DPIA Microsoft Dynamics CRM

Ministerie van Justitie en Veiligheid DPIA Microsoft Dynamics CRM Data protection impact assessment on the processing of personal data with Microsoft Dynamics CRM Version 1.0 Date 23 February 2021 Status Final © 2021; Ministerie van Justitie en Veiligheid. Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toestemming van het Ministerie van Justitie en Veiligheid. 179410127 0025 0925 179410127 0025 0926 179410127 DPIA Microsoft Dynamics CRM | DRAFT REPORT | 23 February 2021 Colofon DPIA by Contact Project Name Authors Ministry of Justice and Security Strategic Vendor Management Microsoft (SLM Rijk) Turfmarkt 147 2511 DP Den Haag PO Box 20301 2500 EH The Hague www. rijksoverheid.nl/jenv 5.1.2e E 5.1.2e Dminvenj.nl T 5.1.2e DPIA report on Microsoft Dynamics CRM Privacy Company 5.1.2e 5.1.26 5.1.2e 5.1.2e www. privacycompany.eu 0025 0927 179410127 0025 0928 179410127 Change log Version Date Summary of input 0.1 20 August 2019 First draft, framework report 0.2 23 December 2019 | Update part A based on updated contracts 0.3 30 March 2020 Revision part A, including updated contracts and data collected from test scenarios.

Full rewrite 0.4 23 June 2020 Part A completed with more data sources, revisions where applicable based on new information, sent to Council of State for review 0.5 30 June 2020 Input Council added to part A, first draft of Part B, C, and D. 0.6 30 June 2020 Internal review 0.7 1 July 2020 Summary added 0.8 15 July 2020 Revision draft 0.9 27 August 2020 Added input from external supplier 0.92 22 September 2020 | Processed comments DPO Council 0.93 15 January 2021 Additional research on tracking pixel and telemetry in web interface. Review of the text. 0.94 5 February 2021 Split between report for the Dutch Council of State, and general report for publication 1.0 23 February 2021 Final 1A 14 April 2022 Final version for publication 0025 0929 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 CONTENTS Colofon Change log Summary Introduction Scope of this DPIA Out of scope Part A. Description of the Data Processing 1. 1.1. 1.2. 2.1. 2.2. 2.3. 2.4. 2.5. 2.6. 2.7. 2.8. 3:2. 3.3. 3.4. 4.1. 4.2. 5.1. 5:2: 5:3: 5.4. 5.5. 6.1. 6.2.

AA 8.1. 8.2. 9.1. 9.2. 9.3: 9.4. 10. Page 2 of 64 179410127 The Processing of Personal Data Generic data processing by Dynamics CRM Data processing through Microsoft Dynamics CRM by the Council of State Personal Data and Data Subjects Definition of personal data Categories of personal data in the content data Tracking pixel added to newsletters Dynamics activity logging: technical log files, audit tables and browser telemetry Classified information Personal data of a sensitive nature Special categories of personal data Categories of data subjects Processing of personal data via Dynamics CRM Customer processing of Content Data Customer processing of Diagnostic (personal) Data Microsoft processing of Diagnostic (personal) Data Purposes of the Processing Purposes determined by the Council of State Purposes determined by Microsoft Controller, Processor, and Subprocessors The role of the Enterprise customer as data controller The role of Microsoft as data processor Microsoft and the Dynamics Enterprise customers as joint controllers The role of Microsoft as (independent) data controller The role of other third parties Interests in the data processing Interests Dutch governmental organisations Interests Microsoft Transfer of personal data outside of the EU No overview of (sub-)processors outside of the EU Techniques and Methods of the Data Processing General processings within Dynamics CRM Processing through Microsoft Azure Active Directory Additional legal obligations: ePrivacy Directive Browser telemetry data Authentication cookies Tracking pixel Sending of newsletters Retention Periods 0025 rE MN W 0930 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 10.1.

Customer Data with Dynamics CRM as a cloud service 41 10.2. Diagnostic Data (Dynamics CRM on-premise and cloud) 41 Part B. Lawfulness of the data processing 43 11. Legal Grounds 43 11.1. Consent 43 11.2. Processing is necessary for the performance of a contract 43 11.3. Processing is necessary to comply with a legal obligation 44 11.4. Processing is necessary for a task in the public interest or for the legitimate interests of the controller or a third party 45 12. Special categories of personal data 46 13. Purpose limitation 47 13.1. Purposes of the Council of State 47 13.2. Purposes for which Microsoft processes personal data 48 14. Necessity and proportionality 49 14.1. Assessment of the subsidiarity 49 14.2. Assessment of the proportionality 50 15. Rights of data subjects 51 15.1. Right to information 54 15.2. Right to access 51 15.3. Right of rectification and erasure 52 15.4. Right to object to processing, including profiling 52 15.5.

Right to data portability 53 15.6. Conclusion 53 Part C. Discussion and Assessment of the Risks 54 16. Risks 54 16.1. Identification of risks 54 16.2. Assessment of risks related to government organisations 55 16.3. Assessment of risks related to Microsoft 55 16.4. Assessment of risks specific to the Council of State 58 16.5. Summary of risks 59 Part D. Description of risk mitigating measures 61 17. Risk mitigating measures 61 17.1. Measures to be taken by the government organisation and Microsoft to mitigate high risks 61 17.2. Assessment of risks after taking mitigating measures 62 Conclusion 64 Page 3 of 64 0025 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Summary This report, commissioned by SLM Microsoft Rijk, contains the Data Protection Impact Assessment (DPIA) on the use of Microsoft Dynamics Customer Relationship Management (CRM). This assessment of the Dynamics software is based on inspection of the specific implementation of the system at the Dutch Council of State (the Council).

The Council uses Dynamics CRM to organise its external relations and send newsletters and mailings with invitations for events with the marketing module. This public version of the DPIA does not contain confidential information about the specific implementation and data protection risks at the Council. Outcome: five high data protection risks The outcome of this DPIA is that the investigated use of Microsoft Dynamics CRM leads to four high data protection risks and three low data protection risks for data subjects. In this summary only the risks that are likely to be present for all or many government organisations are included. These four high risks are due to the following circumstances: ° Every activity in the CRM database can be stored in audit tables, if the admin enables this logging, which is often necessary in order to be able to correct mistakes and investigate data breaches. When a user deletes a contact from the database, for example because an individual withdraws consent, or because the retention period has expired, the audit table stores what employee has performed the activity as well as all content data.

Thus, the content data are not completely deleted. . If a government organisation processes special categories of data through Dynamics CRM, such special categories of data are also stored in the audit tables, potentially violating the prohibition of processing of special categories of personal data when no exception to the prohibition applies. ° System administrators can decide to turn on the audit tables, but they have limited influence over the retention period of data in the audit tables. This implies a risk of processing of personal data after they are no longer necessary for the purpose for which they were collected. ° Data subjects cannot exercise their rights. A data subject access request to Microsoft has remained unanswered, also after the sending of reminders. e By default, Microsoft includes a tracking pixel in the mailings that are sent through the marketing module. With this tracking pixel, government organisations can see what individual recipients opened the mailing and when they did.

Based on the ePrivacy Directive, as implemented in the Dutch Telecommunications Act, the use of such a tracking pixel requires prior informed consent from the recipients. During this DPIA, Microsoft added a technical possibility to turn off the tracking pixel for all or for individual recipients, but the effectivity of this update could not be tested at the Council. Use of a tracking pixel without consent from the mail recipient leads to a high risk for data subjects. ° Dynamics CRM collects Diagnostic Data for which no documentation is provided by Microsoft, which makes it impossible for the government organisation to properly inform the data subjects of the processings. ° Microsoft collects Diagnostic Data about the use of Dynamics CRM, even in deployments that are not hosted by Microsoft, through a JavaScript library. This processing is not documented. Page 4 of 64 0025 0932 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 The high risks and the proposed mitigating measures for government organisations and for Microsoft are listed in the table below: about the processing of logging data.

Risk | High risk Measures Council of Measures Microsoft no. State 1 Possible unlawful Review the lawfulness Create an option to further processing of of special categories of | keep specific fields special categories of data being included in from storage in audit data in audit tables. the audit tables, or: tables. Stop using the audit tables for these data. 2 Tracking pixels require Update Dynamics CRM consent. to include GDPR options and switch off use of tracking pixels in newsletters. 4 Inability to exercise Perform a specific audit | Update procedures to data subject rights. on whether Microsoft ensure that data acts according to the subject rights are agreed contractual respected and requests measures. from data subjects are followed up properly. 5 Lack of transparency Provide detailed documentation about the meaning of all Diagnostic Data collected. Deactivate by default the JavaScript library, or: Provide detailed documentation about the content and purposes of the data processing through the JavaScript library Umbrella DPIA versus individual DPIAs This umbrella DPIA was conducted for SLM Microsoft Rijk, the central negotiator for Microsoft products and services for Dutch central government organisations.

However, the individual government organisations buy the licenses and determine the settings and scope of the processing by Microsoft. Therefore, while this general umbrella DPIA can help the different government organisations with the DPIAs they must conduct, it cannot replace the specific risk assessments the different government organisations must make. Only the organisations themselves can assess the specific data protection risks, based on their specific deployment, their purposes for processing, the level of confidentiality of their work, and the types of personal data they process. Page 5 of 64 0025 0933 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Approach: legal and technical analysis This umbrella DPIA is based on a combination of a legal and a technical analysis. The legal analysis is based on the specific terms and conditions negotiated by SLM Microsoft Rijk for the central Dutch government.

Additionally, the Council has used an external supplier. The implementation plan was used to understand the nature and volume of the data processing. To examine the factual data processing, a number of scripted scenarios was executed. Afterwards, the audit logs and audit tables were analysed to determine what input led to what recorded data. Conclusion If Microsoft and the government organisations apply the recommended risk mitigating measures in this DPIA, all identified high risks can be reduced to low risks. Page 6 of 64 179410127 0025 0934 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Introduction Microsoft Dynamics CRM is a customer relationship management system that helps organisations to manage their relations. This report, commissioned by the Microsoft Strategic Vendor Management office (SLM Microsoft Rijk!) of the Ministry of Justice and Security, is a data protection impact assessment (DPIA) about Microsoft Dynamics CRM.

The DPIA has been executed using the implementation at the Dutch Council of State (the Council) as a basis for factfinding. DPIA Under the terms of the General Data Protection Regulation (GDPR), an organisation may be obliged to carry out a data protection impact assessment (DPIA) under certain circumstances, for instance where it involves large-scale processing of personal data. The assessment is intended to shed light on, among other things, the specific processing activities, the inherent risk to data subjects, and the safeguards applied to mitigate these risks. The purpose of a DPIA is to ensure that any risks attached to the process in question are mapped and assessed, and that adequate safeguards have been implemented to mitigate those risks. A DPIA used to be called PIA, privacy impact assessment. According to the GDPR a DPIA assesses the risks for the rights and freedoms of individuals.

Data subjects have a fundamental right to protection of their personal data and some other fundamental freedoms that can be affected by the processing of personal data, such as for example freedom of expression. The right to data protection is therefore broader than the right to privacy. Consideration 4 of the GDPR explains: “This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity”. This DPIA follows the structure of the DPIA Model mandatory for all Dutch government organisations.

