7 ms·

> Microsoft also plans to deploy its EU Data Boundary, though which EU customer data can be processed in compliance with data regulations, by the end of 2022.

> Microsoft also plans to deploy its EU Data Boundary, though which EU customer data can be processed in compliance with data regulations, by the end of 2022. IMHO that's the root of the problem. Why does MSFT need to process customer data? Yeah, we all know why, but I'm really getting tired of this shit! It's not a problem paying for your product but leave my data alone, it is mine and that's it! No searching for emails, no training AIs on my code, no scanning images for "child porn", no reading my documents for "national security", etc... all the customer data you need to process is my email to send me a payment receipt or the size of the data I've saved to see if I'm over quota or whatever on that line. And the same applies to all players in this field, not just MSFT who isn't even one of the worst offenders.

ThePowerOfFuet 4y ago
This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing. So is deletion. And, as the processor, they are required to do as the controller (you) instructs.
- vincnetas 4y ago
  Can i instruct to "do not collect"? Or could they for example "do not collect" until i ask them to?
  - marcosdumay 4y ago
    It's a SaaS product. "Collecting" is how it does anything.
- dijit 4y ago
  > re the GDPR, storage is a form of processing. That's not true, which lawyer told you this? I'm honestly really tired of the FUD surrounding GDPR, it's not actually that complicated.
  - guhidalg 4y ago
    https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-constitutes-data-processing_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Check YOUR FUD at the door please.
    - dijit 4y ago
      Storage with intent to process. Not storage itself. IE if you send me a file and I put it on a drive and don’t give it to anyone or read it on behalf of anyone but you: it’s fine.
      - dkyc 4y ago
        It literally isn't. The source provided by the parent confirms it. There is no 'with intent to process' clause. > Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, _storage_, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
        dijit 4y ago
        > It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. I feel like you're intentionally missing the second section here. Regardless, GDPR has hundreds of provisions where it excludes data as long as it's not processed, "storing is processing" in so far as it's secure and not being used by anyone except the account holder isn't going to stand up in any court on the planet, even luddite ones.
        LegionMammal978 4y ago
        You might be parsing the sentence incorrectly. I'd generally read it as: > It includes {the [(collection), (recording), (organisation), (structuring), (storage), (adaptation or alteration), (retrieval), (consultation), (use), (disclosure by {[transmission], [dissemination] or [otherwise making available]}), (alignment or combination), (restriction), (erasure) or (destruction)] of personal data}. So there is no "second section" of the sentence, just a long list. The text of the GDPR has the exact same list [0]. [0] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- PeterisP 4y ago
  >And, as the processor, they are required to do as the controller (you) instructs. There seems to be a terminology issue here, "You" would generally be the data subject, not the data controller, unless you are a company. If you're directly using Office 365 or Google workspace, then MSFT/Google would be the data controller (the primary company who handles the private data), and any subcontractors involved would be data processors on behalf of the controller. If you're a user in the school system, and have no direct agreement with MSFT/Google, then the school may be the data controller and MSFT/Google handling that data on behalf of the school.
itsmeste 4y ago
Amen.
names_are_hard 4y ago
It's a cloud-based product. So processing is a core part of the value proposition - the provider (Google, Microsoft) stores a copy of the data and exposes APIs that the frontends use to download the documents to the users' machines. The alternative is a product that is not collaborative (no online collaboration, at least) or requires customers to hire a sys admin to install on their own servers and maintain it. This isn't some nefarious plot by big tech to steal your data, it's the product people want.
- qubex 4y ago
  I don’t want to collaborate with anyone. I don’t want that ‘functionality’ to get in my way. I don’t want to be driven to despair in an attempt to save a document to my local storage rather than to the OneDrive or whatever it’s called by default.
  - DoctorOW 4y ago
    You really don't have to clarify your needs as one person are different from a school system. I would have figured as such.
  - qubex 4y ago
    I was prompted to reply by “it’s the product people want”. No, it isn’t. Not this person, at least.
  - iwillbenice 4y ago
  - HEmanZ 4y ago
    Congrats. Guess who does want it? Almost every large organization on the planet.
    - gsich 4y ago
      You can build it to be E2EE.
    - 4y ago
Kiro 4y ago
You seem to have an incorrect definition of "processing". It's not about scanning your data or doing anything special with the content. If your data is in the cloud they're automatically processing it.
- silverpepsi 4y ago
  Exactly... feel like a lot of people have 0 perspective on how all encompassing the GDPR is I've worked on plugin software for a super common enterprise ticketing application. The fact that we need to make sure one person can't see another person's data mean we need to record the user names or a unique identifier number of some sort. But these numbers can be related back to a living breathing human being, so that's processing personal data according to European law and makes selling to Europe seem almost insurmountable if you aren't venture capital funded happy to burn very large piles of cash. Afaik exchanging business cards in Europe technically involves violating the GDPR if you pass them on to someone else at work without explicit permission. But contacting the person for permission also isn't allowed, Honda got HUGE fines for that iirc
  - jimnotgym 4y ago
    >Afaik exchanging business cards in Europe technically involves violating the GDPR if you pass them on to someone else at work without explicit permission A bit off topic, but...I would have thought it depends on how you got that card. If someone hands me their card in a private meeting I wouldn't share it anyway. I would offer to do an introduction. If someone had cards in a display stand on their public front desk it is really advertising, and I am quite sure you could share it. Sounds like a GDPR scare story.
- 01acheru 4y ago
  My point is not about doing anything special with their customer's data, it is that if they didn't do anything beyond the basic processing needed for their services to work it would be straightforward to migrate their offerings to Europe complying with local laws. Instead, if you are used to doing whatever you want with the data you store it takes years to build an European service since many parts of your process need to be reviewed and maybe even rebuilt. It was about time for those laws to finally kick in and we started to see a change.
dh2022 4y ago
You can always encrypt your data if you don’t want Microsoft to train its models, red your emails, etccc
- cute_boi 4y ago
  But it is inconvenient. And, if we look on history convenience have always won, eg plastics.
1vuio0pswjnm7 4y ago
This is not the product I want. Not even close. "Tech" companies never ask users what they want. The company decides what it wants, sets the direction that is most profitable and users follow along (after all, what choice do they have). Then "tech" company employees and spokespersons claim this is what people want. Ex post facto. Bullshit! IMHO, HN commenters can speak for themselves. However there is no reason to believe they can speak on behalf of users.

