7 ms·

European Commission's use of Microsoft 365 infringes data protection law for EU

120 points by jrepinc 3y ago

dathinab 3y ago
Tbh. after the recent sets of Microsoft ToS/Privacy Terms I would argue _any usage of Microsoft Windows and/or most Microsoft products_ is not legally possible in a public office handling any private or otherwise sensitive data. ... I mean they might have different ToS/Privacy Terms, but I it would still be high risk due to MS track record of "accidentally" undoing or ignoring various "I don't want to be tracked" choices. Like tbh. from a privacy POV MS has become a joke, I mean how hard do you have to mess up that google is preferable bay a not so small margin.
- 7373737373 3y ago
  I wonder how with such a big market alternatives have never become popular Is it too much to hope for a Blender-like foundation to run an open source project that is actually competitive?
  - explaininjs 3y ago
    The risk of not being compatible with XYZ Word/Excel/Powerpoint feature is too great. Do you really want your employees to not be able to open the client's document because you cheaped out on your productivity suite? Or, conversely, your prospective customer to not be able to open your proposal because of the same? Alternatives did exist, who remembers Lotus Notes, Word Perfect, Open Office, Apple Pages, ..., but to use them today would be akin to deploying a new fangled AI web app as a Flash application.
    - Closi 3y ago
      The other thing to mention is that the Microsoft products are really pretty good and for most businesses really pretty cheap. You can get a 365 licence (Teams, OneDrive/Sharepoint, Powerpoint, Excel, Word, Outlook & hosted exchange) for $12.50/month. It's only really Google that's competing at this price point (Broadly both their 'standard' packages are approx. the same price). Plus I've not come across a product that's better than being Excel than Excel is (and your analyst and finance teams will hate you if you take Excel away!).
  - pid-1 3y ago
    I don't think that's wild. But IMO the real moat in M365 is that it also bundles Microsoft Entra ID (formerly AAD) licenses and it's strongly integrated to it + SharePoint. This way you can have "basic IT stuff" you expect in a company like company users, groups, shared folders, file permissions, etc...
  - gray_-_wolf 3y ago
    I mean https://www.collaboraoffice.com/collabora-online/ https://www.collaboraoffice.com/collabora-online/ is a thing. Never tried it though.
- lozenge 3y ago
  LTSC/LTSB has or had a lot of stuff removed, like Bing on the Start bar search
  - ale42 3y ago
    Same for Windows server... but it's probably too expensive to use it as a desktop OS
  - deleted 3y ago
    [deleted]
- EMIRELADERO 3y ago
  > Tbh. after the recent sets of Microsoft ToS/Privacy Terms I would argue _any usage of Microsoft Windows and/or most Microsoft products_ is not legally possible in a public office handling any private or otherwise sensitive data. Then MS is violating GDPR and must come into compliance, less it risks turning into a cashcow for the EU and get fined billions of dollars day after day.
  - jprete 3y ago
    That doesn't help non-EU users, though.
  - input_sh 3y ago
    > to bring the processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. This isn't GDPR specifically, this is something like "GPDR for EU institutions", so stricter.
carlosjobim 3y ago
I have personal experience of authorities in the European Union abusing GDPR laws to circumference laws on transparency. In the case I was involved with, they refused to give out public documents where political parties have to list the people that receive money from them, by getting the data protection authority involved and saying it was not possible because the recipient might use an American company for backup or an American e-mail provider on their computers. All this communication of course sent to us through their Microsoft Exchange server. As with all laws in Europe, GDPR has a chief purpose to be abused by the rulers and used against the public and the public interest. That's a long standing tradition in Europe, and I feel that it's only people here that don't "get it" and actually believe the propaganda. You don't believe Apple propaganda, Monsanto propaganda, or Republican propaganda. So why swallow EU propaganda?
- wildrhythms 3y ago
  >they refused to give out public documents where political parties have to list the people that receive money from them So who is 'they' and what were the documents? I'm American so I'm not deeply familiar with this area.
  - carlosjobim 3y ago
    "They" in this case is a national authority within a EU country. They are responsible for handing out tax payer's money as subsidies to political parties, and the political parties have to declare and account for how they used this money. The authority refused to give out these declarations, saying it would break GDPR laws because they might be backed up to an American server. Of course it is blatant mis-interpretation of the law, but this is how these laws and other laws get applied in reality. Used when they benefit the rulers and ignored when they would benefit the population. In the US you don't have this kind of financing I believe, because your political parties pay for themselves by endless fundraising from their voters.
    - emayljames 3y ago
      most financing in the US for parties come from corporate donations, very much with a condition imposed by the corporation. Kind of acting like a bribe.
nemoniac 3y ago
This is the key sentence but it's not clear to me how to parse it: "The EDPS has therefore decided to order the Commission, effective on 9 December 2024, to suspend all data flows resulting from its use of Microsoft 365 to Microsoft and to its affiliates and sub-processors located in countries outside the EU/EEA not covered by an adequacy decision." Does it mean suspend flows to Microsoft anywhere and to its affilietes and sub-processors outside EEA? Or does it mean suspend flows to (Microsoft and to its affilietes and sub-processors) which are located outside EEA? In other words can data still flow to Microsoft within EEA?
- kosinus 3y ago
  It goes on to say: > The EDPS has also decided to order the Commission to bring the processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. Which, to me, reads like they can keep using Microsoft 365, they just need to work with Microsoft to bring it in compliance. So my guess is your second interpretation.
