Windows 10: Microsoft Office in trouble in Germany due to GDPR

GHacks · Dec 1, 2022

Microsoft’s suite of productivity apps, Microsoft 365, is in hot water with German authorities due to an alleged incompatibility with the data protection laws of Germany and the rest of the European Union.

Microsoft has been in negotiations with Germany’s state and federal data protection authorities since 2020 about the compatibility of its 365 utility with the EU’s data protection laws. According to a report written by the Datenschutzkonferenz (DSK), Microsoft is still in breach of the General Data Protection Regulation (GDPR).

The main issue seems to be that under the GDPR, individuals under 13 years of age are not capable of consenting to data collection. Permission may be given by a guardian or other holder of parental responsibility for children under 16 years of age, but the law is clear about companies not being able to collect data from children younger than 13. The unofficial agreement with data collection is that should data be collected from a consenting adult, that person retains the agency to request that their data be deleted.

Unfortunately, while Microsoft 365 is incredibly useful in school situations, use of the utility requires users to consent to data collection. Particularly, the report highlights that ‘Many of the services included in Microsoft 365 require Microsoft to access the unencrypted, non-pseudonymized data.’*

*The quote above has been translated from the native German used in the report into English.

Microsoft, however, maintains that ‘We ensure that our M365 products not only meet, but often exceed, the strict EU data protection laws. Our customers in Germany and throughout the EU can continue to use M365 products without hesitation and in a legally secure manner.’

The DSK alleges that Microsoft is still in breach of the law because it has only changed the wording of its policy, not the implications thereof. The final word on the ruling thus far is that the ‘use of personal data of users (e.g. employees or students) for the provider's own purposes excludes the use of a processor in the public sector (especially in schools).’

The Founder of Tutanota, an encrypted email service, Matthias Pfau, delivered his opinion of the situation subsequent to the ruling: ‘It is unbelievable that American online services continue to trample on the European GDPR more than four years after it was passed... Instead of relying on voluntary cooperation, much harsher consequences must be drawn here; for example, by using completely different systems. Linux with Open Office is a very good alternative to which schools and authorities should switch immediately.’

If you’re not familiar with the software, click here for our first look at Microsoft 365.

Thank you for being a Ghacks reader. The post Microsoft Office in trouble in Germany due to GDPR appeared first on gHacks Technology News.

read more...

Brink · Dec 1, 2022

GDPR Compliancy with OneDrive and SharePoint

Microsoft is committed to helping our business customers comply with the General Data Protection Regulation (GDPR). Last month, and how we help businesses around the world, not just in Europe, take control, manage compliance, and avoid risk. Today we wanted to share how the OneDrive For Business and SharePoint have approached meeting these GDPR requirements.

Given the buzz around this significant new regulation, I sat down with several of our customers over the past few weeks and asked if they had any questions about how OneDrive for Business and SharePoint in Office 365 is helping them be compliant with GDPR. Here are some of the common questions they had.

How does Microsoft, with OneDrive and SharePoint, ensure that we have granular control over personal data including what is held, where the data is located, and how it will be used?

Office 365 with OneDrive and SharePoint allows people to store, share and work together on content. That content as well as end user information remains in the direct control of administrators and end users. This data is owned solely by the customer. Microsoft is only its custodian in providing the service as outlined in the Online Service Terms (OST) - more information here https://www.microsoft.com/en-us/licensing/product-licensing/products.asp. Administrators can set policies that control the lifecycle of this information independently of the lifecycle of the user account that the OneDrive is associated with. For example, this includes the ability to retain or delete OneDrive files after a user leaves the organization. Administrators can also set access and share policies that control how OneDrive content is accessed or used.

Administrators and users are also in direct control of user account and contact information. This information can be modified at-will using in-product functionality. For example, admins can force password updates or update a user's login information. This information is used to control access to OneDrive and can power experiences within SharePoint and all of Office 365.

