"The EDPS, the EU’s data watchdog, opened an investigation in April to assess whether contracts between Microsoft and EU institutions such as the European Commission fully complied with the bloc’s data protection rules."
Are these contracts signed before GDPR? Signed after?
Is there some part of the EU that you can submit a contract and that they go thru and raise any compliance issues that you should change? Or is it, do you best, and possibly get a knock on the digital door by the EU at a later date and a backdated fine?
Hard to form any opinion about this without knowing when the contracts got signed (by both parties) and how changes in law affect existing contracts from an accountability aspect (good/bad faith) on both sides.
Microsoft has contracts that are extremely overbearing so it is not surprising that their contracts might not comply with the law. There is of course a space (the legal department) and a profession (lawyers) that large institutions usually employ to monitor problems like these and I don't see why there needs to be another body that performs the same function.
Not all companies have Microsoft or indeed EU sized lawyer pools. So would be nice if there was some aspect of the EU that you could have check/audit contracts to approve them as compliant. Sure that may well be the realms of a lawyer and equally also insurance policy on the indemnity aspect. But does highlight how smaller companies will and can suffer the same issues (maybe more so) and fall foul even when acting in good faith.
"If your company, organisation or institution is established in the EU (In this case, the 28 EU member states + Iceland, Norway and Liechtenstein.), you have the right to compete for a public tender in any EU country. You have the right to:
compete for a public tender in another EU country without discrimination
use supporting documents (certificates, diplomas, etc.) issued by your country
have equal access to all information regarding tenders, regardless of the EU country in which you are established
have access to the review procedures in the respective country"
That last one implies that equally access to review procedures in EU member states must be available. That would cover contracts and with that, raises more questions about the accountability of this.
But my takeaway is, if Microsoft can have a contract questioned at a later date, how exposed are smaller companies in the same vain.
It's more a matter of: If you push your legal rights in such a contract to the absolute limits, well, you may run into some issues later on when laws change.
If you're a tiny company but you put maximum onerous one-sided rules in your contracts, AND you somehow have the government you're selling to by the short and curlies so they sign it anyway, yeah, this view of 'eh, microsoft has got it coming' would imply this small company is now on the hook for keeping a team of lawyers on the ball.
That seems fair to me.
In real life, there's no way a small company would even go for such a pushed contract in the first place, or if they did, that's because they messed up by copying the wrong contract text, or there's a big brother helping them out.
Or, perhaps said simply: If this notion of 'oops the rules changed right in the middle of the contract, that is not fair!' becomes relevant, they probably were.. NOT acting in good faith in the first place.
> If this notion of 'oops the rules changed right in the middle of the contract, that is not fair!' becomes relevant, they probably were.. NOT acting in good faith in the first place
That assumes a benevolent government. Rules can change because of balance-of-power shifts, or as a result of misinformed debates.
If you do business in a heavily-regulated economy like Europe, part of the cost of doing business is legal and compliance. This is a valid tradeoff the Continent has made. It makes many consumers and workers happy while adding fixed costs to commerce.
> that's true in any jurisdiction, right? Laws and regulations can always override contracts.
What varies is how easily new rules can be introduced, how easily they can be challenged, and the number of entities with rule making power.
Broadly speaking, Europe's systems make it easy for rules to be introduced and hard for them to be struck down by a competing arm of government. There also tend to be more regulators with independent rule making authority in Europe than in America.
This derives, fundamentally, from differing levels of trust in government, and differing views on the scope of government's job.
The rule (i.e. the GDPR law) was introduced by the european commission and parliament. It is applied by the various regulating agencies, interpreted by the courts and ultimately by the ECJ.
It is not like that governmental agencies are making up rules.
> It is applied by the various regulating agencies
I was making a broad statement about rule making processes in the Europe (EU and member states) versus Europe. That said,
GDPR is independently interpreted by each of the EU's member states. It is a complain-investigate regime that does not bind one member state to the other's precedents. That's a lot of leeway for regulatory variance.
divergence of rule interpretation is an issue, and harmonization is is the role of the ECJ (as final arbiter of interpretation) and ultimately the European legislative branch (for further harmonization).
Still, I do not see you go from that to "[it is] easy for rules to be introduced and hard for them to be struck down ".
edit: remember, the alternative is 28 potentially incompatible rules.
The page you're quoting is specific for public tenders, i. e. selling to governments across the EU. "review procedures" in this context is the ability to appeal those contract decisions.
