Despite legal and other objections, Radboud University is continuing to roll out Microsoft365. It is, however, awaiting the advice of a VSNU committee and is closely following developments in the field of privacy rules.

Radboud University is continuing with preparations for the introduction of the Microsoft365 cloud service. Digital Security Professor Bart Jacobs recently explained that a solution for the legal objections in the field of privacy is currently being sought in the SURF context, the ICT collaboration between universities and other knowledge institutions. If that fails, ‘we will consider this within a SURF context.’ The university stated this in a written response to questions from Vox.

Since the beginning of 2019, the university has been working towards working ‘in the cloud’ via Microsoft software. According to a plan from February, the idea is that after implementation, students and employees can more easily access their files everywhere via Microsoft365 (formerly Office365), regardless of whether they work at home or on campus, from a PC or a tablet. Working together simultaneously on the same document should also be easier. Students, employees and external parties will receive the same type of ‘digital identity’: an @ru.nl account, which is shared with Microsoft.

Objections

That sounds efficient, but there are quite a few objections to the transition to Microsoft systems, Digital Security Professor Bart Jacobs recently told Vox. His main concern is that the collaboration with Microsoft is in violation of European privacy legislation, following a ruling by the European Court of Justice last June. A treaty between the EU and the US, which should protect the personal data of European citizens in the US, declared the Court ruling invalid. The privacy rules in the US are less strict than, for example, the GDPR legislation in the Netherlands.

Deciding not to go with Microsoft365 would also partially address another objection, Jacobs said, namely that universities are becoming increasingly dependent on tech giants like Microsoft and Google. That is not only a concern of Jacobs, but also of the universities themselves. The Dutch rectores magnifici published a joint open letter about it a year ago in the Volkskrant.

Collaboration not ended

Should the university still continue with Microsoft365? ‘The concerns that have been voiced still apply to the academic field,’ the university stated in a written response, because it is ‘a rather complex issue.’ ‘However, that does not mean that cooperation with organisations such as Microsoft should be terminated immediately or that ongoing projects should be stopped.’

According to the university, there is a great need for ways to collaborate better and more easily at a distance. In a so-called user needs survey, ‘many employees and researchers indicate that they would rather have access to Microsoft365 today than tomorrow.’

‘Depending on the advice of the VSNU committee, we will take further action’

Regarding the increasing dependence on tech companies, the university is awaiting an advisory report from a VSNU committee. Jacobs is one of its members. This committee was established in response to the open letter in de Volkskrant and will issue advice in the spring. Only then will the rollout of Microsoft365 begin in the university departments.

‘Depending on that advice, we will take further action,’ the university said. ‘The technical pilot for the introduction of Microsoft365 will start in January. This pilot will not be completed by the time the advisory report is issued.’

Rector Han van Krieken did not have time to respond personally as to whether the concerns he expressed in his opinion piece might not be as great as he imagined.

The university is also ‘closely following’ the developments regarding privacy, she writes. ‘At Radboud University, we want to limit the risk as much as possible when it comes to the data of our employees and students and / or research data.’

Privacy

The university is also ‘closely following’ the developments regarding privacy, she writes. ‘At Radboud University, we want to limit the risk as much as possible when it comes to the data of our employees and students and / or research data.’

President of the Executive Board Daniël Wigboldus indicated in his New Year’s speech how difficult the questions about Microsoft365 are. ‘For us as the executive board, the central question is not only how safe it is to use such a package, but also what the risks are if we don’t.’

That is why we are currently working on privacy issues in collaboration with other universities. The universities also study privacy legislation jointly. Any consequences for the design of Microsoft365 will be drawn in a SURF context, according to university spokesperson Anja van Kessel.

To this end, SURF has set up a ‘privacy shield task force’ to come up with alternatives that would still guarantee the protection of personal data; for example, by asking Microsoft to adjust certain agreements with universities. These so-called model contracts also regulate the protection of personal data in itself, but probably insufficiently, according to SURF experts. The question is whether Microsoft will or can go along with the necessary changes.

The European Union is also working on alternatives to Privacy Shield. If there is ultimately no legal basis for the processing of European personal data by an American company, the university writes in its response, the universities will consider this jointly. ‘The privacy of our employees and students remains paramount.’

‘No legal basis’

Professor of Digital Security Bart Jacobs is still concerned about the transition, he responds when asked. ‘SURF in fact confirms that as long as Microsoft does not amend the model contracts, there is no legal basis for Office365.’ All parties currently using Microsoft’s cloud system are involved, he emphasises, but Radboud University is in a different position because it hasn’t rolled out the system yet.

‘I keep wondering what would happens if a student or employee went to a Dutch court or submitted an enforcement request to the Dutch Data Protection Authority. There is a possibility that Radboud University would have to stop.’