- deleted 3y ago
  [deleted]
- yk 3y ago
  As I read it, in practice it will mean that Microsoft comes up with a compliant version of Word 365. (Or at least a roadmap how to bring it into compliance.)
nbevans 3y ago
If even the European Commission cannot get GDPR right, then what hope do small/medium businesses have?
- Sammi 3y ago
  It's not that the European Commission cannot, it's that they won't (wonnot? ). The EU is made up of different institutions that want different things.
  - b112 3y ago
    ? == will not
- belorn 3y ago
  This is not GDPR. Regulation (EU) 2018/1725 is about how the European Parliament, Council and other bodies, offices of it has to handle information. It would be similar to a federal law in the US that dictate that no information stored in the tax office, police databases or social security administration may be shared or stored outside the US. US citizens may expect that when dealing with the US government, information stored about them stays inside the US. In the context of internal security and national sovereignty, it make sense to have dedicated regulation. It similar to how lawyers/doctors has more strict regulation regarding personal information that other professions.
- p_l 3y ago
  It's very simple to be compliant - just don't process PII that isn't core to your business process for serving given user (marketing isn't considered core process unless it's literally the service you provide the affected user)
KingOfCoders 3y ago
The Comission doesn't care about privacy and wants tighter integration with the US (for the companies). The parliament and the European Court of Justice want stronger privacy (for the people). That is the reason for the drama over the last years concerning Privacy Shield etc.
- moi2388 3y ago
  Yeah, they will do whatever they can to keep our data flowing to the US so that their intelligence agencies and data brokers can extract the info and sell it back legally
  - close04 3y ago
    This is taking it a bit far. The choice is a lot simpler in most cases, between the loss of privacy and the loss of productivity the choice is usually for the former. Eventually for almost anything "computers" you'll loop back to a US company. Where do you think every EU company and institution is going "to the cloud"? Hetzner? OVH? Or AWS, Azure, GCP, OCI? The background being that there's little competition for the M365 ecosystem in general, least of all in the EU. EU has homegrown "bits and pieces" that could, maybe, somehow, go head to head with the equivalent bits from M365. But as soon as you need more of them you hit the integration and synergies wall and the advantages of M365 get compounded.
    - epolanski 3y ago
      I'm surprised those agencies cannot setup their own infrastructure to be honest. We're not talking about high volumes of traffic, this is mostly internal tools for few hundreds/thousands people, of those few dozens at best concurrently connected? With all due respect those are few servers worth of hardware plus redundancy, plus all the security you want.
      - deleted 3y ago
        [deleted]
      - 3y ago
greatgib 3y ago
It blows my mind how European political leaders are so incompetent that they don't see any issue having their sensitive IT infrastructure outsourced to foreign providers. They feel confident because they believe the words of providers or what is said in contract or "paper" agreements that the US will not spy on them when it is possible. Despite all previous examples of shamelessly doing what they wanted. Like when there was undercover operations to retrieve the fingerprints of political leaders.
- deleted 3y ago
  [deleted]
- layer8 3y ago
  The European Commission has been using Microsoft Office since the 1980s, so it’s hard to get rid of, given all the established processes and existing documents, and there were no significant data privacy concerns until the rise of telemetry and the push to the cloud a few years ago. But there are actual steps being taken to reduce the dependency.
  - jrepinc 3y ago
    Thats why every smart person and institution should insist on using ončy completely free and open documents formats (like OpenDocument Format for office documents), protocols and standards. So that the chance of getting trapped into vendor locking is greatly reduced.
    - troupo 3y ago
      You will get locked in to the one/two vendors that can make those free and open document formats and protocols work, interoperate, and integrate with all the processes and requirements of a government. "Free and open" is not a silver bullet. Neither is Microsoft, but Microsoft has been providing government services for decades, and they know the ins and outs, the requirements, the policies, the access levels and a billion other details. None of that exists in "free and open". I wouldn't be surprised if just resolving the complex web of Active Directories in a small government department will make anyone mad.
deleted 3y ago
[deleted]
nforgerit 3y ago
German here. It's been blowing my mind for 20ys now how incompetent and naive our leadership (nation-wise but also on EU level) is. The current German gov't silently issued a statement in December 2023 of IT license cost on federal level for the upcoming years which essentially was 6 billion EUR to Microsoft and Oracle. 1. They throw valuable tax-payer money at companies who do tax evasion. 2. They simply ignore the _fact_ that we've been spied on by our allies. 3. They became over-dependent on US tech which trickled down into all fine-granular processes of private and public institutions. 4. They make it additionally hard for local companies to compete with their regulation frenzies. Don't know what to say anymore but mocking them and mention what might happen if Trump gets re-elected and discovers this dependency. If US is playing hardball, Germany will be back in stone age.
- Levitating 3y ago
  Where can I read this statement?
  - nforgerit 3y ago
    Here you are: https://www.zdf.de/nachrichten/politik/deutschland/it-open-source-bundesregierung-kleine-anfrage-100.html https://www.zdf.de/nachrichten/politik/deutschland/it-open-s...
DavideNL 3y ago
dupe link: https://news.ycombinator.com/item?id=39666561 https://news.ycombinator.com/item?id=39666561