For small companies not engaging in anything specifically nefarious (i.e. Cambridge Analytica) the real danger is really rather limited. If you read https://europa.eu/youreurope/business/dealing-with-customers..., which should take about 10 minutes, you will understand enough about the requirements to stay clear of any danger.
One common complaint is that the law isn't very specific. It sets out principles more than checklists. That is unfortunately necessary because it's impossible to anticipate every set of circumstances individually, and because technology is a fast-moving target no specific requirements ("use md5 hashing") could keep up with.
Yet if you've understood those principles ("don't collect data you don't need to provide the actual service/product the customer is buying" etc) and strive for the spirit of these rules you shouldn't have any problems.
"Are these contracts signed before GDPR? Signed after?"
Why would that matter? If the law changes, contracts may have to be updated. Microsoft is large enough to be in the "should have known the changes were coming, and should have acted upon it" camp.
"Is there some part of the EU that you can submit a contract and that they go thru and raise any compliance issues that you should change?"
Yes/No. On the one hand: NO, just like with (almost) all other laws and regulations in any government (or, for that matter, companies. You can't ask Apple or Google whether doing X will get your app on the App Store, for example). Allowing that would be impractical, as governments would be overwhelmed by entities looking to find exactly how far they can go before they get 'caught'.
Also, the ones to be fined, if any, in this case likely also, and maybe more so (as a, perhaps somewhat bad, analogy, there's nothing wrong with a North Korean company applying for some US defense contract; companies hiring them to do the work would be in the wrong) would be Microsoft's customers. Many of them also are large enough to be in the "should have known the changes were coming, and should have acted upon it" camp.
There's gonna be lots of those IMHO. GDPR will change a lot how IT companies manage their businesses and security as well. And I can't see American companies complying a lot with EU laws...Tense moment we live in.
Well, Microsoft used to offer its cloud services under license via German Telekom in Germany. They've sunsetted that offering though while announcing a Microsoft-owned GDPR-compliant server infrastructure in Europe.
They've yet to deliver on that announcement but that seems more like the usual delays than willful obstruction.
The obvious issue is that these contracts are already in place. It will be very difficult, if not impossible, for the eu to add such a contractual provision (especially of this significance) arbitrarily; they may have to wait until the contracts are re-negotiated.
What contractual position? It seems that any contractual term which is against the law would be null. I do not think that the law is (nor should be) subordinate to contract terms.
Why would it be difficult? Are you thinking of ex post facto doctrine? That really only applies to criminal penalties. A good, long-term contract should require that if some part of it is invalidated by changes to law (or a court finds that it violates existing law), then the parties can or must renegotiate that part but the rest of the contract survives, or alternatively that the entire contract becomes void if that's what the parties want. There really isn't a way to include a clause in a contract that says the parties are free to ignore changes in laws.
Contracts are designed in such a way that they remain in place if any parts of them are voided by law but they don't take precedence over the law even if the law changes after the contract was signed.
If slavery were legal today and abolished tomorrow, you couldn't keep your slaves just because they were signed into indentured servitude before the law came into effect.
What if the entire machinery known as "State" (govs, senates & assemblies, justice, agencies) realized that the logical long-term choice is to develop and maintain open-source software for pretty much anything they do, so as to effectively 1. enrich the 'national' or 'regional' wealth of all citizens and 2. contribute to technology in a historical way?
Nuance: I'd qualify the whole endeavor a 'mildly massive untertaking', it's not a switch but a decade-long effort. Bigger than the longest of usual "LTS". But the benefits, in terms of saved money (lower taxes?), quality of service (if any citizen can participate, whether as programmer or writer or evangelist or trainer or whatever), security (I'd wager there'd be enough eyeballs to proof this software), and probably 50 other externalities, like massive general training / jobs, better technical expertise of many state workers at every level, possible service to citizens (switching them off the customer status in some domains critical to democracy, especially when it's free thus they are the product), yadi yada.
The State could be an excellent digital host for itself, and a great steward for its population, if it addressed the technological matter in a professional way, with the right heart and the right mind.
If executed superbly, it could qualify as some "8th wonder", the first digital and truly collective one, to ever be built. A true hallmark of the 21st century. And we can all, all of us worldwide, participate to make a master; then proceed to fork based on our local systems —political and technical— and cultural preferences.