Multi-Geo enables OneDrive in your tenant to span across multiple datacenter geographies and gives you the ability to store your employee's data at rest, on a per-user basis, in your chosen geo. Microsoft will not move the data unless directed by you. You can control where data resides on a granular level, specifically, on a per-user basis. Each user connects to the closest service front door, and always interacts with data in the geo where it’s stored at rest, whether they’re interacting with their own data in their own geo, or with someone else’s data stored in a different geo. This means even the smallest subsidiaries of a multinational organization can adopt Office 365 and still meet data residency requirements.

Finally, Microsoft is providing functionality to identify and manage data for the purposes of compliance with the GDPR. We offer a wide variety of features that organizations can use to implement their own policies for data access and management, including OneDrive and SharePoint data. For example, the Compliance Manager in Office 365 (Service Trust Portal) helps guide customers through preparatory steps they can take to improve their own GDPR readiness. Microsoft will provide detailed guidance on how to leverage Office 365, OneDrive and SharePoint functionality to manage and honor GDPR data subject requests (DSRs) by the GDPR deadline.

How do we ensure no data is held beyond retention and that once deletion of a record is requested that all copies of it, as well as backups, are in fact destroyed?
Simply put, the customer is in control:

The customer maintains control of the lifecycle of customer data and user-generated content. Admins and end users can add, modify, and delete data explicitly via well-known user interfaces or admin tools. Admins can set retention policies on OneDrive/SharePoint content (on a per-user basis). Data can be removed aggressively or preserved for longer periods.

Account data synchronized from Office 365 is used to determine, based on licenses, what experience the end user is entitled to. This data follows the lifecycle of the user. Admins can add, modify and delete user accounts, and those changes will be promptly reflected in OneDrive for Business.

Product and service usage data follows a controlled lifecycle designed to comply with GDPR data subject requests.

Finally, with Advanced Encryption with Customer Key, administrators can be confident that when they have offboarded their data, that Microsoft no longer has any access.

What is a DPIA and how do we ensure the security of the customer data?
A Data Protection Impact Assessment (DPIA) is a mandatory requirement according to Article 35 of the GDPR. In short, a DPIA serves to determine, for new assets or projects in the company, if compliance with 'privacy by design' and 'privacy by default' is met. Privacy by default simply means that the strictest privacy settings automatically apply once a customer acquires a new product or service. In other words, no manual change to the privacy settings should be required on the part of the user. There is also a temporal element to this principle, as personal information must by default only be kept for the amount of time necessary to provide the product or service.

Privacy by design means that each new service or business process that makes use of personal data must take the protection of such data into consideration. An organization needs to be able to show that they have adequate security in place and that compliance is monitored. In practice, this means that an IT department must take privacy into account during the whole life cycle of the system or process development.

Microsoft regularly conducts DPIAs of Office 365, inclusive of OneDrive and SharePoint.

We have designed tight controls and measures, technical and organizational, to protect customer data against accidental, unauthorized or unlawful access, disclosure, alteration, loss, or destruction. Some examples include:

We restrict physical data center access to authorized personnel and have multiple layers of physical security, such as biometric readers, motion sensors, 24-hour secured access, video camera surveillance, and security breach alarms.

We enable encryption of data both at rest and in transit between data centers and users. End User Pseudonymous Information (EUPI) is hashed following FIPS140-2 requirements.

We conduct internal privacy, compliance, security and legal review of all new commercial features, services, and processes.

Finally, services are independently verified to meet the applicable compliance framework set forth in our Online Services Terms (OST). This includes FedRAMP, SOC, and ISO, and many more.

What if there is a breach?
In the event of a breach, Microsoft will notify your organization’s admin to ensure as soon as a breach is detected. Organizations should also designate a privacy contact alias in Azure Active Directory who we may email in addition to notifying the admin. Office 365’s security and incident response program is in place to keep customers' data safe and to meet various requirements, including those set forth in the GDPR.

To learn more about GDPR and how Office 365 is helping protect you and your data visit the following resources:

Microsoft Trust Center

GDPR Compliance Center

Get GDPR compliant with the Microsoft Cloud

EU GDPR law and policies

Finally, make sure to check out the Safeguarding individual privacy rights with the Microsoft Cloud webinar with the Director of Microsoft 365, Alym Rayani on May 25th at 12 pm PST.
Click to expand...

