Microsoft found to be taking a data slurp with Office Pro Plus 2106 and Office 365

[sigma]

https://www.privacycompany.eu/en/impact-assessment-shows-privacy-risks-microsoft-office-proplus-enterprise/

 

In summary:

 

On behalf of the Ministry of Security and Justice [Dutch Government], Privacy Company carried out a DPIA on DPIA on Microsoft Office ProPlus (Office 2016 MSI and Office 365 CTR). At the request of the Ministry, we publish this blog about the findings.

 

Large scale and covert collection of personal data

Microsoft systematically collects data on a large scale about the individual use of Word, Excel, PowerPoint and Outlook. Covertly, without informing people. Microsoft does not offer any choice with regard to the amount of data, or possibility to switch off the collection, or ability to see what data are collected, because the data stream is encoded. Similar to the practice in Windows 10, Microsoft has included separate software in the Office software that regularly sends telemetry data to its own servers in the United States. For example, Microsoft collects information about events in Word, when you use the backspace key a number of times in a row, which probably means you do not know the correct spelling. But also the sentence before and after a word that you look up in the online spelling checker or translation service. Microsoft not only collects use data via the inbuilt telemetry client, but also records and stores the individual use of Connected Services. For example, if users access a Connected Service such as the translate service through the Office software, Microsoft can store the personal data about this usage in so called system-generated event logs.

 

Microsoft as a (joint) controller and not as a data processor

 

Some residual risks can be mitigated if the government organisations will use the newly developed settings to minimise the processing of telemetry data. There are 6 remaining high risks for data subjects.

 

The unlawful storage of sensitive/classified/special categories of data, both in metadata and in, for example, subject lines of e-mails

The incorrect qualification of Microsoft as a data processor, instead of as joint controller as defined in article 26 of the GDPR

Insufficient control over sub-processors and factual data processing

The lack of purpose limitation, both for the processing of historically collected diagnostic data and the possibility to dynamically add new types of events

The transfer of (all kinds of) diagnostic data outside of the EEA, while the current legal ground for Office ProPlus is the Privacy Shield and the validity of this agreement is subject of a procedure at the European Court of Justice

The indefinite retention period of diagnostic data and the lack of a tool to delete historical diagnostical data

 

Admins of the Enterprise version of Office ProPlus can already take a number of specific measures to lower the privacy risks for employees and other people in the Netherlands.

 

Apply the new zero-exhaust settings

Centrally prohibit the use of Connected Services

Centrally prohibit the option for users to send personal data to Microsoft to ‘improve Office’

Do not use SharePoint Oneline / OneDrive

Do not use the web-only version of Office 365

Periodically delete the Active Directory account of some VIP users, and create new accounts for them, to ensure that Microsoft deletes the historical diagnostic data

Consider using a stand-alone deployment without Microsoft account for confidential/sensitive data

Consider conducting a pilot with alternative software, after having conducted a DPIA on that specific processing This could be a pilot with alternative open source productivity software. This would be in line with the Dutch government policy to promote open standards and open source software.

These measure are not in all cases realistic or feasible. It is not possible for the (Enterprise) customers of Office to solve all problems. With regard to the contracts and transfer of personal data to the USA, a European solution must be sought.

 

Full report in English : https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/rapporten/2018/11/07/data-protection-impact-assessment-op-microsoft-office/DPIA+Microsoft+Office+2016+and+365+-+20191105.pdf

[PotNoodleTech]

Cant trust anyone nowadays.