Windows 10 Enterprise and Office do not yet meet government privacy requirements
Windows 10 Enterprise and the mobile apps for Microsoft Office do not yet meet the conditions that the central government has set for the software. The operating system and programs were supposed to be modified, but not all software has yet.
The agreements that the government has made with Microsoft and the company’s promised changes have not yet been implemented for all products, according to a privacy impact assessment by Privacy Company. Commissioned by the Strategic Supplier Management Microsoft Rijk, this looked at the possible privacy-sensitive problems surrounding Microsoft’s software. That assessment was a follow-up to an earlier study that the SLM Rijk had commissioned. It found that some Microsoft software was not GDPR compliant and sent sensitive telemetry to the company.
As a result of the earlier audit, the government made agreements with Microsoft about new software. Now a new audit shows that the proposed improvements have not been implemented everywhere. That has happened with Office 365 ProPlus, which since version 1904 has more options for system administrators to minimize telemetry collection. However, this is not yet the case in Windows 10 Enterprise, Office Online, and the Office mobile apps.
In Office Online it is not possible to minimize data collection. At least three iOS mobile apps for Office collect data that goes to an American marketing company that specializes in predictive profiling, Privacy Company said. In addition, no information is given about the purpose of that data collection, and users and system administrators cannot prevent it. In Windows 10 Enterprise, telemetry is also collected, but according to the new audit this can be minimized by system administrators.
The audit is not an obligation for the government, but above all a recommendation. Privacy Company advises system administrators to stop using Office Online and the Office mobile apps, and to minimize data collection in Windows 10 Enterprise. It is not yet known whether the government will adopt the recommendations. A spokesperson for the Ministry of Justice and Security could not immediately answer that question.