Source: GDPR Compliancy with OneDrive and SharePoint - Microsoft Tech Community - 191126

Brink · Dec 1, 2022

Announcing GDPR Compliance Manager in Microsoft 365

The General Data Protection Regulation (GDPR), which began as a regulatory requirement, is increasingly seen as a long-term opportunity to establish greater trust with customers and further unlock employee collaboration and productivity in many businesses. The intelligent compliance solutions in Microsoft 365 help you assess and manage your compliance risks and leverage the cloud to identify, classify, protect, and monitor sensitive data residing in hybrid and heterogeneous environments to support GDPR compliance.

Updates in Microsoft 365—currently rolling out—help protect sensitive data and include:

Compliance Manager general availability for Azure, Dynamics 365, and Office 365 Business and Enterprise customers in public clouds.

Compliance Score availability for Office 365.

Azure Information Protection scanner general availability.

In addition to the updates announced today, capabilities in Microsoft 365 help to:

Protect sensitive data in apps and across cloud services.

Support data protection across platforms.

Provide a consistent labeling schema experience (in preview).

We’re also going to expand sensitive data types to include a GDPR template to consolidate sensitive data types into a single template.

tVNrilQy5YU

These Microsoft 365 updates and capabilities are designed to provide you with an information protection strategy to help with GDPR compliance.
“GDPR is coming. But with Microsoft’s information protection solutions, we will have a more efficient way to handle compliance.”
—Erlend Skuterud, chief information security officer for Yara
Assess and manage compliance risk with Compliance Manager

Because achieving organizational compliance can be very challenging, we suggest organizations periodically perform risk assessments to understand their compliance posture. Compliance Manager is a cross–Microsoft Cloud services solution designed to help organizations meet complex compliance obligations like the GDPR. The Compliance Manager is now generally available for Azure, Dynamics 365, and Office 365 Business and Enterprise customers in public clouds.
“Compliance Manager really adds great additional value for Microsoft Cloud services by providing insights on the relationships between regulation, processes, and technology,” stated IT manager Nick Postma from Abrona, a Dutch healthcare organization that helps clients on their journey to becoming strong and confident members of society through social partnerships.

Perform risk assessments with Compliance Score

Compliance Score—a Compliance Manager feature—enables you to perform ongoing risk assessments on Microsoft Cloud services with a risk-based score reference, giving you visibility into your compliance performance. Each control is assigned a risk weight based on the level of risk involved due to control failure, and as you implement and assess controls, you’ll see your score change. Compliance Score is currently available for Office 365 and will be rolling out to other Microsoft Cloud services soon.

Learn more about the key capabilities and updates for Compliance Manager and Compliance Score at our Tech Communityblog.

Protect sensitive data on-premises

Azure Information Protection scanner addresses hybrid and on-premises scenarios by allowing you to configure policies to automatically discover, classify, label, and protect documents in your on-premises repositories such as File servers and on-premises SharePoint servers. The scanner can be configured to periodically scan on-premises repositories based on company policies. Azure Information Protection scanner is now generally available.

Read “Azure Information Protection scanner” to learn more. To deploy the scanner in your own environment, follow instructions in this technical guide.

Protect sensitive data in apps and across cloud services

Since data travels through many locations—across devices, apps, cloud services, and on-premises—it is important to build the protection into the file so this protection persistently stays with the data itself. Azure Information Protection provides persistent data protection by classifying, labeling, and protecting sensitive files and emails.

Microsoft Cloud App Security (MCAS) can read files labeled by Azure Information Protection and set policies based on the file labels. For example, a file labeled as Confidential, with an associated policy of “do not forward or copy,” cannot leave your network via file sharing apps like Box.net or Dropbox. In addition, the service scans and classifies sensitive files in cloud apps and automatically applies AIP labels for protection—including encryption. To learn more about this feature, read “Automatically apply labels to sensitive files in cloud apps” and the related technical documentation.

