In March last year, the Cloud Act passed in the US. A law that gives the US government access, under legally determined conditions, to US companies' data, even if the data is stored outside the US. Had the TU/e completely switched to Office 365 as planned last year, American security services could theoretically have gained access to e-mails, personal data and research data from employees.

One of the problems of the Cloud Act is that it clashes with the European privacy law GDPR, in which it states everyone’s right to know what is happening with their digital data. However, the Cloud Act explicitly states that the user is not told anything about access.

After Microsoft adjusted its policy in various areas in the meantime, the Executive Board now dares to switch slowly, starting with one department. For example, the company has provided the possibility to disable sending diagnostic data at the domain level (@tue.nl). Microsoft has also promised changes to contracts with the Netherlands to better meet the privacy legislation.

Ministry

A letter from the Dutch Ministry of Justice and Security to the House of Representatives sent Monday, announced that the GDPR objections are no longer an issue. Microsoft has also introduced options for administrators to minimize and verify the collected data.

Nicole Ummelen, Vice President of the Executive Board, says that she will “check this new information thoroughly. We will soon decide exactly how the implementation will take place, taking into account everything that has been said about it in the University Council."

The subject was discussed during the University Council meeting in mid-June and the Council advised the Executive Board to provide proper information on the inplementation of the system and on the safe handling of data, to provide a good alternative for 'vulnerable groups with privacy-sensitive data', and to only implement the system further if the doubts about safety have been sufficiently removed.

Privacy-sensitive data

Ummelen says that Pieter van Besouw, TU/e’s Office 365 project leader, is consulting colleagues from Mathematics & Computer Science as well as Chief Information Security Officer Martin Romijn to identify vulnerable groups with privacy-sensitive data and to explore possible solutions. "In the organization-wide implementation will also be plenty of attention for dealing with data and awareness about this."

The TU/e wants to switch to Office 365 because the current Office application is outdated and it is difficult to guarantee data security in the future. In addition, the Microsoft Teams application, which is part of Office 365, offers better opportunities for collaboration. This is for many teachers an important argument to make the switch. The TU/e students already switched to Office 365 in 2018. At the time, this was not reversed on the grounds that students had less sensitive data and that the risk would therefore be lower for them.

At Industrial Design they are happy with the pilot, says Jos Hermus, the department’s Director of Operations. "We had been in contact about this with the Information Management & Services Department for months and when we heard about a possible pilot, I immediately indicated that we would like to get started." The big advantage is that they can now use Microsoft Teams, Hermus states. “It allows you to create groups and share and organize information. That way we can work across different groups at ID. We used to do so via Sharepoint, but that had major limitations.”

Hermus says that the Department Board has made a conscious decision to let everyone switch now; both the scientists and the supporting staff. "I've had Office365 myself before, and it's annoying when you can get in, but not your secretary."

The employees do not have to switch though. Hermus: "If they don't want to, they can put their documents on a separate site, but then they can't use the Teams option and the extra storage capacity that Office 365 offers." The director of operations expects little resistance. “I have not heard any complaints yet. For us, the benefits are much greater than the possible disadvantages.” From this week on, employees will have access to the system and will get help from coaches to find their way in the new system. During the pilot, teething problems will be examined and points for improvement will be included in the planning for the implementation in other departments and services later this year.