Umbrella DPIA versus individual DPIAs The Dutch government organisations frequently make use of Microsoft software, including the Dynamics CRM system. Because the data processing takes place on a large scale, and the data processing involves data about the communication (be it content or metadata) and involves data that can be used to track the activities of employees, it is mandatory for the Dutch government organisations in the Netherlands to conduct a DPIA based on the criteria published by the Dutch data protection authority.2 The European national supervisory authorities (hereinafter referred to as the Data Protection Authorities or DPAs), united in the European Data 1 Model Gegevensbeschermingseffectbeoordeling Rijksdienst (PIA) (September 2017). For an explanation and examples (in Dutch) see: https://www.rijksoverheid.nl/documenten/rapporten/2017/09/29/model- gegevensbeschermingseffectbeoordeling-rijksdienst-pia. 2 Dutch DPA, list of processings for which a DPIA is required, in Dutch only, Besluit inzake lijst van verwerkingen van persoonsgegevens waarvoor een gegevensbeschermingseffectbeoordeling (DPIA) verplicht is, URL: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/stcrt-2019-64418. pdf Page 7 of 64 179410127 0025 0935 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Protection Board (EDPB) published a list of 9 criteria.

As a rule of thumb, if a data processing meets 2 of these criteria a DPIA is required.3 In GDPR terms SLM Microsoft Rijk is not the data controller for the processing of Diagnostic Data via the use of the Dynamics software. The data controller is the individual government organisation that offers the use of the Dynamics software to its employees. However, as central negotiator with Microsoft, it has a responsibility to assess the data protection risks for the employees and negotiate for a framework contract that complies with the GDPR. Therefore, SLM Microsoft Rijk commissions umbrella DPIAs to assist the government organisations to select a privacy-compliant deployment and conduct their own DPIAs where necessary. Only the organisations themselves can assess the specific data protection risks, related to the technical privacy settings, nature and volume of the personal data they process, and vulnerability of the data subjects.

This umbrella DPIA is meant to help the different government organisations with the DPIA they must conduct, but this document cannot replace the specific risk assessments the different government organisations must make. Scope of this DPIA The scope of this DPIA is limited to the personal data processed in and about the use of the on-premise Dynamics 365 server as deployed by the Council, with access through a browser on a Windows 10 desktop. The effects of authentication through the Azure Active Directory have been investigated previously in the Microsoft Office 365 DPIA and have not been extensively revisited for the purposes of this DPIA. The term on-premise has different meanings. It can be used if an organisation hosts the software on a server on its own physical premises, but Microsoft also uses this term if an organisation implements Dynamics 365 on a server of its own choosing, including servers in the cloud.

The Council uses this latter option. Out of scope The following types of data processing are out of scope of this DPIA: ° Microsoft Dynamics 365 as a cloud service and related Microsoft server- generated system logs. ° Microsoft Account Data. ° Microsoft Support Data (through a separate Professional Services contract). ° Dynamics 365 Customer Insights. e Dynamics 365 Fraud Protection. . The effectivity of the new privacy choice to disable the tracking pixel in newsletters sent through Dynamics. ° Optional monitoring features that must be specifically switched on or that require the customer to install add-ons to Dynamics CRM. Technical research Privacy Company has written test scenarios for the use of Dynamics CRM. The scenarios were written to imitate the average activities of a government administrator to add or delete personal contact data from the database. The test scenarios were executed on a desktop computer with Windows 10 Enterprise, in the default work configuration at the Council with the on-premise Dynamics 365 server, with an Edge 3 The EDPB has adopted the WP29 Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, WP248rev.01, 13 October 2017, URL: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item id=611236 Page 8 of 64 179410127 0025 0936 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 browser.

The test scenarios were executed twice (in August and October 2019), to take changes of the configuration into account. Privacy Company obtained access to some of Microsoft’s Dynamics logs in February 2020, and access to the audit tables in June 2020. Privacy Company asked the Council to check the functioning of the new option to turn off the tracking pixel in the marketing module in July 2020. Unfortunately, the Council was not able to upgrade its version of Dynamics CRM (9.1.0000.22242) in time to test the effectivity of the new privacy choice. In September 2020, Privacy Company conducted a further check on the use of cookies on the log-in page. This resulted in the finding that Microsoft collects telemetry data through the browser. Timeline of this DPIA This data protection impact assessment was carried out by Privacy Company as commissioned by the Dutch ministry of Justice and Security between April 2019 and February 2021.

It builds on previous assessments carried out for other Microsoft products used by the ministry and uses the privacy-improved version of the ministry's framework contract with Microsoft. The process of compiling and writing this DPIA was slow, with numerous setbacks, and reconfiguration of the test set-up. In August and October 2019, the test scenarios were executed on the test implementation at the Council and a data subject access request was filed with Microsoft. No answer to this request was ever received, nor did Microsoft notify the data controller of the request. In May 2020 it became apparent that the external supplier had access to more log files and audit tables than previously discovered. These were provided to Privacy Company in June 2020, resulting in a draft version of this report provided to the Council in July 2021. Over the course of Q3 2020 additional data processings have come to light after additional inquiries were made.

The processings were analysed and recorded in a final report in February 2021. Outline This Data Protection Impact Assessment assesses the use of Microsoft Dynamics by Dutch governmental organisations. In addition, a specific use case of the Council is assessed. The Council intends to use Dynamics CRM for contact relationship management purposes. The Dutch government DPIA-model uses a structure of four main divisions, which are reflected here as “parts”. Description of the factual data processing Assessment of the lawfulness of the data processing Assessment of the risks for data subjects Description of mitigation measures UNO P Part A explains the Dynamics CRM solution, both in general terms and in the specific case of the Council. This part starts with a description of the way the data are collected and describes the categories of personal data and data subjects that may be included in the processing; the purposes of the data processing; the different roles of the parties involved; the different interests related to this processing; the locations where Page 9 of 64 0025 0937 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 the data are stored, and the retention periods.

Part A also lists all relevant legal documents that govern the processing of data within Dynamics CRM and the way they impact each other. Part B provides an assessment by Privacy Company, with input from the Ministry of Justice and Security and the Council, of the lawfulness of this data processing through Dynamics CRM. This analysis starts with an overview of the extent to which the GDPR and the ePrivacy Directive apply to these processings, in relation to the legal qualification of the role of Microsoft as provider of the software and services. Subsequently, part B provides an assessment of the conformity with the key principles of data processing, including transparency, data minimisation, purpose limitation, and the legal ground for the processing, as well as the necessity and proportionality of the processing. In this section the legitimacy of any transfers of personal data to countries outside of the (European Economic Area (EEA) is separately addressed, as well as how the rights of the data subjects are respected.

Part C assesses the risks to the rights and freedoms of the data subjects caused by the processing activities identified in Dynamics CRM in Part A of this DPIA. It names specific risks that derive from these processings and aims to specifically determine both the likelihood that these risks may occur, and the severity of the impact on the rights and freedoms of the data subjects if the risks occur. Finally, Part D contains concrete measures that can be taken by either Microsoft or the individual governmental organisations to mitigate these risks. These measures might either reduce the chance the risks occur, or the impact they might have, or both. Part D also contains an assessment of any residual risk attached to the use of Dynamics CRM, that could not be mitigated by applying the suggested measures. If such unmitigated risks remain, the Council might be required to consult the supervisory agency prior to the processing.

Page 10 of 64 0025 0938 179410127 1.1. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Part A. Description of the Data Processing This first part of the DPIA provides a description of the data processing by Microsoft Dynamics CRM as implemented by the Council. The Processing of Personal Data Generic data processing by Dynamics CRM Microsoft Dynamics 365 was developed by Microsoft as a group brand of Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) applications. Specific Microsoft Dynamics 365 solutions are available for Sales, Customer Service, Field Service, Talent, Finance and Operations, Retail, Project Service Automation, Marketing, Artificial Intelligence, Mixed Reality, and Business Central.* Microsoft Dynamics can be used in combination with other Microsoft programs and services, such as SharePoint, Yammer, Office 365, Azure, and Outlook.

To enable this combination, Dynamics is based on the so-called “Common Data Model” (CDM).5 This means that the data are entered and maintained in a standardised format, enabling the use of data across many different applications. Additionally, each app may have its own data and schemas, depending on its functionalities.® There are three main options in the deployment of Microsoft Dynamics 365: Customers can choose between deploying the software in Microsoft’s cloud (resulting in the deployment as a Software-as-a-Service (SaaS) solution), on a partner-hosted cloud chosen by the customer, or on the customer’s premises.’ A hybrid of on-premise and server-hosted deployment is also possible. This DPIA examines the risks to the rights and freedoms of data subjects of the use of Microsoft Dynamics CRM. Microsoft recently re-branded the Dynamics CRM product as “Microsoft Dynamics 365 for Customer Engagement”.® Microsoft Dynamics CRM provides an operating platform to manage customer relationships for first contact, purchase, and post sales.

It is highly customizable.?® This report addresses the data protection risks of the processing of two kinds of personal data: the content data actively stored in the database, that Microsoft calls Customer Data, and the metadata on the individual (employee) use of the database. These metadata (about the use of the services) are called ‘Diagnostic Data’ in this report. Technically, Microsoft collects Diagnostic Data about the way users use the tool in multiple ways. Through telemetry in JavaScript in the browser, via log files created on the on-premise server, and via system-generated event logs on its own servers, for example with regard to the use of the Azure Active Directory. Microsoft 4 Microsoft Dynamics Homepage, Applications, URL: https://dynamics.microsoft.com/en-us/. 5 Microsoft, What is the Common Data Model?, undated. URL: https://dynamics.microsoft.com/en-us/microsoft-power-platform/common-data-model/. 6 Microsoft, The Common Data Model, 11 February 2020, URL: https://docs.microsoft.com/en-us/common-data-model/ . ?

365 Licensing Guide, July 2019 p. 9, URL: https://mbs.microsoft.com/Files/public/365/Dynamics365LicensingGuide. pdf. ® Microsoft Dynamics CRM Forum, Question from November 1, 2018: “Is Microsoft re-branding Dynamics CRM 365 to Microsoft Dynamics 365 Customer Engagement? So no CRM any more?”, URL: https://community.dynamics.com/crm/f/117/t/299853. ° Microsoft, What is CRM? undated, URL: https://dynamics.microsoft.com/en-us/crm/what-is- crm/. Page 11 of 64 0025 0939 1.2. 2.1. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 thus collects Diagnostic Data about the use of Dynamics CRM regardless of whether it is used as a cloud service, or as hosted on the servers of the tenant. Data processing through Microsoft Dynamics CRM by the Council of State The Council is planning to use Dynamics CRM specifically for relationship management purposes and in particular for sending invitations for events to its relations by email.

For this purpose, the Council will be using the marketing module of Dynamics CRM and the layer on top of Dynamics CRM, developed by an external supplier. The scope of this DPIA covers the use of Dynamics CRM by the Council and includes: e The role and purposes of Microsoft as provider of the Dynamics CRM services. e Any transfer of personal data, both via content and log files, to countries outside of the European Economic Area. e The processing of Diagnostic Data on the use of Dynamics CRM by the Council, its contractors, as well as by Microsoft Corporation. e The processing of authentication data via the Azure AD. e The use of a tracking pixel in the newsletter. e The use of cookies on the log-in page for Dynamics. e The collection of telemetry data through the browser when using the web interface. e The processing of content data by the Council, including through Dynamics CRM-plugins that are not provided by Microsoft. e Validation of personal data with external non-Microsoft services, such as webservices.nl. e The exercise of data subject rights.