Support for data protection across platforms

As part of our information protection vision, our goal is to cover all major device platforms. Building on our efforts to support non-Windows platforms, we are now previewing the ability to label and protect sensitive data natively, with no plugins required, in Office applications running on Mac devices. This enables Mac users to easily classify, label, and protect Word, PowerPoint, and Excel documents in a similar manner that you are used to with the Azure Information Protection client on Windows. Considering that a significant amount of sensitive information is in PDF format, as part of our ongoing partnership, we are in the process of working with Adobe to have the same consistent labeling and protection of PDFs available in Adobe Reader. As we deepen the integration of Azure Information Protection with Adobe, we’ll soon also enable native labeling and protection of PDFs using Adobe Acrobat Pro on Windows.

To learn more about these new information protection capabilities, visit the Enterprise Mobility + Security blog.

Consistent labeling schema experience now in preview

We are previewing a consistent labeling schema that will be used across information protection solutions in Microsoft 365. To start, this means that the same default labels will be used across both Office 365 and Azure Information Protection—eliminating the need to create labels in two different places.

The consistent labeling model also helps ensure that sensitive labels—regardless of where they were created—are recognized and understood across Microsoft 365, including Azure Information Protection, Office 365 Advanced Data Governance, Office 365 Data Loss Prevention, and Microsoft Cloud App Security. Learn more about the preview of the consistent labeling experience.
“Microsoft’s information protection capabilities help you protect and manage your sensitive data throughout its lifecycle—inside and outside the organization,” stated an analyst from KuppingerCole, an international and independent analyst organization headquartered in Europe.
Detect and classify personal data relevant to GDPR

The ability to automatically classify personal data is a critical part of helping you achieve your GDPR goals. Today, we have over 80 out-of-the-box sensitive information types that can be used to detect and classify your data. Soon we will provide a GDPR sensitive information type template to help detect and classify personal data relevant to GDPR. The upcoming GDPR sensitive information type template will help consolidate our sensitive data types into a single template—as well as add several new personal data types to detect (such as addresses, telephone numbers, and medical information).

To learn more about the current sensitive information types, read “What the sensitive information types look for.” To learn more about how to create and customize your own sensitive information types, read “Create a custom sensitive information type.”

For sensitive emails, Microsoft 365 enables users to collaborate on protected messages with anyone inside or outside the organization via Office 365 Message Encryption. To provide more flexibility over controlling and protecting personal information shared in sensitive emails, we are rolling out the new encrypt-only policy in Office 365 Message Encryption starting today. Read further about this and other updates in our Tech Community blog.

Get started on your GDPR journey with Microsoft 365

The Microsoft Cloud is uniquely positioned to help you meet your GDPR compliance obligations. Our cloud solution is built for power, scale, and flexibility. Microsoft 365 brings together Office 365, Windows 10, and Enterprise Mobility + Security—offering a rich set of integrated solutions that help you assess and manage your compliance risk by leveraging Artificial Intelligence (AI) to protect your most important data and streamline your processes with a sophisticated and holistic solution set.

No matter where you are in your GDPR efforts, the Microsoft Cloud and our intelligent compliance solutions in Microsoft 365 can help you on your journey to GDPR compliance. Learn more about how Microsoft can help you prepare for the GDPR and take our free online GDPR assessment. Get started with your organization’s information protection planning by downloading our free white paper and eBook.

—Alym Rayani, director of the Microsoft 365 team
Click to expand...

Source: Microsoft 365 provides an information protection strategy to help with GDPR

Brink · Dec 1, 2022

Get GDPR compliant with the Microsoft Cloud

The new General Data Protection Regulation (GDPR) is the most significant change to European Union (EU) privacy law in two decades. The GDPR requires that organizations respect and protect personal data – no matter where it is sent, processed or stored. Complying with the GDPR will not be easy. To simplify your path to compliance, Microsoft is committing to be GDPR compliant across our cloud services when enforcement begins on May 25, 2018.

GDPR is part of our holistic cloud compliance investments

We are committed to our principles of cloud trust – across security, privacy, transparency and compliance. We have a broad portfolio of cloud services that address the rigorous security and privacy demands of our customers, who comprise over 90 percent of Fortune 500 companies. As the GDPR enforcement begins, here is what else you can expect from us:

Technology that meets your needs – You can leverage our broad portfolio of enterprise cloud services to meet your GDPR obligations for areas including deletion, rectification, transfer of, access to and objection to processing of personal data. Furthermore, you can count on our extensive global partner ecosystem for expert support as you use Microsoft technologies.