I hope I do not have to explain why I'm a little jaded, a feeling of too much deja vu and not enough 'tomorrow', when I read such ethical yet misguided fights. /understanding rant
EU, you have your heart in the right place, your ethics are fair and much needed in this world, but at our current pace your solutions seem ancient —so 20th century. Think 2030+ now and begin building long-term, towards a definitive solution. Move the needle, redefine things, fail/break the old stuff to make room for contemporary greatness. OSS for public software is a low hanging fruit, however giant, and you'll do the world a fantastic service worthy of your wealth and values.
Source of ideas: I am a concerned French citizen, and being born some 10,000 km away gave me a wider-than-Western-EU perspective of modernity, for some 37 years and counting.
I am myself quite baffled as to why governments don't embrace open source to a higher degree and - more importantly - enforce open standards (no, OOXML does not count, for obvious reasons).
> The State could be an excellent digital host for itself, and a great steward for its population, if it addressed the technological matter in a professional way, with the right heart and the right mind.
Given my past experience, that's a very big if, unfortunately. :-(
A case that deserves to be taken as an example of lobbying: the German city of Munich, which in 2003 started moving all desktop workstations to Linux, and by the end of 2012 reported a huge success with savings amounting to 11 million Euros, but in 2017 they announced they would migrate back to Windows, probably because of this:
https://www.novinite.com/articles/155950/Munich+Set+to+Becom...
On the doing-actual-work level, governments aren't really different from private companies, so one shouldn't expect dramatically different outcomes.
The idea that governments' actions should strive for some more idealistic goals isn't entirely wrong. But then again: why should we expect less from private citizens and corporations? They are just as much part of society, have rather more power to influence the software market, and tend to have more money to spent (I've recently seen a government office still using CRT).
It's not entirely bad, not everywhere —some countries are quite advanced in that regard, notably in Europe. However I'm evoking a deeper system; i.e. creating the "software information system of states", automating the hell out of it, building some Amazon-like octopus of goodness at the service of everything public = property of all citizens.
Relevant buzzwords: State as an Open-source Service (StaaOS)
I share your concerns for gov efficiency; a common reasonable idea seems to make a "hybrid institution" e.g. create an independent agency run by citizens, with a governance model a la NGO / not-for-profit.
An ideal management, imho, would involve various 'captains' of the tech industry (I'd say there's a pool of at least 10,000 people fitting that bill on earth today, i.e. ~1 per mil., and I'm possibly low-balling it by orders of magnitude). The structure should definitely be mission-driven (probably architected much like a business). Several countries enjoy great success (in quality, cost, etc.) with such types of agencies.
Often because they don't have the required knowledge in house, so they hire consultants. And consultants will propose "safe" solutions = solutions that look good on paper and are easily defendable or quantifyable.
It's easier to defend a huge company like SAP, MS or ... than an unknown underdog. Even more so when that big corp often invites you to tech nights and similar learning opportunities whereas small opensource projects have no marketing budget to swoon, wine and dine those consultants.
This could be done well or badly. I think the biggest challenge would be competing with industry at hiring good employees. Another big challenge would be writing software that works for everyone (as governments are expected to do) rather than for a small subset of users (as businesses can do, at least at first).
There are things governments cannot do that private companies can: shut down and go away because you made product no one wants. Over time this applies a positive pressure on governments to accumulate junk - layoffs are unacceptable, costly, etc. It isn’t the ‘fault’ of government. It’s just that cleansing is necessary for quality And systems that do not allow for cleansing have junk perpetuate.
Governments cannot discriminate, which is the fastest way to trial product - targeting your most fertile customers and adapting. Therefore, they will be locked into massive waterfall-style design.
Governments cannot ignore edge-cases.
It makes it really hard, though I’ve noticed that lots of new gov.uk stuff and things like Id.gov are pretty good.
1. EU members signed contracts with Microsoft
2. EU changed the law
3. Contracts are not following the law.
Seems like a great way to have your cake and eat it too. Don’t like the contracts? Change the law (because you have the power to do so). Seems like something a dictator would do.
Remember, states (and multistates) are large collections of people. The people who are negotiating the contracts with companies are most likely several steps removed from the people who are making laws.
33 comments
[ 2.9 ms ] story [ 90.4 ms ] threadAre these contracts signed before GDPR? Signed after?
Is there some part of the EU that you can submit a contract and that they go thru and raise any compliance issues that you should change? Or is it, do you best, and possibly get a knock on the digital door by the EU at a later date and a backdated fine?