Personal Data and Data Subjects The Dutch government DPIA model requires that this section provides a list of the kinds of personal data that will be processed, and per category of data subjects, what kind of personal data will be processed by the product or service for which the DPIA is conducted. To help readers that are not GDPR experts understand the data protection risks, this section explains in detail why the stored Diagnostic Data about the use of the Dynamics CRM software are personal data as defined in Article 4 (1) GDPR. The different kinds of data that Microsoft processes via Dynamics CRM will be described in more detail in Section 3 of this DPIA, Processing of personal data via Dynamics CRM. Definition of personal data According to Article 4 (1) (a) GDPR, “personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

This umbrella DPIA can only indicate types of personal data and types of data subjects that may be involved in the processing, but cannot assess the specific risks of the actual data processing per organisation that uses or will use the Dynamics CRM software, outside of the Council's use case. The risks for data subjects strongly depend on the privacy choices and settings that each organisation makes, as well as on the nature of the work performed by their employees. Page 12 of 64 0025 0940 179410127 2.2. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 This DPIA focuses on the Diagnostic Data that are generated by the software, and all personal data specifically used as part of the Council’s implementation of Dynamics CRM. This umbrella DPIA provides a description of the possible kinds of content data that government organisations may process in Dynamics CRM. In the implementation at the Council, the use of Dynamics CRM concerns two groups of data subjects: (i) the individuals whose data are entered into the application (the relations of the Council and their partners), and (ii) the employees of the Council working with the CRM application.

Categories of personal data in the content data The personal data visibly and intentionally collected through the interface of Dynamics CRM in the implementation at the Council include: . Name ° Titles (hereditary, academic, etc). ° Gender . Language e Address e Sensitive private contact details, including secret phone numbers, mail addresses and private addresses e Email address ° Phone number e Photo ° Social media accounts e Employer (possible special category) e Department e Function . Side activities and positions ° Contact preferences ° Lead status e Notes* e Tasks e Contact type . Calendar-items e Conversations ° Messages e Diet* e Allergies* . Activities (historical transactions on the contact’s information) e Properties* e Related persons (link to another person’s records) Every record in Dynamics CRM contains the following metadata: e Date created . Date updated e Username ° Password ° Account setting “These types of data might include special categories of personal data (see Section 2.7 of this report) In the Enterprise contract for Online Services, Microsoft uses the definition of Customer Data for all data that are actively provided by Customers.

Customer Data Page 13 of 64 0025 0941 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 do not include the metadata. However, based on the specific privacy amendment negotiated by the Dutch government, all personal data, including all Diagnostic Data, are covered by the privacy guarantees and purpose limitation. Customers are free to define the data type ‘Properties’. This means this data type can contain anything that can help to create selections. These data persist after use and remain active until they are deliberately inactivated. After inactivation, they become invisible, but are not removed from the system until the contact is completely deleted. In the Dynamics information schema for government system administrators!° Microsoft explains that the identifiers mentioned in Figure 1 below are always collected when system administrators access Dynamics CRM. Figure 1 - Microsoft table common identifiers collected about system admins Base schema Schemas define which fields are sent to the Microsoft 365 Security and Compliance Center.

Some fields are common to all applications that send audit data to Microsoft 365, while others are specific to model-driven apps in Dynamics 365. The Base schema contains the common fields. Field name Type Mandatory Description Date Edm.Date No Date and time of when the log was generated in UTC IP address Edm. String No IP address of the user or corporate gateway Id Edm.Guid No Unique GUID for every row logged Result Status Edm.String No Status of the row logged. Success in most cases Organization Edm.Guid Yes Unique identifier of the organization from which the log was generated. You can find this ID td under Dynamics Developer Resources. ClientIP Edm. String No IP Address of the user or corporate gateway Correlationld Edm.Guid No A unique value used to associate related rows (e.g., when a large row is split) CreationTime Edm.Date No Date and time of when the log was generated in UTC Operation Edm.Date No Name of the message called in the SDK UserKey Edm.String No Unique Identifier of the User in AAD.

AKA User PUID Userlype Self.Userlype No The Microsoft 365 audit type (Admin, Regular, System) User Edm.String No UPN of the user 2.3. Tracking pixel added to newsletters When newsletters and other mailings are sent directly from Dynamics CRM to a list of recipients, by default Dynamics CRM will include a tracking pixel into the body of the emails sent out. This tracking pixel informs Dynamics CRM whether and when the recipient has opened the email. The tracking pixel is meant to be activated when the user reads the email. The pixel contains a specific identifying code, which makes it possible to see for Microsoft and its customers which recipients have opened the mail unless the customer turns this pixel off. 10 Microsoft, Microsoft Dataverse and model-driven apps activity logging. 10 December 2020, URL: https://docs.microsoft.com/en-us/power-platform/admin/enable-use-comprehensive- auditing Page 14 of 64 179410127 0025 0942 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Since not all recipients use a mail client that will open the pixel by default, the resulting reading behaviour statistics are not accurate.

The customer cannot conclude for sure a recipient has not opened the email. Dynamics CRM logs every attempt to open the newsletters if the pixel is activated according to the scheme shown below in Figure 2. Figure 2 - Tracking pixel process flow Microsoft tracking pixel in newsletters Microsoft Dynamics 7 External I | supplier Privacy Company has asked the Council to switch off the tracking pixel in newsletters sent through Dynamics CRM. However, these settings are only available in an updated version of Dynamics, released in June 2020.1! The newer version include new options for admins to choose GDPR settings.!* . These settings were not available in the version implemented at the Council and could therefore not be tested. 2.4. Dynamics activity logging: technical log files, audit tables and browser telemetry Microsoft has programmed extensive logging capabilities into Dynamics CRM.!? If a customer uses Dynamics CRM as a cloud service, Microsoft can collect and process log files about user activities (actions performed on resources).

However, in this DPIA, only an on-premise set-up has been examined. In this setup, the log files are created on the server controlled by the customer. Therefore, most of the log files described 11 As confirmed to Privacy Company in an e-mail from 5 June 2020. 12 Microsoft, Enable GDPR features in Dynamics 365 Marketing, 16 December 2020, URL: https://docs.microsoft.com/en-us/dynamics365/marketing/gdpr#view-and-set-the-consent- level-for-each-contact 13 Microsoft, Audit data and user activity for security and compliance, September 30, 2017, URL: https://docs.microsoft.com/en-us/dynamics365/customer-engagement/admin/audit- data-user-activity. Page 15 of 64 179410127 0025 0943 2.4.1. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 below are only accessible for the system administrators of the government organisation. Microsoft describes the purpose of logging as follows: “audit data and user activity for security and compliance [this] auditing feature logs changes that are made to customer records and user access so [a system administrator or a user with a customizer security role] can review the activity later’ .14 Three separate systems have been investigated.

In the first place, Dynamics CRM creates /og files [locally or on Microsoft's servers in case of Dynamics as a cloud service] that store information about the use of Dynamics CRM. In the second place, use of and changes to records are recorded locally in audit tables in the Dynamics CRM database. In the third place, Microsoft creates and sends telemetry data about the individual employee use of Dynamics CRM to its own servers through a Javascript library when Dynamics CRM is accessed through a browser. These three types of logging generate different levels of information that are described below. Technical log files The technical log files with diagnostic data are only available to the Council in its on- premise setup. Microsoft explains these logs enable its customers to monitor “server status and performance, troubleshooting issues, and planning for disaster recovery” .'5 To examine the contents of the technical log files, a test scenario was run on the development environment of the Dynamics CRM system at the Council on 17 October 2019.

Location of data (EU, EMEA, ‘westeurope’) ° Browser information ° Agent . Viewport ° Referrer e IP address (possibly internal — encoded) ® User ID ° NPS status 14 Microsoft, Audit data and user activity for security and compliance, 11 January 2021, URL: https://docs.microsoft.com/en-us/dynamics365/customer-engagement/admin/audit-data- user-activity 15 Microsoft, Operating Dynamics 365 Customer Engagement (on-premises) (on-premises), 1 October 2018, URL: https://docs.microsoft.com/en-us/dynamics365/customerengagement/on- premises/deploy/operating-microsoft-dynamics-365 Page 16 of 64 0025 0944 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 e Current location (‘none’) ° Azure Active Directory status and ID ° Action These data are personal data insofar as they relate to the user — an employee of the Council. No personal data of other types of data subjects have been detected in any of these log files.

The longest file (4461462.json) contains as many as 6.334 objects, much more than the number of distinct interactions made by the user during the test session. It appears to contain information about database access requests. It does not contain content data, but does include a UserRequestID, a SystemRequestID, a RequestID, and a CorrelationID, each with a unique identifier. These are not user identifiers. Nonetheless these identifiers might be linked by the Council to personal data in the database. This examination does not suggest that this data collection is excessive for the security purpose. Another file (3695963.json) contains 70 relevant records, that Privacy Company could not identify as connected to any specific user action. One of these 70 records contains a reference to a specific HTTP request that shows information is being transferred from the home.dynamics.com domain to the api.businessappdiscovery.microsoft.com domain, with the user ID and details about the used web browser.

This sample record suggests user settings were somehow part of the interaction. Most of the log files seem to register specific interactions. The contents of these logs can be seen as a logical and necessary measure to guarantee that any errors can be fixed and audit trails are created to detect intruders. However, Microsoft is possibly preparing for the use of the logs by its customers or by itself for other purposes, in particular for marketing purposes. This follows from a reference in the log files to the Net Promotor Score, a metric for user satisfaction. The following snippet was recorded four times during the test session: { "time": "", "correlationId": "", "properties": { "HasBeenPrompted": "False", "UserIdentifier": "XXXUSERPRINCIPALIDXXXX", "NPSSurveyType": "NPSInitial3DB" This could very well be a remnant of a functionality Microsoft doesn’t use in the on- premise server, but only in the cloud service.

It could also concern a functionality that has been switched off, or be a functionality Microsoft only makes available to its customers but that has not been activated by the Council. Another option is that Microsoft intends to use this functionality in the future to ask for feedback from users of the Council. In that case, Microsoft would collect these personal data for its own purposes. This would not be in line with the privacy amendment with the Dutch government. Microsoft does not publish any documentation about the possibility for customers, or itself, to use the NPS metrics. Even though the processing of this snippet only results in limited data processing, the lack of transparency and Microsoft’s ability to create such new types of logging result in uncertainty for the Enterprise customers about the scope of the data processing, and thus, a lack of control. Page 17 of 64 0025 0945 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 The technical inspection shows that Microsoft collects a variety of technical logs with limited information about the way the users (employees of the Council) interact with Dynamics CRM.

These are personal data, but these data reveal little information about user activities. In the discovered data, no references were found to one of the other types of data subjects (the relations of the Council). The test scenarios included changing the contents of records about relations, but none of these actions resulted in the inclusion of content data in the technical logs. Whether that means that such references do not exist, or that they do exist, but were for some reason excluded from this collection of log files, is impossible to establish. The discovered data mostly contain limited descriptions of the actions of the users. Much of the data appear to be of little direct value from any practical point of view, such as security, without additional information on the contents of the action. For instance, one folder (named 2057) in the produced log collection contains 38 files, all created at the exact same time, contain the exact same information.

