Dutch government: Microsoft infringes GDPR rules with Office

The Dutch government is of the opinion that Microsoft is infringing the European General Data Protection Regulation (GDPR). The Dutch government has identified eight obstacles when it comes to the ProPlus subscriptions of Office 2016 and Office 365. There are also problems with the web version of Office 365.

The researchers state that Microsoft collects personal data on a large scale and secretly via Office telemetry. Microsoft does this without informing the users. For example, the researchers could not find any formal documentation about what information Microsoft collects through Office. Also, there was no way to disable this data collection.

Collecting normally?

The researchers did admit that collecting functional and diagnostic data is a common practice among software developers. But the researchers argue that they also discovered that Microsoft apps actually collect content from users. For example, subject lines of e-mails and sentences from documents were transferred to Microsoft’s servers. The latter happened when a user turned on the Office translation machine or game checker.

Despite the fact that Microsoft is trying to make the Office products comply with GDPR by storing the documents of EU residents on EU servers, Dutch telemetric data was transferred to American servers. That information could be requested by the U.S. government to carry out certain investigations.

The Dutch government is therefore concerned about this. For example, sensitive Dutch government documents could also be on the American servers. The government runs on more than 300,000 Office-apps computers. This is particularly annoying for the government, because the telemetry that Microsoft collects around Office is also more extensive than, for example, Windows 10.

Below is a table with all the risks that have been identified and what are possible solutions.

The Dutch researchers are already in contact with Microsoft, which is currently looking at the solutions offered by the researchers. In any case, it will apply solutions #1 and #2, and the company will look at #3 to #8 with the government. This would allow Microsoft to avoid a large fine.