Central government can continue to use Windows 10 and Office after AVG adjustments

The national government may continue to use Windows 10 without violating the GDPR. The government has made changes to Windows 10 Enterprise and Office Pro Plus so that they comply with the privacy law.

When using Windows 10 Enterprise in government, diagnostic data was collected from users and forwarded to Microsoft databases in the United States, it was discovered during an audit conducted by Strategic Vendor Management Microsoft Empire. During that audit, the SLM looked at the possible risks of using Windows 10 at the national government. There was fear that the operating system would forward user telemetry to Microsoft. Adjustments have now been made, Minister Grapperhaus of Justice & Security now writes to the House of Representatives.

When Microsoft Office Pro Plus is used in government, according to Grapperhaus, “diagnostic data from and about the users is collected and stored in a database in the US.” That would be against the General Data Protection Regulation. SLM has therefore implemented improvements together with Microsoft so that the government can continue to use the software. Microsoft has therefore offered a new version of both Office and Windows 10 Enterprise to the government.

For example, system administrators are given the option to “minimize” data, and to “verify collected data.” A certain amount of data is still being collected, but the biggest obstacle, according to the audit, was that there was ‘insufficient purpose limitation/base for authorized targets’. One of the obligations of the GDPR is that it must always be clearly established for what purpose data is collected. The government has therefore made additional agreements with Microsoft. This includes the purposes for which Microsoft collects data and how it is anonymized. It is also now prohibited to use the data for profiling, analysis and advertisements.

The government also requires that an annual audit be done to check whether Microsoft is still adhering to the agreements. The agreements only apply to government departments, independent administrative bodies such as the Chamber of Commerce or the CBR, and government agencies that are affiliated with the State Microsoft Business and Services contract.