120 points by jrepinc 3y ago

Tbh. after the recent sets of Microsoft ToS/Privacy Terms I would argue _any usage of Microsoft Windows and/or most Microsoft products_ is not legally possible in a public office handling any private or otherwise sensitive data. ... I mean they might have different ToS/Privacy Terms, but I it would still be high risk due to MS track record of "accidentally" undoing or ignoring various "I don't want to be tracked" choices. Like tbh. from a privacy POV MS has become a joke, I mean how hard do you have to mess up that google is preferable bay a not so small margin.

7373737373 3y ago
I wonder how with such a big market alternatives have never become popular Is it too much to hope for a Blender-like foundation to run an open source project that is actually competitive?
- explaininjs 3y ago
  The risk of not being compatible with XYZ Word/Excel/Powerpoint feature is too great. Do you really want your employees to not be able to open the client's document because you cheaped out on your productivity suite? Or, conversely, your prospective customer to not be able to open your proposal because of the same? Alternatives did exist, who remembers Lotus Notes, Word Perfect, Open Office, Apple Pages, ..., but to use them today would be akin to deploying a new fangled AI web app as a Flash application.
  - Closi 3y ago
    The other thing to mention is that the Microsoft products are really pretty good and for most businesses really pretty cheap. You can get a 365 licence (Teams, OneDrive/Sharepoint, Powerpoint, Excel, Word, Outlook & hosted exchange) for $12.50/month. It's only really Google that's competing at this price point (Broadly both their 'standard' packages are approx. the same price). Plus I've not come across a product that's better than being Excel than Excel is (and your analyst and finance teams will hate you if you take Excel away!).
- pid-1 3y ago
  I don't think that's wild. But IMO the real moat in M365 is that it also bundles Microsoft Entra ID (formerly AAD) licenses and it's strongly integrated to it + SharePoint. This way you can have "basic IT stuff" you expect in a company like company users, groups, shared folders, file permissions, etc...
- gray_-_wolf 3y ago
  I mean https://www.collaboraoffice.com/collabora-online/ https://www.collaboraoffice.com/collabora-online/ is a thing. Never tried it though.
lozenge 3y ago
LTSC/LTSB has or had a lot of stuff removed, like Bing on the Start bar search
- ale42 3y ago
  Same for Windows server... but it's probably too expensive to use it as a desktop OS
- deleted 3y ago
  [deleted]
EMIRELADERO 3y ago
> Tbh. after the recent sets of Microsoft ToS/Privacy Terms I would argue _any usage of Microsoft Windows and/or most Microsoft products_ is not legally possible in a public office handling any private or otherwise sensitive data. Then MS is violating GDPR and must come into compliance, less it risks turning into a cashcow for the EU and get fined billions of dollars day after day.
- jprete 3y ago
  That doesn't help non-EU users, though.
- input_sh 3y ago
  > to bring the processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. This isn't GDPR specifically, this is something like "GPDR for EU institutions", so stricter.