Hard to form any opinion about this without knowing when the contracts got signed (by both parties) and how changes in law affect existing contracts from an accountability aspect (good/bad faith) on both sides.
https://europa.eu/youreurope/business/selling-in-eu/public-c...
"If your company, organisation or institution is established in the EU (In this case, the 28 EU member states + Iceland, Norway and Liechtenstein.), you have the right to compete for a public tender in any EU country. You have the right to:
compete for a public tender in another EU country without discrimination use supporting documents (certificates, diplomas, etc.) issued by your country have equal access to all information regarding tenders, regardless of the EU country in which you are established have access to the review procedures in the respective country"
That last one implies that equally access to review procedures in EU member states must be available. That would cover contracts and with that, raises more questions about the accountability of this.
But my takeaway is, if Microsoft can have a contract questioned at a later date, how exposed are smaller companies in the same vain.
It's more a matter of: If you push your legal rights in such a contract to the absolute limits, well, you may run into some issues later on when laws change.
If you're a tiny company but you put maximum onerous one-sided rules in your contracts, AND you somehow have the government you're selling to by the short and curlies so they sign it anyway, yeah, this view of 'eh, microsoft has got it coming' would imply this small company is now on the hook for keeping a team of lawyers on the ball.
That seems fair to me.
In real life, there's no way a small company would even go for such a pushed contract in the first place, or if they did, that's because they messed up by copying the wrong contract text, or there's a big brother helping them out.
Or, perhaps said simply: If this notion of 'oops the rules changed right in the middle of the contract, that is not fair!' becomes relevant, they probably were.. NOT acting in good faith in the first place.
That assumes a benevolent government. Rules can change because of balance-of-power shifts, or as a result of misinformed debates.
If you do business in a heavily-regulated economy like Europe, part of the cost of doing business is legal and compliance. This is a valid tradeoff the Continent has made. It makes many consumers and workers happy while adding fixed costs to commerce.
that's true in any jurisdiction, right? Laws and regulations can always override contracts.
What varies is how easily new rules can be introduced, how easily they can be challenged, and the number of entities with rule making power.
Broadly speaking, Europe's systems make it easy for rules to be introduced and hard for them to be struck down by a competing arm of government. There also tend to be more regulators with independent rule making authority in Europe than in America.
This derives, fundamentally, from differing levels of trust in government, and differing views on the scope of government's job.
It is not like that governmental agencies are making up rules.
I was making a broad statement about rule making processes in the Europe (EU and member states) versus Europe. That said, GDPR is independently interpreted by each of the EU's member states. It is a complain-investigate regime that does not bind one member state to the other's precedents. That's a lot of leeway for regulatory variance.
Still, I do not see you go from that to "[it is] easy for rules to be introduced and hard for them to be struck down ".
edit: remember, the alternative is 28 potentially incompatible rules.
For small companies not engaging in anything specifically nefarious (i.e. Cambridge Analytica) the real danger is really rather limited. If you read https://europa.eu/youreurope/business/dealing-with-customers..., which should take about 10 minutes, you will understand enough about the requirements to stay clear of any danger.
One common complaint is that the law isn't very specific. It sets out principles more than checklists. That is unfortunately necessary because it's impossible to anticipate every set of circumstances individually, and because technology is a fast-moving target no specific requirements ("use md5 hashing") could keep up with.
Yet if you've understood those principles ("don't collect data you don't need to provide the actual service/product the customer is buying" etc) and strive for the spirit of these rules you shouldn't have any problems.
Why would that matter? If the law changes, contracts may have to be updated. Microsoft is large enough to be in the "should have known the changes were coming, and should have acted upon it" camp.
"Is there some part of the EU that you can submit a contract and that they go thru and raise any compliance issues that you should change?"
Yes/No. On the one hand: NO, just like with (almost) all other laws and regulations in any government (or, for that matter, companies. You can't ask Apple or Google whether doing X will get your app on the App Store, for example). Allowing that would be impractical, as governments would be overwhelmed by entities looking to find exactly how far they can go before they get 'caught'.
Also, there's the "Separation of Powers" thing (https://en.wikipedia.org/wiki/Separation_of_powers). That brings me to the YES: on the other hand, there is: https://en.wikipedia.org/wiki/Test_case_(law). It will cost you money, but, if you do it right, less so than when you go in full.
Also, the ones to be fined, if any, in this case likely also, and maybe more so (as a, perhaps somewhat bad, analogy, there's nothing wrong with a North Korean company applying for some US defense contract; companies hiring them to do the work would be in the wrong) would be Microsoft's customers. Many of them also are large enough to be in the "should have known the changes were coming, and should have acted upon it" camp.