However, in an on-premise set- Page 18 of 64 0025 179410127 2.4.2. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 up, no log files are being sent to Microsoft. It is thus unclear why the log files contain a geo indication. Additionally, Microsoft offers a range of optional monitoring features to its customers, that have to be specifically switched on or that require the customer to install add- ons to Dynamics CRM. This is not part of the implementation strategy of the Dynamics CRM system for the Council. Therefore, these features are out of scope of this DPIA. Note that Microsoft can also log usage of the Dynamics CRM if such an activity is captured by the telemetry sent to Microsoft from the operating system, such as Windows 10. This DPIA assumes all government organisations follow the recommendation from SLM Microsoft Rijk to set the telemetry level in Windows 10 to the least invasive ‘security’ level.

In that case, such activity data will not be captured, and are therefore out of scope of this DPIA. Audit tables Dynamics CRM stores every change to every content field by default, together with information about the time the change was entered into the system and by whom. These records are stored in so called Audit tables. These tables can be used to reconstruct and rectify errors. System administrators have the option to turn these audit logs on and off, but they were on during the time of the second run of the test scenarios. The audit tables inspected by Privacy Company contain information about both the current and previous information about records that were changed. They also contain all deleted content. The information about contacts contains the same categories of data as the rest of the application. Personal data about employees of the Council is also stored: the time and date they interacted with the application, the records they accessed, as well as information about which changes they made to the data in Dynamics CRM.

Collecting this type of information is often a vital part of securing the integrity of a system and to be able to detect weaknesses in the system. Whether Microsoft also uses these data for any other purposes cannot be determined from examining the files themselves. Microsoft provides the following information about the audit tables: Page 19 of 64 0025 0947 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Figure 3 - Microsoft Dynamics User and support-related events!6 User and support-related events Event Create. read, update, delete (CRUD) Multiple record view Export to Excel SDK calls via surround or custom apps All support CRUD activities Admin activities Backend commands Report Viewed Report Viewer Export Report Viewer Render Image Description Logging all CRUD activities essential for understanding the impact of a problem and being compliant with data protection impact assessments (DPIA).

Inspection of the audit tables shows that all data types mentioned earlier in this section, including the content data, were included. In other words, through the audit tables the Council continues to process deleted content data. 16 Microsoft, Microsoft Dataverse and model-driven apps activity logging, 10 December 2020, URL: https://docs.microsoft.com/en-us/power-platform/admin/enable-use-comprehensive- auditing Page 20 of 64 0025 0948 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Figure 4 - Anonymized sample of audit logs!” SS Geegeiga soot Fr Gewitigde datum 26-19-2079 1126 Veldnaar Wasrde ‘Aanhet (tail) ~ Geachte hoo Amnmeiding ls ingeschakeid Nee Aamachijfwijze formes armen Td Adres 1 TR "22-28-2201 neotrcano Adres 1: bannt/tegio NEDERLAND Adres 1: plaats | | Adres 1: pesteode ri Adres 1: prowincie Noord Brabant Adres 1: straat 1 es nore 2 I 0006-0: 02 22 scorns ano Adres 2: adrestype Standaardwaarde Adres 2: land/regio NEDERLAND Adres 2: leveringscondities Standaardwaarde Adres 2: plnats Fe Adres 2: postcode || Adres 2: province Noord.

Brabant Adres 2: ivaat 4 a Adres 2: werzendwijre SMandaardwasrde Adresregel 1 fiona Adresregel 2 Taw. de beer Adrewregel 3 _ Adresrege! 4 Pe Adressering Taw. de heer Abeen marketing Nee Autamatich asmasit he Figure 4 above shows an anonymized sample of a Create action in the audit tables. The audit tables provide information on which user accessed the system at what time and date, which user updated a field value of a record at what time and date, the previous field value before the update, which user deleted a record at what time and date, what locale was used to make an update, and a complete audit trail on a specific user’s recent activities. 18 System administrators have to actively turn on the auditing feature. The Council turned this feature on, with a retention period that is set to three months, according to information provided by the Council. During the investigation, some data were found that date back for more than three months.

The audit tables can be deleted, paused, or restarted by a system administrator (or customized security role) to save storage capacity or for maintenance purposes.!9 2.4.3. Telemetry Data through the browser In additional testing, Privacy Company observed that some telemetry data were sent from the browser to Microsoft when using Dynamics CRM. These telemetry data do not contain directly identifiable personal data but do sometimes include unique user IDs. The browser creates POST requests, containing telemetry events with data in the body of the request, to the server https://browser.pipe.aria.microsoft.com/. Privacy Company captured traffic to that server and additional tests were conducted to generate more telemetry data. The following requests were captured over a total of 32 POST requests (most POST requests contain more than one telemetry event): 17 Screenshot provided by the Council of State. 18 Microsoft, Audit data and user activity for security and compliance, 11 January 2021, URL: https://docs.microsoft.com/en-us/dynamics365/customer-engagement/admin/audit-data- user-activity. 19 Idem.

Page 21 of 64 179410127 0025 0949 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Table 1 - Telemetry data requests to Microsoft when using a browser Event name Frequency uci_monitor_performance 20 uci_monitor_success 32 uci_trace 94 initializelivepersonacard_success 2 uci_context 18 livepersonacard_configurationsetaction 2 uci_monitor_failure 10 awt_stats 10 At least in the two cases of calls to “livepersonacard_configurationsetaction”, the call contains the unique user ID and other identifying data. These are personal data, that Microsoft processes. However, Microsoft does not make any information publicly available about the contents and purposes of this data processing. 2.4.4, Authentication cookies collected by Microsoft At the request of Privacy Company, on 17 September 2020 the Council tested the presence of cookies and similar tracking technology on Microsoft’s log-in page by intercepting the outgoing traffic from the browser.

Employees must visit this page to authenticate themselves for access to the (on-premise) Dynamics CRM via their browser. Because at the Council employees can only access the Dynamics CRM through a browser, and because the browser needs to send its authentication information in each request (without cookies, the http connection is stateless), Microsoft uses cookies to remember the user. The recorded log only shows traffic to Microsoft-owned domains and specifically, access to the Dynamics server, but no traffic to third parties. The traffic does contain cookies with unique identifiers, but these cookies can be qualified as functional cookies to transmit the authentication request. Therefore, as will be explained in more detail in Section 9 of this report, prior consent is not required. It follows from the intercepted outgoing traffic that Microsoft -at least- collects the following personal data through these functional cookies: eIP-address eTime of access «User Agent Referrer eID in header x-ms-RefreshTokenCredential eClientID eValue with unique number eLogin_hint in the format of an e-mail address?° An example of such a functional cookie with a retention period of 1 day is: { "name": "fpc", "value": "[unique number removed]", "path": ae 20 This is not a limitative list of all data collected by Microsoft through these cookies, but this list shows the clearest examples of personal data.

Page 22 of 64 179410127 0025 0950 179410127 2.5. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 "domain": "“login.microsoftonline.com", "expires": "2020-10-18T10:14:57.0002", "httpOnly": true, "secure": true, "sameSite": "None" Other examples of cookies with non-unique identifiers are: { "name": "x-ms-gateway-slice", "value": "estsfd", paths: Mf, "domain": "“login.microsoftonline.com", "expires": null, "httpOnly": true, "secure": true, “sameSite": "none" hy { "name": "stsservicecookie", [security token service service cookie, explanation added by Privacy Company] “value”: “estsfd”, "path": "/", "domain": "“login.microsoftonline.com", “expires”: null, "httpOnly": true, "secure": true, "“sameSite": "none" Microsoft appears not to publish any documentation about the contents and purposes of cookies used on the log-in page for Dynamics. Microsoft only makes some information available about cookies that can be used by customers in the Dynamics marketing module.2!

Separate from these cookies, Microsoft also logs access to its Azure Active Directory in Azure security logs. Since Microsoft did not reply to a Data Subject Access Request filed for this test, it is not clear wat data Microsoft stores relating to this authentication process in these logs. Classified information Dutch government employees will, depending on the capacity in which they work, often process Classified Information. The Dutch government defines 4 classes of Classified Information, ranging from confidential within the ministry to extra secret state secret.22 Classified Information is not a separate category of data in the GDPR or other personal data legislation. Nonetheless, information processed by the government that is qualified as classified information, whether it qualifies as personal data or not, must legally be protected by special safeguards. The processing of this information when 21 Microsoft, How Dynamics 365 Marketing uses cookies, 9 October 2020, URL: https://docs.microsoft.com/en-gb/dynamics365/marketing/cookies 22 Defined in: Besluit Voorschrift Informatiebeveiliging Rijksdienst Bijzondere Informatie 2013 (VIRBI 2013) Page 23 of 64 0025 0951 2.6. 2.7. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 related to an individual, can also have a privacy impact.

If the personal data of an employee, such as an Enterprise account ID, or unique device identifier, can be connected to the information that this person works with Classified Information, the impact on the private life of this employee may be higher than if that person would only process ‘regular’ personal data. Unauthorised use of this information could for example lead to a higher risk of being targeted for social engineering, spear phishing and/or blackmailing. If government organisations chose to use an Azure Cloud or hybrid deployment of Dynamics CRM, combined with SharePoint Online or OneDrive, they have to be aware that Microsoft may process classified information, including confidential file names and storage locations. A folder may for example have as name: “State Secret — negotiations with country/company xX”. Personal data of a sensitive nature Some types of personal data have to be processed with extra care, due to their sensitive nature.

Examples of such sensitive data are financial data, communications traffic data and location data. The sensitivity is related to the level of risk for the data subjects in case the confidentiality of the data are breached. Risks may vary from slight embarrassment if the employer notices from the log files that an employee has made several mistakes, to a chilling effect if the employer does not specifically exclude the use of the log files for performance assessments, to exposure and possibly job termination if the employer discovers malicious fraud through the log files. It is likely that many government employees process personal data of a sensitive nature about other data subjects on a daily basis. These content data are also stored in audit tables, including data of a sensitive nature. The Dynamics CRM implementation at the Council does not include any explicit use of sensitive categories of personal information (except for the dietary information, see below) though it is possible that the Council could derive some browsing history from URL referrers contained in the technical log files.

This however is an edge case. Special categories of personal data According to the GDPR, the processing of special categories of personal data are prohibited, unless one of the exceptions from the limitative list included in the GDPR applies. According to Article 9 (1) GDPR, personal information falling into special categories of data are any: “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation”. With special categories of data, the principle is one of prohibition: special data may not be processed. There are exceptions to this rule, however, for instance when the data subject has explicitly consented to the processing, or when data have been made public by the data subject, or when processing is necessary for the data controller to exercise legal claims.

Dynamics CRM does not by default process any special categories of personal data. Depending on the specific implementation by a customer, it is possible that special categories of personal data become part of the processing and may also be included in the browser telemetry. Microsoft has no direct influence over what data gets Page 24 of 64 0025 0952 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 included in an implementation. In the on-premise solution tested for this DPIA, Microsoft only collects three limited streams of Diagnostic Data: authentication data for the Azure AD through cookies, through the browser telemetry and through the tracking pixel in newsletters. The Enterprise customer collects many more detailed personal data, which may include special categories of data, in the audit table, and possibly, though not observed in this DPIA, also in technical log files.