carlosjobim 3y ago

I have personal experience of authorities in the European Union abusing GDPR laws to circumference laws on transparency. In the case I was involved with, they refused to give out public documents where political parties have to list the people that receive money from them, by getting the data protection authority involved and saying it was not possible because the recipient might use an American company for backup or an American e-mail provider on their computers. All this communication of course sent to us through their Microsoft Exchange server. As with all laws in Europe, GDPR has a chief purpose to be abused by the rulers and used against the public and the public interest. That's a long standing tradition in Europe, and I feel that it's only people here that don't "get it" and actually believe the propaganda. You don't believe Apple propaganda, Monsanto propaganda, or Republican propaganda. So why swallow EU propaganda?

wildrhythms 3y ago
>they refused to give out public documents where political parties have to list the people that receive money from them So who is 'they' and what were the documents? I'm American so I'm not deeply familiar with this area.
- carlosjobim 3y ago
  "They" in this case is a national authority within a EU country. They are responsible for handing out tax payer's money as subsidies to political parties, and the political parties have to declare and account for how they used this money. The authority refused to give out these declarations, saying it would break GDPR laws because they might be backed up to an American server. Of course it is blatant mis-interpretation of the law, but this is how these laws and other laws get applied in reality. Used when they benefit the rulers and ignored when they would benefit the population. In the US you don't have this kind of financing I believe, because your political parties pay for themselves by endless fundraising from their voters.
  - emayljames 3y ago
    most financing in the US for parties come from corporate donations, very much with a condition imposed by the corporation. Kind of acting like a bribe.

nemoniac 3y ago

This is the key sentence but it's not clear to me how to parse it: "The EDPS has therefore decided to order the Commission, effective on 9 December 2024, to suspend all data flows resulting from its use of Microsoft 365 to Microsoft and to its affiliates and sub-processors located in countries outside the EU/EEA not covered by an adequacy decision." Does it mean suspend flows to Microsoft anywhere and to its affilietes and sub-processors outside EEA? Or does it mean suspend flows to (Microsoft and to its affilietes and sub-processors) which are located outside EEA? In other words can data still flow to Microsoft within EEA?

kosinus 3y ago
It goes on to say: > The EDPS has also decided to order the Commission to bring the processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. Which, to me, reads like they can keep using Microsoft 365, they just need to work with Microsoft to bring it in compliance. So my guess is your second interpretation.
deleted 3y ago
[deleted]
yk 3y ago
As I read it, in practice it will mean that Microsoft comes up with a compliant version of Word 365. (Or at least a roadmap how to bring it into compliance.)

nbevans 3y ago

If even the European Commission cannot get GDPR right, then what hope do small/medium businesses have?

