Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

twitter.com

Post reply on HN
Print view View original

21–30 of 346 posts

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#21

Post by hobofan »

dgellow wrote: post #14
throwaway294566 wrote: post #10

Problem as always is, it's all talk and (almost) zero enforcement in Germany. Complaints to a data protection official take forever, are usually dismissed at first, even if counter to published opinions or decisions such as TFA. And only if you still care after a few years of waiting and at least one appeal you might get a decision, however usually a very cheap one for the perpetrator.

GDPR fines can be massive, look at the list here: https://www.enforcementtracker.com/ (sort by the fine amount)

So 3 enforcements in Germany in all of 2022, and the highest fine in Germany was 35mil. 35mil is how much for Microsoft? The yearly Office 365 fees of one of their DAX customers?

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#22

Post by throwaway294566 »

dgellow wrote: post #14
throwaway294566 wrote: post #10

Problem as always is, it's all talk and (almost) zero enforcement in Germany. Complaints to a data protection official take forever, are usually dismissed at first, even if counter to published opinions or decisions such as TFA. And only if you still care after a few years of waiting and at least one appeal you might get a decision, however usually a very cheap one for the perpetrator.

GDPR fines can be massive, look at the list here: https://www.enforcementtracker.com/ (sort by the fine amount)

Yes. But there is too few of them, and usually in situations where other companies can still wait and see. "We aren't Facebook", "We are too small to be noticed" and "but we had them sign a waiver" are still prevalent in most companies.

For things to change, there would really need to be something like:

- data protection fines the whole of the customer list of Amazon/Google/MS cloud

- data protection fines a high-profile company a lot of money for using Office365

- a court forces a public institution to cease using Office365 (no fines possible there)

- enforcement accelerates to a point where, from complaint to fine, things take only a few weeks, instead of a few years, so that lots of medium and smaller businesses are hit. Currently enforcement seems to be starting with the big cases, and being bogged down in the complexity of those.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#23

Post by baxtr »

foepys wrote: post #7
bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

It could lead to billions in fines for Microsoft. Up to 4% global revenue - for each EU country.

Can you provide a precedent where this has happened?

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#24

Post by InCityDreams »

ifeeltriedboss wrote: post #9
janmarsal wrote: post #6

Earlier quoted context omitted.

I wish I had ms office with its 90s UI/UX instead of whatever garbage it evolved into.

It's available to download at libreoffice.org

Ms office is available to download 'at libreoffice.org'?

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#25

Post by piva00 »

vdfs wrote: post #16
foepys wrote: post #7

Earlier quoted context omitted.

It could lead to billions in fines for Microsoft. Up to 4% global revenue - for each EU country.

It's just the cost of doing business for them, implementing and complaining with EU laws might cost even more than the fine

The fine is so outrageously high (up to 4% of global revenue) exactly so this argument can't be made. It's really hard to imagine that implementing proper privacy controls would cost 4% of Microsoft's global revenue, it amounts to US$ 8B for the past year...

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#26

Post by baxtr »

throwaway294566 wrote: post #13
ofrzeta wrote: post #8

Earlier quoted context omitted.

We regularly discuss GDPR matters in our German company because there's a lot of FUD concerning the various cloud platforms and we have to cater to sensitive customers with our own hosting. One extreme is that you can't use AWS at all because of Schrems and it's a US compancy etc. On the other hand there's some hearsay about Microsoft (Azure) being tolerated because there's no way around it.

Imho, the "FUD" is largely right and most cloud platforms are indeed illegal. However, due to enforcement being absent or taking ages, there are too few legal decisions and big expensive enforcement actions that one can point to. Currently everything is really still fear, uncertainty and doubt, the hammer hasn't come down yet. I'm not sure if it ever will, at least not before EU institutions or other member states su…

And meanwhile German company Continental has just 40 TB of data from their own systems.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#27

Post by hef19898 »

bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

Rather MS will find a way to make Teams GDPR compliant, huge market and huge fines and all such.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#28

Post by eastbound »

throwaway294566 wrote: post #18
foepys wrote: post #7

Earlier quoted context omitted.

It could lead to billions in fines for Microsoft. Up to 4% global revenue - for each EU country.

It would really depend on the situation to be decided, whether MS would have to pay up, or rather the company using MS products to handle customer data. One can imagine a way to use MS products that might not be illegal, e.g. never use it to process personal data, use anonymized accounts that are not bound to a real person, swap around accounts and computers to prevent association with a person, etc. Then, all it wou…

That’s a good point: The use of general-purpose tools like Excel is by essence non-GDPR compliant, since there is no way to mark a column as “person” and therefore attach it to that person’s rights.

Therefore, all corporate tools must be specific for one purpose when managing PII, and no tool should allow free-text fields. Excel, Access, notepads shouldn’t exist in companies.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#29

Post by Kwpolska »

janmarsal wrote: post #6
ifeeltriedboss wrote: post #5

Earlier quoted context omitted.

And what would be the alternative? LibreOffice with its 90s UI/UX?

I wish I had ms office with its 90s UI/UX instead of whatever garbage it evolved into.

Office 95 works on Windows 11: https://www.youtube.com/watch?v=_jSfIroiFdA

So you can buy a copy of your favourite old Office version on eBay or whatever and use that.

Re: German privacy watchdogs conclude that Microsoft 365 is incompatible with GDPR

#30

Post by Bombthecat »

bayesian_horse wrote: post #3

This will have absolutely zero impact. Everybody knows you must use Microsoft products and if those don't comply with regulations, the regulations will have to change...

Agree,schrems II already paved the way what you need to do/ what needs to be done..

Basically separation of encryption and decryption key in a location other then azure for example.

Nobody cared, nothing happened. People still store both in azure.

As long no one gets fined ( here companies) nothing will happen

Post reply on HN