MyAnalytics data protection: Microsoft knows where your free time is

Golem.de has acquired a license for Microsoft 365 for the editorial work. The package for corporate customers includes: Office 365 and several modules, including an analytics tool. A few weeks after the switch, an editor received an email with the subject “MyAnalytics | Wellbeing Edition”, Microsoft advertised: “Explore your habits. Work smarter” and whispered: “Only for you”, Then it started straight away: Under the heading “Your month in review: well-being” Microsoft pointed out that the editor just last month “1 quiet day” would have.

Why did the company know that? He just had that “Meeting, email, chat, and calling activities outside of working hours, as set in Outlook”, evaluated. On a calendar sheet, he clearly indicated that the quiet day was a Friday. Consequently, he answered the obvious question in his well-being email: “Find out where your time stays”, A switch to the personal dashboard is enough to see “who is on your network, how much you work after work and more”,

The notifications could be deactivated immediately. But how did it come about? The system administrator had not activated the function. Microsoft only announced in a few newsletters last year, most recently on July 23 that this feature should be rolled out for all users with an Exchange Online license. The functions were automatically active after the rollout.

For Thilo Weichert, who, as a former Schleswig-Holstein data protection officer, dealt with Office 365 and the question of data protection in companies early on, is clear: “That doesn’t work at all.” Because it is not understandable for those affected how the system comes to its results. The data processing goes far beyond what is necessary, and the basic settings of the system should provide for data-saving processing.

“Measuring the workforce”

“Measuring the workforce” has been an issue for works councils and unions for years. You have a say when it comes to collecting employee data. All data that serve to monitor behavior or performance are subject to co-determination. How far this can go can be specified in a company agreement.

The Hans Böckler Foundation has therefore published its own handout (PDF), in which it examines, among other things, the Microsoft Office package for the cloud. This was updated and continued with the dossier Automated Personnel Management and Co-determination of the non-governmental organization Algorithm Watch published on March 2, 2020, which was funded by the foundation.

The MyAnalytics tool can be deactivated in the admin center, but is activated by default. (Screenshot: Golem.de)

“What which user does with which software tool on which document or what he sends whom, everything is recorded”, the computer scientist Hein-Peter Höller and the employment law specialist Peter Wedde state here. This creates a social graph “gigantic size”, And not just for one company, but for everyone who uses Office 365.

Is that even possible under the GDPR? And what does Microsoft say about it?

–