Sammi 3y ago
It's not that the European Commission cannot, it's that they won't (wonnot? ). The EU is made up of different institutions that want different things.
- b112 3y ago
  ? == will not
belorn 3y ago
This is not GDPR. Regulation (EU) 2018/1725 is about how the European Parliament, Council and other bodies, offices of it has to handle information. It would be similar to a federal law in the US that dictate that no information stored in the tax office, police databases or social security administration may be shared or stored outside the US. US citizens may expect that when dealing with the US government, information stored about them stays inside the US. In the context of internal security and national sovereignty, it make sense to have dedicated regulation. It similar to how lawyers/doctors has more strict regulation regarding personal information that other professions.
p_l 3y ago
It's very simple to be compliant - just don't process PII that isn't core to your business process for serving given user (marketing isn't considered core process unless it's literally the service you provide the affected user)

KingOfCoders 3y ago

The Comission doesn't care about privacy and wants tighter integration with the US (for the companies). The parliament and the European Court of Justice want stronger privacy (for the people). That is the reason for the drama over the last years concerning Privacy Shield etc.

moi2388 3y ago
Yeah, they will do whatever they can to keep our data flowing to the US so that their intelligence agencies and data brokers can extract the info and sell it back legally
- close04 3y ago
  This is taking it a bit far. The choice is a lot simpler in most cases, between the loss of privacy and the loss of productivity the choice is usually for the former. Eventually for almost anything "computers" you'll loop back to a US company. Where do you think every EU company and institution is going "to the cloud"? Hetzner? OVH? Or AWS, Azure, GCP, OCI? The background being that there's little competition for the M365 ecosystem in general, least of all in the EU. EU has homegrown "bits and pieces" that could, maybe, somehow, go head to head with the equivalent bits from M365. But as soon as you need more of them you hit the integration and synergies wall and the advantages of M365 get compounded.
  - epolanski 3y ago
    I'm surprised those agencies cannot setup their own infrastructure to be honest. We're not talking about high volumes of traffic, this is mostly internal tools for few hundreds/thousands people, of those few dozens at best concurrently connected? With all due respect those are few servers worth of hardware plus redundancy, plus all the security you want.
    - deleted 3y ago
      [deleted]
    - 3y ago

greatgib 3y ago

It blows my mind how European political leaders are so incompetent that they don't see any issue having their sensitive IT infrastructure outsourced to foreign providers. They feel confident because they believe the words of providers or what is said in contract or "paper" agreements that the US will not spy on them when it is possible. Despite all previous examples of shamelessly doing what they wanted. Like when there was undercover operations to retrieve the fingerprints of political leaders.

deleted 3y ago
[deleted]
layer8 3y ago
The European Commission has been using Microsoft Office since the 1980s, so it’s hard to get rid of, given all the established processes and existing documents, and there were no significant data privacy concerns until the rise of telemetry and the push to the cloud a few years ago. But there are actual steps being taken to reduce the dependency.
- jrepinc 3y ago
  Thats why every smart person and institution should insist on using ončy completely free and open documents formats (like OpenDocument Format for office documents), protocols and standards. So that the chance of getting trapped into vendor locking is greatly reduced.
  - troupo 3y ago
    You will get locked in to the one/two vendors that can make those free and open document formats and protocols work, interoperate, and integrate with all the processes and requirements of a government. "Free and open" is not a silver bullet. Neither is Microsoft, but Microsoft has been providing government services for decades, and they know the ins and outs, the requirements, the policies, the access levels and a billion other details. None of that exists in "free and open". I wouldn't be surprised if just resolving the complex web of Active Directories in a small government department will make anyone mad.

deleted 3y ago

[deleted]

nforgerit 3y ago

German here. It's been blowing my mind for 20ys now how incompetent and naive our leadership (nation-wise but also on EU level) is. The current German gov't silently issued a statement in December 2023 of IT license cost on federal level for the upcoming years which essentially was 6 billion EUR to Microsoft and Oracle. 1. They throw valuable tax-payer money at companies who do tax evasion. 2. They simply ignore the _fact_ that we've been spied on by our allies. 3. They became over-dependent on US tech which trickled down into all fine-granular processes of private and public institutions. 4. They make it additionally hard for local companies to compete with their regulation frenzies. Don't know what to say anymore but mocking them and mention what might happen if Trump gets re-elected and discovers this dependency. If US is playing hardball, Germany will be back in stone age.

Levitating 3y ago
Where can I read this statement?
- nforgerit 3y ago
  Here you are: https://www.zdf.de/nachrichten/politik/deutschland/it-open-source-bundesregierung-kleine-anfrage-100.html https://www.zdf.de/nachrichten/politik/deutschland/it-open-s...

DavideNL 3y ago

dupe link: https://news.ycombinator.com/item?id=39666561 https://news.ycombinator.com/item?id=39666561