Microsoft is likely to process personal data from the different log files, including sensitive data, if a customer uses the Dynamics CRM services as a cloud service, but this processing is out of scope of this DPIA. If a government organisation implementing Dynamics CRM were to process special categories of personal data in the system, this would impact the risks for the rights and freedoms of the data subjects. 2.7.1, Special categories of data at the Council The Council implementation does include occasional processing of special categories of personal data. Often, relations are connected to the organisation they are affiliated with. In the context of the Council the names of organisations may reveal the political, religious or health background of those relations, for instance when the relation is a representative of a political party, a church, or a patient organisation. Trade union membership is also easily implied when the relation’s employer is itself a trade union.

Additionally, Dynamics CRM as implemented by the Council can include information about dietary needs and allergies. Dietary information can reveal information about health or religious affiliation. Allergy information is always informative of someone's health. Both are to be considered special categories of personal data. The assessment of the risks and the legitimacy of the processing of Dynamics CRM by the Council is influenced by the presence of special categories of personal data. 2.8. Categories of data subjects In all implementations of Dynamics CRM, the organisation's employees will be among the data subjects. Other than that, the categories of data subjects might vary, but for a CRM system, it will typically include contact persons of some type. The specific categories of data subjects for the Council are the following: 2.8.1. Employees The users of the Dynamics CRM system are employees of the Council.

With the term employee this report wants to describe a broad group of workers, regardless of their contracting situation as internal, temporary or external employees. Employees require system credentials and the way they use the system is recorded in log files. These data are stored for a defined period of time. This implies that the system could contain information about former employees if there were no possibility to delete individual credentials or log files. 2.8.2. Contact persons The largest group of data subjects consists of the people whose personal contact details are being stored in the Dynamics CRM system, sometimes including their partners. These are the contacts of the Council. Page 25 of 64 179410127 0025 0953 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 3. Processing of personal data via Dynamics CRM When using Dynamics CRM, different data processing activities are at stake.

For the purposes of analysis this DPIA examines three broad groups of data to structure the description of the processing activities: 1 Content data; 2 Functional data; 3 Diagnostic data. This DPIA focusses on two types of data processing through Dynamics CRM: processing of the Content Data and processing of the Diagnostic Data, as tested in the implementation of the Council. In the tested on-premise set-up, almost none of the data processing is performed by Microsoft on its own servers, with three exceptions: 1 authentication of employees through the Azure AD 2 the use of a tracking pixel in newsletters 3 browser telemetry Theoretically, if an organisation chooses to host a Dynamics server on a VM in the Azure cloud, Microsoft can also gain access to both the Content and the Diagnostic Data, but this scenario is out of scope of this DPIA. Bt; Out of scope: Functional Data, Account Data and Support Data Through the use of the cloud version of Dynamics CRM, and through the combination of an on-premise Dynamics implementation with authentication through the cloud Active Directory, Microsoft also processes functional data.

These data are outside the scope of this umbrella DPIA, because they necessarily have to be sent to Microsoft to communicate with the databases in the Microsoft cloud. Functional data are and should remain transient. If Microsoft stores such functional personal data, they belong to the category of Diagnostic Data. Similarly, the processing of Support Data and Account Data are out of scope of this report. The processing of these data is generic for all Microsoft Online Services. 3.2. Customer processing of Content Data Through Dynamics CRM, as implemented by the Council, Microsoft enables its customers to perform (at least) 3 specific types of data processing. The Council processed the personal data for two other specific purposes: remembering food preferences and external address verification. ° Relationship management: Entry, updating and manual deletion of contact information about relations of the Council. .

Sending mailings: Selection of data subjects and inviting them to events. ° Creating back-ups of the database. ° Remembering food preferences: Taking into account dietary preferences of relations visiting customer organised events.22 e Verification of the address data in the CRM system, through the use of an external online service provided by webservices.nl.** 23 “Inrichtingsdocument CRM”, Raad van State (intern) 11 April 2019, Appendix 4. 24 As described in the memo “Gewenste aanpassingen m.b.t. Relatiebeheer module” version 0.3, Raad van State, 17-7-2019 Page 26 of 64 179410127 0025 0954 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 3.3. Customer processing of Diagnostic (personal) Data Microsoft enables its customers to process Diagnostic Data for the following purposes: ° Tracking of newsletter reading. ° Authentication and authorisation of the employees to the Dynamics CRM system, based on Azure Active Directory. e Logging changes made to specific records within the Dynamics CRM system in the audit tables. ° Security purposes (detection of unlawful access and data breaches). e Removal of obsolete personal data from the audit tables (individually or by date range). e Administration of the system, including setting up roles for specific users and their permissions. 3.4.

Microsoft processing of Diagnostic (personal) Data e Tracking of Dynamics CRM use through a JavaScript library in the browser e Capturing Azure AD security logs e Collection of functional authentication cookie data The processing of personal data for authentication within Dynamics CRM is generally done in combination with the use of Azure Active Directory. This combination and technology will be described in more detail in Section 8 of this report. 4. Purposes of the Processing 4,1. Purposes determined by the Council of State The Council has a limited number of purposes for the processing of Content Data and Diagnostic Data. These purposes have been made explicit in a functional description (‘Inrichtingsdocument CRM’)25, or can be derived from secondary project documentation.26 The Council describes as overarching purpose of the use of Dynamics CRM “an improvement of the quality and compliance (GDPR and information security standards) of the use and maintenance of the relationship data of the Council.”

The Council has two sub-purposes: 1. Relationship management 2. Organisation of meetings and events, segmentation of contacts and sending of letters and (e-)mail(ing)s.?” These two purposes do not explicitly cover the collection of Diagnostic Data in the technical log files and the audit tables by the Council. As part of the overarching information security purpose, government organisations implementing Dynamics CRM should be able to detect historical changes and corrections to the personal data in Dynamics CRM, and regularly inspect the logfiles to check for anomalies. Every government organisation should define such purposes in its internal privacy policy. The Council has not provided a limitative list of purposes and circumstances for its use of these log files. The Inrichtingsdocument includes a list of future purposes that will not be part of the initial implementation and are out of scope of this DPIA. 25 “Inrichtingsdocument CRM”, Raad van State (intern) 11 April 2019 26 “Gewenste aanpassingen m.b.t.

Relatiebeheer module” version 0.3, by, Raad van State, 17 juli 2019. 2? Inrichtingsdocument, p. 4. Page 27 of 64 179410127 0025 0955 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Purposes determined by Microsoft The purposes of the data processing by Microsoft are limited and defined in the privacy amendment negotiated by the Dutch government. For Microsoft Online Services, contracts are closed with the entity Microsoft Ireland Operations Ltd. The different Dynamics 365 services are part of the the Online Services.28 The contractual guarantees are created in the form of an amendment to the document that is the highest in the enrolment framework, the Microsoft Business and Services Agreement (MBSA). This ensures that no ‘lower’ ranking document can overrule the new limitations and guarantees. In its public (unamended) contract structure, Microsoft unilaterally imposes a number of conditions regarding its compliance with European privacy regulations.

The most comprehensive provisions are contained in the Online Service Terms (OST).29 Microsoft offers a separate Data Processing Addendum*2, that is included by reference in the OST. Normally, when a customer wishes to change the instructions for the processing, the changes to these instructions are applied in the same way as changes to the licensing agreement.?} As a hyperscale tech provider Microsoft does not conclude individual data processing agreements with individual Enterprise customers. Instead, the standard terms and conditions of Microsoft apply. As an annex to the OST, the pre-filled EU Standard Contractual Clauses (SCC) are included to legitimise transfer of personal data from the Netherlands to the USA.?* Microsoft does not allow individual customers to determine the purposes in the SCC for which the personal data are processed. In the OST Microsoft states: “Customer agrees that its volume licensing agreement (including the OST) along with Customer's use and configuration of features in the Online Services are Customer’s complete and final documented instructions to Microsoft for the processing of Personal Data.”33 In the past SLM Rijk had already managed to negotiate a number of amendments on the standard agreement and standard terms.

However, SLM Rijk did not have the ability to determine the purposes of the processing of Diagnostic Data, nor to specify which categories of personal data could and could not be processed for each of these purposes, nor to individually consent to each subprocessor. 28 Microsoft Dynamics 365 Core Services are desribed in the OST of January 2021, From page 15 onwards Microsoft 22 The most recent version of the Microsoft Online Services (OST) dates from January 2021, URL: https://www.microsoftvolumelicensing.com/Downloader.aspx?documenttype=OST- &lang=English 3° The most recent version of the Microsoft Online Services Data Protection Addendum, dates from 9 December 2020, URL: https://aka.ms/DPA. 31 OST Jan 2021, p. 8. 32 Microsoft has removed this appendix from the OST as of Jan 2021, but it was present at the time of the investigations OST March 2019, p. 32. 33 OST Jan 2021, p. 36, Annex 3.

The clauses are between the government Enterprise tenant as data controller and ‘exporter’ and Microsoft Corporation in the USA as data processor and ‘importer’. Page 28 of 64 0025 0956 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Figure 5 - Contents of enrolment framework Office 3657+ ea _____ Agreement (MBSA) — Older iterations are called Microsoft Business | Agreement (MBA) : | Select Plus EAs. Agreement Agreement. ee of Eom Server and (Desktop) EA H Cloud -| Enrollment [could be i} Enrollment more than one] f Al. ta) Product Customer Product Customer Selection} | Price Sheet Selection | | Price Sheet Form (CPS) Form (CPS) Sup. CPS Sup. CPS The Dutch government privacy amendment overrules all previous amendments and ensures that Microsoft may only process all personal data for three purposes, and only when proportional. The amendment ensures that Microsoft may not process any personal data for its own purposes.

Due to the contractual amendment, and the audit on the compliance with the contract, the Dutch government ensures that Microsoft strictly processes in a role as data processor, not as (joint) controller of personal data. However, the privacy amendment does not apply to services for which Microsoft considers itself a data controller, such as installed software and a limited category of online services such as services related to LinkedIn and search engine Bing. In order to create maximum transparency, the amendment includes a list of specific purposes of data processing related to business operations for which Microsoft may legitimately act as an (independent) data controller. These purposes range from the obvious (sending invoices, creating statistics for the annual financial reports) to the often forgotten, such as complying with orders from law enforcement. Through the amendment negotiated with SLM Rijk, it is clarified that Microsoft does not act as a data processor when it has to hand over personal data (be it content, or Diagnostic Data) to a law enforcement authority, security agency or secret service in the USA.

In those circumstances, Microsoft acts as a data controller, to comply with legal obligations imposed under American law. This will be elaborated in paragraph 5.2 of this report (Microsoft as a data controller). 34 Graphic made by Directions on Microsoft, URL: https://www.directionsonmicrosoft.com/. Page 29 of 64 179410127 0025 0957 4.2.1. 5.1. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 The contractual amendments apply to Dynamics CRM since they are explicitly described in the Online Services Terms, including three types of on-premise Dynamics servers.?5 The use of Microsoft mobile apps was not included explicitly in this enrolment framework, but starting with the core features in Office 365 Microsoft will ensure they only process personal data in line with the privacy amendment. Microsoft responded with an improvement plan to mitigate the lack of protection assessed in the DPIA for Microsoft Office 365 mobile apps in July 2019.36 Purposes Microsoft as data processor As a data processor, Microsoft acknowledges that it processes personal data through the metadata and will only process these data for three authorised purposes, and only where proportional.