Contractual commitments – We are standing behind you through contractual commitments for our cloud services, including timely security support and notifications in accordance with the new GDPR requirements. In March 2017, our customer licensing agreements for Microsoft cloud services will include commitments to be GDPR compliant when enforcement begins.

Sharing our experience – We will share Microsoft’s GDPR compliance journey so you can adapt what we have learned to help you craft the best path forward for your organization.

While Microsoft is committed to helping you successfully comply with the GDPR, it is important to recognize that compliance is a shared responsibility. New requirements – like greater data access and deletion rules, risk assessment procedures, a Data Protection Officer role for many organizations and data breach notification processes – will mean changes for your organization. When it comes to GDPR compliance, it’s not just European organizations that are affected, but also those outside of the EU who process data in connection with the offering of goods and services to, or monitoring the behavior of, EU residents. As such, it’s important to understand your obligations related to GDPR regardless of where your organization resides.

It will take time, tools, processes and expertise for you to comply with the GDPR. To do this, you need to make changes to your privacy and data management practices. And failure to do so could prove costly – as companies that do not meet the requirements could face reputational harm and substantial fines of 20 million euros, or 4 percent of annual worldwide turnover, whichever is greater.

The Microsoft Cloud can help

With the most comprehensive set of compliance offerings of any cloud service provider, the Microsoft Cloud is here to support your compliance initiatives. Our commitment to privacy is proven by our actions. Microsoft was the first enterprise cloud services provider to implement the rigorous controls needed to earn approval for our contractual model clauses governing the transfer of data outside of European Union. We were the first cloud provider to achieve compliance with ISO’s important 27018 cloud privacy standard. Microsoft Azure has 53 major certifications and attestations – more than any other major public cloud provider.

When it comes to security, Microsoft’s unique visibility into the evolving threat landscape can also help protect the data that moves through your systems. Our cloud footprint includes over 100 datacenters and more than 200 cloud services. We’re investing over $1 billion annually in security and using our global insights to identify threats and protect your data.

This focus on privacy and security reflects the belief that our business ultimately relies on the trust of our customers, and we work hard to earn that trust. That’s why Microsoft is committing to be GDPR compliant across our cloud services.

Visit the GDPR webpage on our new Microsoft Trust Center website to learn more about how the features and functionality of Azure, Dynamics 365, Enterprise Mobility + Security, Office 365 and Windows 10 will enable you to meet the GDPR’s requirements.

Partnering with you now and in the future

As the fast-approaching GDPR deadline draws closer, we look forward to working in close partnership with you on GDPR compliance. We will continue to share the resources, tools and solutions you need to help develop your own compliance plan. In March, we will announce the details of our contractual commitments in accordance with GDPR rules. In the coming months, we will hold workshops, and host webinars for all customers and partners. We will also expand our GDPR web pages in the Trust Center to address your needs and feedback. Because when it comes to preparing for the GDPR, Microsoft has your back.

Brendon Lynch
Chief Privacy Officer, Microsoft
Click to expand...

Source: https://blogs.microsoft.com/on-the-i...crosoft-cloud/

Windows 10: Microsoft Office in trouble in Germany due to GDPR

Microsoft Office in trouble in Germany due to GDPR

Microsoft Office in trouble in Germany due to GDPR

Microsoft Office in trouble in Germany due to GDPR

Microsoft Office in trouble in Germany due to GDPR - Similar Threads - Microsoft Office trouble

Trouble logging into Microsoft Office

Trouble logging into Microsoft Office

Trouble logging into Microsoft Office

Difference between English Germany and German Germany keyboards

Difference between English Germany and German Germany keyboards

Difference between English Germany and German Germany keyboards

Get GDPR compliant with the Microsoft Cloud

DNS is about to get into a world of trouble with GDPR

Announcing GDPR Compliance Manager in Microsoft 365