ThePowerOfFuet 4y ago

This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing. So is deletion. And, as the processor, they are required to do as the controller (you) instructs.

vincnetas 4y ago
Can i instruct to "do not collect"? Or could they for example "do not collect" until i ask them to?
- marcosdumay 4y ago
  It's a SaaS product. "Collecting" is how it does anything.
dijit 4y ago
> re the GDPR, storage is a form of processing. That's not true, which lawyer told you this? I'm honestly really tired of the FUD surrounding GDPR, it's not actually that complicated.
- guhidalg 4y ago
  https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-constitutes-data-processing_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Check YOUR FUD at the door please.
  - dijit 4y ago
    Storage with intent to process. Not storage itself. IE if you send me a file and I put it on a drive and don’t give it to anyone or read it on behalf of anyone but you: it’s fine.
    - dkyc 4y ago
      It literally isn't. The source provided by the parent confirms it. There is no 'with intent to process' clause. > Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, _storage_, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
      - dijit 4y ago
        > It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. I feel like you're intentionally missing the second section here. Regardless, GDPR has hundreds of provisions where it excludes data as long as it's not processed, "storing is processing" in so far as it's secure and not being used by anyone except the account holder isn't going to stand up in any court on the planet, even luddite ones.
        LegionMammal978 4y ago
        You might be parsing the sentence incorrectly. I'd generally read it as: > It includes {the [(collection), (recording), (organisation), (structuring), (storage), (adaptation or alteration), (retrieval), (consultation), (use), (disclosure by {[transmission], [dissemination] or [otherwise making available]}), (alignment or combination), (restriction), (erasure) or (destruction)] of personal data}. So there is no "second section" of the sentence, just a long list. The text of the GDPR has the exact same list [0]. [0] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
PeterisP 4y ago
>And, as the processor, they are required to do as the controller (you) instructs. There seems to be a terminology issue here, "You" would generally be the data subject, not the data controller, unless you are a company. If you're directly using Office 365 or Google workspace, then MSFT/Google would be the data controller (the primary company who handles the private data), and any subcontractors involved would be data processors on behalf of the controller. If you're a user in the school system, and have no direct agreement with MSFT/Google, then the school may be the data controller and MSFT/Google handling that data on behalf of the school.