These purposes are: 1. to provide and improve the service, 2. to keep the service up-to-date, and 3. to secure the service. This strict purpose limitation applies to both the content (Customer Data) and to all Diagnostic Data, including the system-generated server logs and telemetry data collected through the end-user browsers. Microsoft has additionally guaranteed contractually that it won't use the Content Data or the Diagnostic Data from these data processor services for the purposes of profiling, data analytics, market research or advertising, unless the customer explicitly requests Microsoft to do so. This includes a specific prohibition to use the personal data to show personalised recommendations on screen for Microsoft’s products and services that the customer has not purchased or does not use. In the tested setup of this DPIA, Microsoft does not collect any Content Data and very limited Diagnostic Data.

Controller, Processor, and Subprocessors The different roles of the involved (commercial) parties in the processing of personal data are defined in Article 4 (7) to (4) 9 GDPR. ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Chapter 3 contains a description of the different types processing of Content and Diagnostic Data through Dynamics CRM. The role of the Enterprise customer as data controller The Council and other Enterprise customers can determine what content data are processed through the service.

Customers can also influence the processing of some, but not all, Diagnostic Data on the use of the service, for example by not turning on 35 OST, Jan 2021, p. 15 - 17. 36 DPIA Office 365 Online and mobile Office apps (June 2019) Page 30 of 64 0025 0958 179410127 5.2. 5.2.1. 5.2.2. 5.2.3. 5.3. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 the audit logs. Nonetheless, Microsoft also determines some purposes of the processing of (some limited) Diagnostic Data, as well as the retention periods. The role of Microsoft as data processor Based on the privacy-amendment negotiated by the Dutch government, Microsoft may only process the Diagnostic Data from Dynamics CRM in a role as data processor. As a data processor, Microsoft acknowledges that it processes personal data through the metadata and will only process these data for three authorised purposes, and only where proportional.

These purposes are: (1) to provide and improve the service, (2) to keep the service up-to-date and (3) to secure the service. Effective audit rights The Dutch government negotiated effective audit rights in the privacy amendment. The amendment covers Microsoft's obligation to ensure cooperation itself, but also obliges the relevant subprocessors to provide all reasonable assistance in relation to all the audit activities of the controller. The scope of the audits covers both the Standard Contractual Clauses and other GDPR audit rights. Control over subprocessors Microsoft provides a reference to a list of subprocessors in its terms and conditions.’ The use of subprocessors by Microsoft is amended in the OST by the following: “From time to time, Microsoft may engage new Subprocessors, Microsoft will give Customer notice (by updating the website and provide Customer with a mechanism to obtain notice of that update) of any new Subprocessor at least 14 days in advance of providing that Subprocessor with the ability to process Customer Data or Personal Data.

However, with respect to Core Online Services, Microsoft will give Customer notice (by updating the website and provide Customer with a mechanism to obtain notice of that update) of any new Subprocessor at least 6 months in advance of providing that Subprocessor with access to Customer Data”. No analysis was performed on possible sharing by Microsoft of personal data from Dynamics CRM with sub-processors. In the Council setup this could only relate to the tracking pixel and the Azure AD. Retention periods The only relevant retention periods Microsoft determines as a data processor in the tested Council setup are for the tracking pixel and for the Azure authentication data. However, government organisations that decide to use Dynamics as a cloud service, should be aware that Microsoft determines long retention periods for the Customer Data through its Online Service Terms. In that case, Microsoft retains Customer Data that remain stored in Online Services in a limited function account for 90 days after expiration or termination of Customer's subscription.

After the 90-day retention period ends, Microsoft will disable Customer’s account and delete the Customer Data and Personal data within an additional 90 days unless Microsoft is permitted or required by applicable law to retain such data or authorized in this agreement. Microsoft and the Dynamics Enterprise customers as joint controllers Even though Microsoft clearly does determine the exact functioning of the Dynamics CRM system, even in an on-premise setup by designing and programming the collection of log files, this does not necessarily mean that Microsoft determines the means of processing and thus becomes a (joint) data controller. 37 Microsoft overview OST subprocessors, 1 August 2020, URL: https://servicetrust. microsoft.com/ViewPage/TrustDocumentsV3. Page 31 of 64 0025 0959 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 The European Court of Justice has clarified in three rulings*® that parties may easily be qualified as joint controllers.

This also applies when they do not have access to all the data collected by the other party, or when the levels of responsibility are very unevenly divided.7? While the three rulings originate in disputes about the European Data Protection Directive, the definition of joint controller did not materially change in the GDPR. The GDPR only adds extra obligations (in Article 26) for joint controllers to transparently determine their roles and responsibilities. To be able to assess the role of Microsoft as a (possible) joint controller for Diagnostic Data, it is necessary to understand what data are collected as well as the purposes that Microsoft collects these data for. If Microsoft collects these data for purposes that do not directly relate to providing the Dynamics CRM service to the Council, that would likely lead to the conclusion that Microsoft is a joint controller. This DPIA demonstrates that Microsoft potentially has access to four sources of personal data: 1 Through technical log files [only in Dynamics as a cloud service]; 2 Through audit tables [only in Dynamics as a cloud service]; 3 Through Javascript based browser telemetry 4 Through authentication cookies Microsoft has not responded to the data access request filed by an employee of the Council for the purposes of this DPIA.

Therefore, it is impossible to determine whether and to what extent Microsoft processes these any of these types of Diagnostic Data. This DPIA cannot provide a conclusive answer what data from these log files Microsoft retains in an identifiable form. The data collected through Javascript in the browser and the authentication cookies are directly sent to Microsoft and do contain limited personal data. Microsoft has control over the way personal data are collected and transmitted through this channel. Since this data collection is not mentioned anywhere in the enrolment framework and Microsoft does not publish any information about its existence and contents, it has to be concluded that Microsoft determines the existence and scope of this personal data processing. However, this DPIA was unable to determine if Microsoft acts as a data processor within the three purposes allowed by the enrolment framework, or whether Microsoft processes these data as (joint) controller with the government organisation.

Microsoft offers too little information for the data controller to fulfil its duties to inform the data subjects or to take measures to limit the processing to what is strictly necessary. 38 European Court of Justice, C-40/17, 29 July 2019, Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV, ECLI:EU:C:2019:629, C210/16, 5 June 2018, Unabhangiges Landeszentrum fur Datenschutz Schleswig-Holstein versus Wirtschaftsakademie Schleswig- Holstein GmbH, ECLI:EU:C:2018:388. See in particular par. 38-43. Also see: C-25/17, 10 July 2018, Tietosuojavaltuutettu versus Jehovah's Witnesses — Religious Community, ECLI:EU:C:2018:551, par. 66-69. 3° European Court of Justice, C 210/16, paragraph 38: “While the audience statistics compiled by Facebook are indeed transmitted to the fan page administrator only in anonymised form, it remains the case that the production of those statistics is based on the prior collection, by means of cookies installed by Facebook on the computers or other devices of visitors to that page, and the processing of the personal data of those visitors for such statistical purposes.

In any event, Directive 95/46 does not, where several operators are jointly responsible for the same processing, require each of them to have access to the personal data concerned.” Page 32 of 64 0025 0960 179410127 5.4. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 In sum, Microsoft should contractually behave as data processor for all data in and about the use of Dynamics CRM. However, the inspection of the outgoing data traffic from the browser of the end-user shows that Microsoft is not fully transparent about the personal data it collects. The observed browser telemetry data and authentication cookies only contain limited personal data. Due to the lack of transparency by Microsoft, the government organisation cannot adequately inform the data subjects, or take measures to limit the processing. The role of Microsoft as (independent) data controller If Microsoft processes some personal data from its customers for its own legitimate business purposes, it acts as an independent data controller.

This is the case when Microsoft is processing contact details of representatives of the customer for the conclusion of contracts and for billing purposes. Microsoft can under specific circumstances be required to hand over personal data from customers to law enforcement authorities or security agencies/secret services. Microsoft mentions the possibility of legally mandatory disclosure of data to law enforcement as a data processor in the Online Service Terms. According to the relevant provision, Microsoft “Microsoft will not disclose or provide access to any Processed Data except: (1) as Customer directs; (2) as described in this DPA; or (3) as required by law."4° When law enforcement compels Microsoft to disclose Customer Data, Microsoft commits to try to redirect the request to the customer (the data controller), and only disclose data directly to law enforcement agencies when compelled to do so.

In these cases, Microsoft commits to notifying the customer promptly of the access.*? Microsoft writes in its Online Services DPA: “Microsoft will not disclose or provide access to any Processed Data to law enforcement unless required by law. If law enforcement contacts Microsoft with a demand for Processed Data, Microsoft will attempt to redirect the law enforcement agency to request that data directly from Customer. If compelled to disclose or provide access to any Processed Data to law enforcement, Microsoft will promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so."42 In reply to the Schrems II-ruling Microsoft makes even stronger promises, to principally challenge each such order and to pay compensation to each data subject affected by such a disclosure of Customer Data. Microsoft's VP for privacy, former FTC commissioner Julie Brill, explains in an official blog post:** “First, we are committing that we will challenge every government request for public sector or enterprise Customer Data — from any government — where there is a lawful basis for doing so.

This strong commitment goes beyond the proposed recommendations of the EDPB. Second, we will provide monetary compensation to these customers’ users if we disclose their data in response to a government request in violation of the EU's General Data Protection Regulation (GDPR). This commitment also exceeds the EDPB’s recommendations. It shows Microsoft is confident that we will protect our *° Microsoft Online Services DPA, December 2020, p. 7. 41 Ibid. * Thid. 43 Blog Julie Brill, New Steps to Defend Your Data, 19 november 2020, URL: https://blogs.microsoft.com/onthe-issues/2020/11/19/defending-your-data-edpb-gdpr/ Page 33 of 64 0025 0961 5.5. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 public sector and enterprise customers’ data and not expose it to inappropriate disclosure.” Microsoft publishes a bi-annual transparency report about law enforcement requests, and a separate report with an aggregate number of requests under U.S. national security laws, such as the Foreign Intelligence Surveillance Act (FISA).*4 In the Netherlands, in the period January-June 2020, Microsoft received 279 law enforcement requests, relating to 277 accounts/users.*° Only 0.72% related to Content Data. 59.14 procent related to other (Diagnostic or Account) data, while in 23.3% no data were found, and Microsoft rejected 16.85% of the request.

Microsoft explains that very few law enforcement requests relate to Enterprise cloud customers.*® Microsoft states there is a very high legal bar for blind requests in the Enterprise environment (where Microsoft would get a nondisclosure order). The requesting authority would have to prove that the board of the government organisation cannot be trusted. Microsoft also explains that in the first half of 2020, it only disclosed content data of 2 non-US enterprise customers, stored outside of the USA, based on the US Cloud Act.47 The role of other third parties In the tested set-up of the Council, a third external supplier was involved, a party hired to implement Dynamics CRM at the Council. This external supplier provides maintenance of the system after its development, which can include some processing (viewing) of personal data. The data processing by this external supplier is out of scope of this umbrella DPIA.

An external supplier was hired by the Council to implement the Dynamics CRM environment and to take care of its maintenance and hosting. This implies some processing of personal data. The supplier has access to the database and its content. The supplier is therefore a processor on behalf of the Council for maintenance and hosting, but has to be seen as an independent controller in relation to the specific task of implementation, insofar that requires any processing of personal data. A Data Processing Agreement is required. According to the Inrichtingsdocument, the Council implementation of Dynamics CRM includes an external API, provided by Webservices.nl.*® This website is provided by Company. info, which is owned by FD Mediagroep. Company.info offers a separate plug-in to Dynamics #4 Microsoft, U.S. National Security Orders Reports online summary, URL: https://www.microsoft.com/en-us/corporate-responsibility/us-national-security-orders- report?activetab=pivot 1%3aprimaryr2 45 Microsoft Law Enforcement Requests Report, URL: di 46 Ibid. Microsoft explains: “In the first half of 2020, Microsoft received 91 requests from law enforcement around the world for accounts associated with enterprise cloud customers.

