Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

twitter.com

Post reply on HN
Print view View original

11–20 of 346 posts

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#11

Post by orwin »

bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

You can still use office365. It's just that the cloud-based M365 shouldn't be used.

TBH, i used to work at a bank (and now at an energy company), and anecdotal evidence i have is that no big business use M365 cloud services(2 for 2 now). At least not in the IT departement, even where we have people using access to mash .xlsx together and get actionnable data from it.

[edit] I must add that the bank used azure (as an AWS backup mostly), and still, we had no M365 product installed on our microsoft computer.

I'm not a hater or anything, i do have a FOSS bias, but i try to stick to the facts here.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#12

Post by dgellow »

sendfoods wrote: post #4

At this points, isn't it pretty safe to assume very few Silicon Valley services conform to GDPR? Another example was shared recently: Shopify is technically illegal in Germany [1] [1] https://news.ycombinator.com/item?id=33561222

Isn’t California data privacy law more or less equivalent to GDPR? If Silicon Valley’s companies don’t conform to GDPR, I would expect them to face the same type of issues locally. That will maybe come in the future, GDPR is still fairly new, that type of stuff can take a long time to develop.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#13

Post by throwaway294566 »

ofrzeta wrote: post #8
bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

We regularly discuss GDPR matters in our German company because there's a lot of FUD concerning the various cloud platforms and we have to cater to sensitive customers with our own hosting. One extreme is that you can't use AWS at all because of Schrems and it's a US compancy etc. On the other hand there's some hearsay about Microsoft (Azure) being tolerated because there's no way around it.

Imho, the "FUD" is largely right and most cloud platforms are indeed illegal.

However, due to enforcement being absent or taking ages, there are too few legal decisions and big expensive enforcement actions that one can point to. Currently everything is really still fear, uncertainty and doubt, the hammer hasn't come down yet. I'm not sure if it ever will, at least not before EU institutions or other member states such as France force Germany to stop dragging its feet.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#14

Post by dgellow »

throwaway294566 wrote: post #10

Problem as always is, it's all talk and (almost) zero enforcement in Germany. Complaints to a data protection official take forever, are usually dismissed at first, even if counter to published opinions or decisions such as TFA. And only if you still care after a few years of waiting and at least one appeal you might get a decision, however usually a very cheap one for the perpetrator.

GDPR fines can be massive, look at the list here: https://www.enforcementtracker.com/ (sort by the fine amount)

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#15

Post by bboygravity »

throwaway294566 wrote: post #10

Problem as always is, it's all talk and (almost) zero enforcement in Germany. Complaints to a data protection official take forever, are usually dismissed at first, even if counter to published opinions or decisions such as TFA. And only if you still care after a few years of waiting and at least one appeal you might get a decision, however usually a very cheap one for the perpetrator.

Who would have thought that uploading business data (trade secrets) and personal data straight to servers that are known to be accessed by the NSA would be incompatible with GDPR? /s

The kicker is that EU companies are essentially paying to upload their trade secrets to their direct competitors in the US.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#16

Post by vdfs »

foepys wrote: post #7
bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

It could lead to billions in fines for Microsoft. Up to 4% global revenue - for each EU country.

It's just the cost of doing business for them, implementing and complaining with EU laws might cost even more than the fine

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#17

Post by jkaplowitz »

bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

What a depressing reality where hostile US corporate data privacy practices and hostile US surveillance law take de facto priority over the EU's own privacy legislation meant to protect its own residents. I wish the EU politicians and regulators were more willing to enforce their own rules, and that the ECJ were more willing to be explicit rather than implicit about the meaning of its Schrems rulings, all of which would eventually force a privacy-protective solution to the problems you describe.

They have more power over MS than they think if they're willing to exercise it, but they're mostly not willing. (Examples like the Dutch public sector do exist, where they were able to get different terms from MS that are more compliant with the GDPR, including effective audit rights that have successfully verified compliance with these terms.)

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#18

Post by throwaway294566 »

foepys wrote: post #7
bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

It could lead to billions in fines for Microsoft. Up to 4% global revenue - for each EU country.

It would really depend on the situation to be decided, whether MS would have to pay up, or rather the company using MS products to handle customer data. One can imagine a way to use MS products that might not be illegal, e.g. never use it to process personal data, use anonymized accounts that are not bound to a real person, swap around accounts and computers to prevent association with a person, etc. Then, all it would take for MS to get its 'get out of jail free'-card is to publish that in a whitepaper and make all the problems just be an unfortunate misconfiguration by the company using MS products.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#19

Post by vdfs »

dgellow wrote: post #12
sendfoods wrote: post #4

At this points, isn't it pretty safe to assume very few Silicon Valley services conform to GDPR? Another example was shared recently: Shopify is technically illegal in Germany [1] [1] https://news.ycombinator.com/item?id=33561222

Isn’t California data privacy law more or less equivalent to GDPR? If Silicon Valley’s companies don’t conform to GDPR, I would expect them to face the same type of issues locally. That will maybe come in the future, GDPR is still fairly new, that type of stuff can take a long time to develop.

I think most of the problems came from EU data being sent to US located servers, that won't be a problem for silicone Valley and California laws

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#20

Post by jkaplowitz »

dgellow wrote: post #12
sendfoods wrote: post #4

At this points, isn't it pretty safe to assume very few Silicon Valley services conform to GDPR? Another example was shared recently: Shopify is technically illegal in Germany [1] [1] https://news.ycombinator.com/item?id=33561222

Isn’t California data privacy law more or less equivalent to GDPR? If Silicon Valley’s companies don’t conform to GDPR, I would expect them to face the same type of issues locally. That will maybe come in the future, GDPR is still fairly new, that type of stuff can take a long time to develop.

No, California's data privacy law is far weaker than the GDPR, though far better than what most of the US has.
Post reply on HN