itsmeste 4y ago

Amen.

names_are_hard 4y ago

It's a cloud-based product. So processing is a core part of the value proposition - the provider (Google, Microsoft) stores a copy of the data and exposes APIs that the frontends use to download the documents to the users' machines. The alternative is a product that is not collaborative (no online collaboration, at least) or requires customers to hire a sys admin to install on their own servers and maintain it. This isn't some nefarious plot by big tech to steal your data, it's the product people want.

qubex 4y ago
I don’t want to collaborate with anyone. I don’t want that ‘functionality’ to get in my way. I don’t want to be driven to despair in an attempt to save a document to my local storage rather than to the OneDrive or whatever it’s called by default.
- DoctorOW 4y ago
  You really don't have to clarify your needs as one person are different from a school system. I would have figured as such.
- qubex 4y ago
  I was prompted to reply by “it’s the product people want”. No, it isn’t. Not this person, at least.
- iwillbenice 4y ago
- HEmanZ 4y ago
  Congrats. Guess who does want it? Almost every large organization on the planet.
  - gsich 4y ago
    You can build it to be E2EE.
  - 4y ago

Kiro 4y ago

You seem to have an incorrect definition of "processing". It's not about scanning your data or doing anything special with the content. If your data is in the cloud they're automatically processing it.

silverpepsi 4y ago
Exactly... feel like a lot of people have 0 perspective on how all encompassing the GDPR is I've worked on plugin software for a super common enterprise ticketing application. The fact that we need to make sure one person can't see another person's data mean we need to record the user names or a unique identifier number of some sort. But these numbers can be related back to a living breathing human being, so that's processing personal data according to European law and makes selling to Europe seem almost insurmountable if you aren't venture capital funded happy to burn very large piles of cash. Afaik exchanging business cards in Europe technically involves violating the GDPR if you pass them on to someone else at work without explicit permission. But contacting the person for permission also isn't allowed, Honda got HUGE fines for that iirc
- jimnotgym 4y ago
  >Afaik exchanging business cards in Europe technically involves violating the GDPR if you pass them on to someone else at work without explicit permission A bit off topic, but...I would have thought it depends on how you got that card. If someone hands me their card in a private meeting I wouldn't share it anyway. I would offer to do an introduction. If someone had cards in a display stand on their public front desk it is really advertising, and I am quite sure you could share it. Sounds like a GDPR scare story.
01acheru 4y ago
My point is not about doing anything special with their customer's data, it is that if they didn't do anything beyond the basic processing needed for their services to work it would be straightforward to migrate their offerings to Europe complying with local laws. Instead, if you are used to doing whatever you want with the data you store it takes years to build an European service since many parts of your process need to be reviewed and maybe even rebuilt. It was about time for those laws to finally kick in and we started to see a change.

dh2022 4y ago

You can always encrypt your data if you don’t want Microsoft to train its models, red your emails, etccc

cute_boi 4y ago
But it is inconvenient. And, if we look on history convenience have always won, eg plastics.

1vuio0pswjnm7 4y ago

This is not the product I want. Not even close. "Tech" companies never ask users what they want. The company decides what it wants, sets the direction that is most profitable and users follow along (after all, what choice do they have). Then "tech" company employees and spokespersons claim this is what people want. Ex post facto. Bullshit! IMHO, HN commenters can speak for themselves. However there is no reason to believe they can speak on behalf of users.