It was implemented in the UK (as in EU countries) by incorporating it into national law, but can be reviewed at a later date as some UK politicians have claimed to support. https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-and-the-eu-in-detail/the-uk-gdpr/ https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
- M2Ys4U 4y ago
  >It was implemented in the UK (as in EU countries) by incorporating it into national law That's not how it worked. The GDPR is a regulation which means that it applies as-is in all EU member states without being incorporated in to national laws. It is only directives that need to be incorporated in to national law (a process known as "transposition"). As far as the UK goes, because the GDPR was in force at the time of Brexit it continued to apply (the same with almost all EU law), although it was amended so that it didn't reference EU institutions any more (like removing the bits that talked about the EDPB or collaboration with other EU supervisory authorities, replacing references to the Commission with the Secretary of State and other things like that).
  - vinay427 4y ago
    I believe you're mostly right, so I stand corrected; apologies for the error. However, the Data Protection Act 2018 [1] does complement and supplement the GDPR in UK national law, including certain data not covered by GDPR, and more specifically apparently "implements those parts of the GDPR which 'are to be determined by Member State law'". This was before Brexit took place, and it was later amended to reflect non-EU status at the start of 2021. [1] https://en.wikipedia.org/wiki/Data_Protection_Act_2018 https://en.wikipedia.org/wiki/Data_Protection_Act_2018
4y ago

sjamaan 4y ago

If self hosting is not an option, there are European mail providers, who must be GDPR compliant. The biggest one being ProtonMail.

pelasaco 4y ago

That was exactly my impression in Germany too. You can search my answer in this thread discussing my whole experience. It is depressing to see this whole argumentation as main blocker to a digital breakthrough. The funniest anecdote was one of the most zealous person against google in the set of meetings that I took place about this topic, used google maps to reach the building where we held the showcases and demos.