Surf advises not to use Microsoft 365 Copilot for now due to privacy risks

Surf, the Dutch national educational IT institute, conducted a data protection impact assessment. The report itself: (also linked in the article)<p><a href="https:&#x2F;&#x2F;www.surf.nl&#x2F;files&#x2F;2024-12&#x2F;20241218-dpia-microsoft-365-copilot.pdf" rel="nofollow">https:&#x2F;&#x2F;www.surf.nl&#x2F;files&#x2F;2024-12&#x2F;20241218-dpia-microsoft-36...</a>

I gave a shot at reading their pdf report but honestly I gave up. I&#x27;m sure it&#x27;s a fine report but I really wanted some granular examples of active privacy problems, and I struggled to find them.<p>&gt;It is not clear what personal data Microsoft collects and stores about the use of Microsoft 365 Copilot. Furthermore, the information users receive when they make a request for access is incomplete and incomprehensible.<p>I&#x27;m guessing this is the core of the issue? Simply that they do not know what is going on behind the scenes?<p>I&#x27;m not disagreeing or agreeing, honest question.

The last few pages of the report summarizes the issues and mitigations. One mitigation is to use GPT-NL.<p>To be frank the report is exhausting to read and I gave up.

This report is a waste of public money. If you don&#x27;t understand the basic privacy risks of using Microsoft products within learning institutions, this 213-page report won&#x27;t help. The money spent on producing this report could have been better used on privacy awareness lessons for students, teachers, and staff.