In 42 cases, these requests were rejected, withdrawn, no data, or law enforcement was successfully redirected to the customer. In 49 cases, Microsoft was compelled to provide responsive information: 24 of these cases required the disclosure of some customer content and in 25 of the cases we were compelled to disclose non-content information only. Of the 24 instances that required disclosure of content data, 20 of those requests were associated with U.S. law enforcement.”. 47 Ibid. Microsoft writes: “In the same time frame, Microsoft received 74 legal demands from law enforcement in the United States for commercial enterprise customers who purchased more than 50 seats. Of those demands, 2 warrants resulted in disclosure of content data related to non-US enterprise customers whose data was stored outside of the United States.” 48 “Tnrichtingsdocument CRM”, Raad van State, 11 April 2019. Page 34 of 64 0025 0962 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 customers.*?

In the Council deployment Dynamics CRM calls this API to verify addresses and to translate postal codes and street numbers into full addresses. Company.info sees itself as an independent data controller when a customer like the Council uses its API.°° In its assessment, a data processing agreement is not necessary. Since personal data are exchanged in two directions (the user provides postal code and street number, the API responds with a full address) each party processes personal data for its own purposes. However, this reasoning fails to take into account the Company.info may create data protection risks for relations of a Dutch government organisation, if they use this attribute of a data subject to enhance possible profiles. Therefore, at the minimum, the Council should negotiate that Company.info may not use the data obtained through the API for its own purposes, or futher processing.

Otherwise they risk becoming joint controllers, without a proper agreement as defined in Article 26 GDPR. In the setup of the Council, the use of Webservices.nl is disabled. It is not clear why the plug-in was installed. 6. Interests in the data processing This paragraph outlines the different interests of Microsoft and of the Dutch governmental organisations in general, and of the Council in particular. The interests of the Dutch governmental organisations may align with the interests of its employees. However, this paragraph does not go into the fundamental data protection rights and interests of data subjects. How their rights relate to the interests of Microsoft and the Dutch governmental organisations will be analysed in part B of this DPIA. 6.1. Interests Dutch governmental organisations Dutch governmental organisations have security, efficiency and compliance reasons to start using a centralised CRM platform.

They have a strong general interest in providing reliable, always on, well integrated and location independent administration tools to their employees. Dynamics CRM provides such a service, that can also be reached from external locations, so employees can work from home or on the road. Different from the on-premise implementation at the Council (which is effectively deployed from a VM in a cloud), use of Dynamics offered by Microsoft as a cloud service may entail the following benefits: 1 Increased flexibility, because creating a Dynamics CRM database online is faster and easier than installing the software on a physical server. Developers and software testers can create new environments on demand to handle new tasks as they arise. 2 Cost saving, because organisations may need less maintenance staff and are generally less effective in maximising the output of the database when hosted on a single physical computer (bare metal server). 3 Increased reliability and availability, because the admins do not need to scale up computing capacity when demand increases. 4 Increased security and recovery, because the cloud database provider has such a wide range of customers that it is able to faster detect new risks than engineers of local data centres.

A globally operating cloud provider such as Microsoft typically has more security engineers available, and 24/7, to mitigate risks. 42 Company.info, Microsoft Dynamics App, undated, URL: https://companyinfo.nl/plugins-en- integraties/microsoft-dynamics-crm-plugin/ 5° Company.info, Microsoft Dynamics App, undated, URL: https://companyinfo.nl/plugins-en- integraties/microsoft-dynamics-crm-plugin/ Page 35 of 64 179410127 0025 0963 6.2. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Regardless of the use of Dynamics on-premise or in the cloud, the ability to access log data about user behaviour through audit logs in Dynamics CRM is essential for governmental organisations to comply with their own obligations as data controllers to regularly inspect the files for unauthorised access to personal data, and detect possible data breaches. Through the Content Search on the diagnostic log files, system administrators can access data about users’ access to personal data.

All government organisations are legally required to protect the privacy of their employees. When they use the Dynamics relation database, they should protect the personal data of their relations, as this may also involve data subjects that are involuntarily included. Finally, the Dutch government has a security and geopolitical interest in storing data in local data centres or, alternatively, in a limited number of data centres in the EU. The Ministry of Defence has a military state sovereignty interest to only store data in a sovereign cloud. Interests Microsoft Microsoft has wanted to be cloud first and mobile first since 2014. Microsoft explains: “Our users don’t simply use a workstation at a desk to do their jobs anymore. They‘re using their phone, their tablet, their laptop, and their desktop computer, if they have one. It’s evolved into a devices ecosystem rather than a single productivity device (...).751 Microsoft has explained that it competes with other large-scale cloud providers and considers it an essential economic interest to be able to process large amounts of data to develop new services.

Microsoft is effectively putting pressure on institutions to switch to the monthly model because it will soon end its support for older versions. Microsoft has strong business ethical interests to comply with international privacy and security standards and laws. In a world where many government organisations are still hesitant to entrust personal data to a cloud service provider, Microsoft puts strong efforts in providing online services that are compliant with the GDPR and compliant with globally acknowledged security standards. Microsoft has a strong track record in fighting disclosure of personal data for law enforcement purposes. Microsoft 5 Microsoft blog, Cloud-first, mobile-first: Microsoft moves to a fully wireless network, August 17, 2016, URL: https://azure.microsoft.com/nl-nl/blog/cloud-first-mobile-first-microsoft- moves-to-a-fully-wireless-network/ 52 Microsoft Office 365 DPIA, Meeting report 30 August 2018, answer to Q46.

Page 36 of 64 0025 0964 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 is the only cloud provider that promises to legally challenge any order for personal data from its (Enterprise) customers, if it is not allowed to forward the request to its customer. Transfer of personal data outside of the EU Enterprise customers of the Dynamics CRM systems may set the location for processing and storage of the content data to either Western Europe, the EU or EMEA.53 Such a choice is not available for the Diagnostic Data, but Microsoft does make such a choice available for the authentication data of employees interacting with the database. Dynamics CRM is generally deployed in combination with the Azure Active Directory. This system, used for authentication of users, geographically resides on servers in the USA. Microsoft is known to process personal data for further analysis on servers located in the United States.

The techniques are discussed in Section 8.2. Microsoft offers a web page with an overview of the countries and data centres in which it offers Azure services.54 This shows that all Core Azure services, including the authentication data from the Azure Active Directory, can be stored in Western Europe (data at rest). The geolocation map shows that Microsoft offers to host the Azure AD in Ireland and the Netherlands. Figure 6 - Image of geolocation of processing data about authentication** Enter vour company or tenant location to beain. =e a ee ae = AFIE Netherlands NOORD-AMERIKA © © y s EUROPA AFRIKA ZUID-AMERIKA AUSTRALI be Bing 22921 Merosalt Corporation Tem Microsoft explains: “Active Directory stores data globally, with these exceptions: (1) deployments in the United States (where the data is stored solely in the United States) and (2) deployments in Europe (where Active Directory data is stored in Europe or the United States)."5° Microsoft also shows that Dutch government organisations may choose to deploy multifactor authentication from data centres in Ireland and the Netherlands. 53 “Inrichtingsdocument CRM”, Raad van State, 11 April 2019. 54 Microsoft geolocation overview for the Azure Core Services, URL: https://azure.microsoft.com/en-us/global-infrastructure/regions/#services. 55 Ibid., Microsoft Azure Active Directory - Where is your data located? 56 Microsoft, Azure Active Directory - Where is your data located, URL: https://msit. powerbi.com/view er=eyJrljoiYzEyZTCSOTgtNTdIZSO0ZTVkKLWExN2ItOTMOOWU4Nj iJOGVjliwidCl6ljcyZjk4OGJMLTg2ZjEtNDFHZiIOSMWFILTIKN2NKMDExZGIONyIsImMMiOjV9 Page 37 of 64 0025 0965 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Figure 7 - Geolocation of Multi Factor Authentication?”

Enter vour company or tenant location to beain. NOORD-AMERIKA AZIE Netherlands ORD-AMERIKA © €) EUROPA Vieginia AFRIKA ZUID-AMERIKA AUSTRALI b Bing 9 2021 Merveatt Cerporation T 7.1. No overview of (sub-)processors outside of the EU Microsoft does not specify the use of any (sub-)processor outside of the EU for Dynamics CRM and the Azure AD. This does not imply that such processings do not occur, but this DPIA has not been able to establish in which cases it might happen. 8. Techniques and Methods of the Data Processing 8.1. General processings within Dynamics CRM Privacy Company has performed a black-box assessment of the local processing of personal data in the specific deployment of the Council. In contrast with other DPIAs, Privacy Company was not able to intercept any traffic and inspect the resulting logfiles itself, but relied on the information provided by the Dynamics administrators of the Council.

In order to collect information about the data processing through the software, Privacy Company has asked employees of the Council to run several test scenarios. The test user, an employee of the Council, subsequently filed a data access request on the basis of Article 15 GDPR with Microsoft. Microsoft did not send a response within the legally allowed time frame of one month, nor did it send any response to the user at a later date. This failure of Microsoft to reply to a formal Data Subject Access request constitutes a significant risk, that will be further described in part C of this DPIA. The Council provided access to the technical logfiles generated as a result of the execution of the test scenarios, filtered for data that were relevant for the specified User ID. Dynamics CRM collects a multitude of data through its log files, as described in Section 2.1 through to 2.6. Most logs contain personal data.

The different logfiles do not contain any content data (about relations), or otherwise sensitive data. In an on-premise setup, most of these personal data (in the technical log files and in the audit tables) are only accessible for the system administrator of the government organisation, not for Microsoft. However, Microsoft does collect limited personal data in four other ways, namely: 1 Azure AD authentication data 2 Browser telemetry data 3 Tracking pixel data 4 Authentication cookies 57 Ibid, MFA selected as AAD service. Page 38 of 64 179410127 0025 0966 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Microsoft has the ability to update these data streams dynamically, and thus change the collection and impact of the collected personal data. 8.2. Processing through Microsoft Azure Active Directory Regardless of a choice for an on-premise or a cloud deployment of Dynamics CRM, many government organisations will combine the use of Dynamics CRM with use of the Azure Active Directory, as does the Council.

An earlier DPIA about Office 365 conducted for SLM Microsoft Rijk describes how Microsoft collects and processes two types of personal data about the use of the Azure Active Directory. The first category consists of log files that Microsoft collects and processes for its own purposes for auditing, research, user analysis, software debugging, system health analysis and system-wide analysis using machine learning. Microsoft indicates that these files contain usernames. Microsoft writes that it removes personal data from the log files (scrubbing) before processing the data in the machine learning systems for general analysis. Microsoft writes: “Log files contain data about usernames, groups, devices, and apps. Log files are originally created and stored in Azure storage in the data center where the Azure AD service runs. Log files are used for local debugging, usage analysis, and system health monitoring purposes, as well as for service-wide analysis.