They've yet to deliver on that announcement but that seems more like the usual delays than willful obstruction.
Sometimes laws might explicitly grandfather previous arrangements or provide transition periods, but that's not a given.
In the case of GDPR, of course grandfathering would render the law moot, but it did take many years from the law passing to becoming effective.
To make an example which is relevant to our field, if a law is passed making non-compete invalid, would you expect it to only apply to new contracts?
If slavery were legal today and abolished tomorrow, you couldn't keep your slaves just because they were signed into indentured servitude before the law came into effect.
What if the entire machinery known as "State" (govs, senates & assemblies, justice, agencies) realized that the logical long-term choice is to develop and maintain open-source software for pretty much anything they do, so as to effectively 1. enrich the 'national' or 'regional' wealth of all citizens and 2. contribute to technology in a historical way?
Nuance: I'd qualify the whole endeavor a 'mildly massive untertaking', it's not a switch but a decade-long effort. Bigger than the longest of usual "LTS". But the benefits, in terms of saved money (lower taxes?), quality of service (if any citizen can participate, whether as programmer or writer or evangelist or trainer or whatever), security (I'd wager there'd be enough eyeballs to proof this software), and probably 50 other externalities, like massive general training / jobs, better technical expertise of many state workers at every level, possible service to citizens (switching them off the customer status in some domains critical to democracy, especially when it's free thus they are the product), yadi yada.
The State could be an excellent digital host for itself, and a great steward for its population, if it addressed the technological matter in a professional way, with the right heart and the right mind.
If executed superbly, it could qualify as some "8th wonder", the first digital and truly collective one, to ever be built. A true hallmark of the 21st century. And we can all, all of us worldwide, participate to make a master; then proceed to fork based on our local systems —political and technical— and cultural preferences.
I hope I do not have to explain why I'm a little jaded, a feeling of too much deja vu and not enough 'tomorrow', when I read such ethical yet misguided fights. /understanding rant
EU, you have your heart in the right place, your ethics are fair and much needed in this world, but at our current pace your solutions seem ancient —so 20th century. Think 2030+ now and begin building long-term, towards a definitive solution. Move the needle, redefine things, fail/break the old stuff to make room for contemporary greatness. OSS for public software is a low hanging fruit, however giant, and you'll do the world a fantastic service worthy of your wealth and values.
Source of ideas: I am a concerned French citizen, and being born some 10,000 km away gave me a wider-than-Western-EU perspective of modernity, for some 37 years and counting.
> The State could be an excellent digital host for itself, and a great steward for its population, if it addressed the technological matter in a professional way, with the right heart and the right mind.
Given my past experience, that's a very big if, unfortunately. :-(
The idea that governments' actions should strive for some more idealistic goals isn't entirely wrong. But then again: why should we expect less from private citizens and corporations? They are just as much part of society, have rather more power to influence the software market, and tend to have more money to spent (I've recently seen a government office still using CRT).
But mandating open standards: yeah, totally.
Relevant buzzwords: State as an Open-source Service (StaaOS)
I share your concerns for gov efficiency; a common reasonable idea seems to make a "hybrid institution" e.g. create an independent agency run by citizens, with a governance model a la NGO / not-for-profit.
An ideal management, imho, would involve various 'captains' of the tech industry (I'd say there's a pool of at least 10,000 people fitting that bill on earth today, i.e. ~1 per mil., and I'm possibly low-balling it by orders of magnitude). The structure should definitely be mission-driven (probably architected much like a business). Several countries enjoy great success (in quality, cost, etc.) with such types of agencies.
It's easier to defend a huge company like SAP, MS or ... than an unknown underdog. Even more so when that big corp often invites you to tech nights and similar learning opportunities whereas small opensource projects have no marketing budget to swoon, wine and dine those consultants.
Governments cannot discriminate, which is the fastest way to trial product - targeting your most fertile customers and adapting. Therefore, they will be locked into massive waterfall-style design.
Governments cannot ignore edge-cases.
It makes it really hard, though I’ve noticed that lots of new gov.uk stuff and things like Id.gov are pretty good.
1. EU members signed contracts with Microsoft 2. EU changed the law 3. Contracts are not following the law.
Seems like a great way to have your cake and eat it too. Don’t like the contracts? Change the law (because you have the power to do so). Seems like something a dictator would do.