La polizia scozzese sta decidendo se usare Microsoft 365 è ok dal punto di vista della privacy, visto che in Regno Unito la legge per la protezione dei dati è molto simile al GDPR (e quindi richiede certe garanzie di trasparenza e valutazioni per il trasferimento dei dati in Paesi terzi) e ci sono regole aggiuntive in caso di dati della polizia.
ComputerWeekly ha scoperto che a prescindere dalla regione scelta i dati possono essere acceduti da personale in 105 Paesi e da 148 sub-processor, tra cui circa 70 non in possesso del requisito di adeguatezza in termini di norme privacy:
According to one list dated 11 November 2024, there are around 70 countries that M365 data could be accessed from that hold no European or UK adequacy for law enforcement data. Outside of the EU and EEA, the UK is the only country with law enforcement data adequacy.
All in all, an analysis of Microsoft’s distributed documentation – conducted by independent security consultant Owen Sayers and shared with Computer Weekly – suggests that Microsoft personnel or contractors can remotely access the data from 105 different countries, using 148 different sub-processors.
The tech giant also refused to disclose its own risk assessments into the transfer of UK policing data to other jurisdictions, including China and others deemed “hostile” in the DPIA documents. This means Police Scotland and the SPA – which are jointly rolling out Office 365 – are unable to satisfy the law enforcement-specific data protection rules laid out in Part Three of the Data Protection Act 2018 (DPA18), which places strict limits on the transfer of policing data outside the UK.