Prior to any system-wide analysis, log files are first scrubbed of personal data, which is tokenized. These logs are then copied over a secure SSL connection to Microsoft’s reporting machine learning systems, which are contained in Microsoft owned data centres in the Continental United States."5® In addition, Microsoft describes that it collects a category of ‘Usage data’ on the Azure AD. Not only for the customers, but also for Microsoft’s own purposes, in order to analyse system usage and to be able to improve the service. Microsoft says that it deletes the personal data from the log files in this category prior to their use for analysis. Microsoft writes: “Usage data is metadata generated by the Azure AD service that indicates how the service is being used. This metadata are used to generate administrator and user facing reports and is also used by the Azure AD engineering team to evaluate system usage and identify opportunities to improve the service.

This data are generally written to log files, but in some cases, is collected directly by our service monitoring and reporting systems. Personal data are stripped out of Microsoft’s usage data prior to the data leaving the originating environment."”°? The removal (deletion or destruction) of identifying data after their collection is a processing of personal data. The GDPR applies to this. The fact that Microsoft deletes certain personal data from the log files does not make any difference in the assessment that Microsoft processes personal data via these log files. Having already been assessed in the Office 365 DPIA, the risks associated with the use of Azure AD is out of scope for this DPIA. 58 Microsoft, Azure Active Directory Data Security Considerations - Download Center, version 2.02, 20 June 2020, URL: http://download.microsoft.com/download/A/A/4/AA48DC38-DBC8- 4C5E-AF0O7-D1433B55363D/Azure-AD-Data-Security-Considerations.pdf 5° Tbid.

Page 39 of 64 179410127 0025 0967 9.1. 9.2. 9.3. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Additional legal obligations: ePrivacy Directive In this paragraph, only the additional obligations arising from the ePrivacy Directive (ePD) will be discussed. Given the limited scope of this DPIA, other legal obligations or policy rules (for example with regard to security), are not included in this report. Since users will have access to the Dynamics CRM system through the (Microsoft Edge) browser on hardware of the Council only, and not through mobile apps, the considerations related to mobile apps examined in the Office 365 DPIAs are not relevant in this context. However, Microsoft engages in three types of data processing that are subjected to the ePrivacy Directive rules: (i) the reading of telemetry data from the browser, (ii) the setting and reading of authentication cookies and (iii) the use of a tracking pixel in newsletters.

The ePrivacy Directive regulates the reading or placing of information on end-user devices through the so- called cookie provision in Article 5 (3) ePD. This article generally requires organisations to obtain the prior consent from end-users for this processing of data from end-user devices. Browser telemetry data As described in Section 2.4.3, Microsoft reads telemetry data through dynamic JavaScript when an employee access Dynamics through the browser. Microsoft does not ask for consent from the end users. The collection of personal data through this stream is limited but surprising. If the Dynamics software is used in on-premise deployment, it is not apparent why Microsoft as the product vendor needs to collect information about the use of the product. In an on-premise implementation the Dynamics services are provided by the Council (and other customers) and not by Microsoft. The data processing by Microsoft therefore does not seem to be necessary for the service the Council provides.

Additionally, Microsoft is not transparent about the existence and scope of the data processing. Therefore, these data cannot be qualified as data that are strictly necessary to transmit the service or data that are necessary for any requested functionality by the end-user. This means Microsoft has to obtain prior consent from the end-users before collecting these data. Authentication cookies Microsoft sets cookies when an employee logs-in on Dynamics through the browser. As described in Section 2.4.4, these cookies contain unique identifiers. Since the cookies are necessary to authenticate the user, and do not contain any additional or excessive tracking data, they can be qualified as functional cookies to transmit the authentication request. Therefore, consent is not required. Tracking pixel As described in Section 2.1, Microsoft includes a tracking pixel by default in the newsletters sent through Dynamics CRM.

If customers do not turn off this pixel, based on Article 5 (3) ePD, they must first obtain the end-user consent before information is accessed that was stored on the user’s device. Since the Council does not have the consent of recipients to activate a tracking pixel, the processing of data collected through the tracking pixel violates the ePD. Finally, since the tested version of Dynamics CRM is an on-premise implementation, this DPIA could not inspect the administrator console, to determine if customers may decide to use cookies or comparable techniques. Page 40 of 64 0025 0968 179410127 9.4. 10. 10.1. 10.2. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Sending of newsletters Customers of Dynamics CRM should take the ePrivacy rules into account about the sending of emails. The ePD regulates the sending of unsolicited communication, including email direct marketing in Article 13 ePD.

Sending of such communications is prohibited in Article 13 (1) ePD, but an exception is made in Article 13 (2) ePD for natural or legal persons who obtain the email addresses of their customers in the context of a sale of a product or a service. In the Dutch implementation of the ePD, the Telecommunicatiewet Article 11 (7) specifies that prior consent is required for all unsolicited emails for commercial, idealistic or charitative purposes. When government organisations want to add new recipients to their mailing lists, they generally must rely on prior consent, since they do not ‘sell’ products or services and therefore cannot rely on the opt-out exception. Retention Periods The Council has not yet determined the retention periods of the personal data that it will process through Dynamics CRM. The Inrichtingsdocument does state that the data retention period needs to be determined. Microsoft publishes very little information about the retention periods of the personal data it collects about on-premise deployments of Dynamics CRM.

Since most of the data are collected locally, customers can influence most, but not all of the retention periods. Microsoft does make more information available about the default retention periods when it processes Customer Data and the Diagnostic Data as provider of Dynamics as a cloud service. Customer Data with Dynamics CRM as a cloud service According to its OST, Microsoft retains Customer Data stored in Online Services in a limited function account for 90 days after expiration or termination of Customer's subscription. This applies when Dynamics CRM is used as a cloud service. After the 90-day retention period ends, Microsoft will disable Customer’s account and delete the Customer Data and Personal data within an additional 90 days unless Microsoft is permitted or required by applicable law to retain such data or authorized in this agreement. The contractual framework does not offer a right for Enterprise customers to delete personal data on any other basis than the end of the subscription.

It is not clear if this means that Microsoft may retain (back-ups) of the Customer Data for the entire contract period when Microsoft acts as a processor for Dynamics as cloud service. Diagnostic Data (Dynamics CRM on-premise and cloud) Microsoft publishes very little public information about the retention periods of the different kinds of Diagnostic Data it collects on the use of the Dynamics CRM. If a customer uses Dynamics CRM as a cloud service, Microsoft offers the option to store the log files in the cloud as well, in a Dataverse environment. In that case, Microsoft applies a default sampling frequency of four hours for the audit tables, and a default retention period of 30 days for existing applications. Microsoft declares that Page 41 of 64 0025 0969 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 the retention period is ‘forever’ for any new features.®° Microsoft writes: “When new features are deployed, the audit retention period is set to Forever for all Dataverse environments with existing audit data.”*!

Microsoft does not distinguish in its documentation between on-premise and in the cloud. Microsoft explains: “By default, auditing is enabled on all auditable entity attributes, but is disabled at the entity and organization /evel.”© It is plausible that this policy applies regardless of the type of deployment. Microsoft describes a possibility for system administrators to either delete individual Diagnostic Data or to select a date range: “After auditing is enabled and data changes are made to those entities and attributes being audited, you can proceed to obtain the data change history. Optionally, you can delete the audit records after you review the change history.”® Microsoft does not provide public information about the retention periods of other Diagnostic Data. This DPIA shows that Microsoft at least collects Diagnostic Data through three other channels: ° Technical log files (cloud only) ° Browser telemetry data e Authentication cookies The lack of transparency prevents Enterprise customers from exercising control over the means of the processing (the retention period determines the scope of the processing), and thus, from fulfilling their role as data controller. °° Microsoft, Start/stop auditing and set retention policy, 11 January 2021, URL: https://docs.microsoft.com/en-us/power-platform/admin/audit-data-user-activity#startstop- auditing-and-set-retention-policy 51 Tbid. 62 Microsoft, Audit data and user activity for security and compliance 11 January 2021, URL: https://docs.microsoft.com/en-us/power-platform/admin/audit-data-user-activity 63 Microsoft, Retrieve and delete the history of audited data changes, 14 October 2020, URL: https://docs.microsoft.com/en-us/powerapps/developer/data-platform/retrieve-and-delete- the-history-of-audited-data-changes Page 42 of 64 0025 0970 179410127 11. 11.1. 11.2.

DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Part B. Lawfulness of the data processing Legal Grounds Any processing of personal data has to be based on a specific legal ground, as specified in Article 6 (1) GDPR. Several legal grounds might apply to different parts of the processing through Dynamics CRM. This part of the DPIA report will examine each of the legal grounds available for applicability. Only the ground of vital interest (Article 6 (1) (d) GDPR will not be discussed, since there is obviously no vital interest of a data subject at stake in maintaining a CRM system. Consent Article 6 (1) (a) GDPR reads: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. If a data subject has freely given consent for the processing, such consent can be the legal ground for the processing of the data. This does require that the consent was freely given, after the data subject has been informed about the scope and potential risks associated with the processing.

It also requires that the data subject is able to withdraw the consent, without consequence. The Dynamics CRM implementation of the Council only relies on the explicit consent of the data subject when storing information about dietary requirements and allergies. This consent is obtained from the data subject in a separate way, not through the Dynamics CRM system. No documentation has been provided by the Council to show directly how the consent is obtained and stored. Microsoft does not offer a digital dashboard for data subjects to exercise their rights digitally, such as withdrawal of their consent. Employees can however withdraw consent on behalf of a data subject, when asked. No procedure has been provided by the Council that describes how the withdrawing of consent should be handled. Microsoft cannot as a controller rely on consent for the processing of Diagnostic Data. Only data subjects who are employees of the Council would be in a position to actively give consent.

Given their dependence on their employer they may not feel free to make such a decision. Thus, consent cannot be validly obtained from the data subjects, neither by the Council nor by Microsoft as a controller. Consent is therefore not a valid legal ground for Microsoft for the processing of Diagnostic Data. The ePrivacy Directive (ePD) requires consent when adding and reading a tracking pixel in a newsletter. Government organisations must therefore obtain the prior consent of recipients for this activity with the purpose of tracking the way they read the newsletter, or instruct Microsoft to turn off the tracking pixel. Other legal grounds of processing are not relevant for this processing, since the ePD requires consent. The Council does not obtain such consent, but the tracking pixel is present in the newsletter. This processing in its current form at the Council is therefore not legitimate.

Processing is necessary for the performance of a contract Article 6 (1) (b) GDPR reads: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.” Government employees are provided with a Dynamics account to be able to carry out the tasks included in their job description. In its privacy-improved contract with the Dutch government, Microsoft limits its processing of employee data to what is necessary for the functioning of the applications. Microsoft is contractually restricted Page 43 of 64 0025 0971 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 to only process personal data for the three purposes mentioned previously. Therefore, governmental organisations may successfully rely on this legal ground if the processing of the Diagnostic Data from these services is strictly necessary for the performance of the employment contract between the data subject and the governmental organisation.

This legal ground, however, is only applicable insofar as Microsoft qualifies as processor for the Dutch governmental organisation. Microsoft itself does not have a contract with the data subjects, and therefore cannot itself rely on this legal ground as a controller for any part of the processing. Even if checking a box to use a service or downloading an app without any information about the consequences in terms of personal data processing could possibly qualify in civil law as an intention to conclude an agreement, the processing does not meet the requirements of the legal ground of Article 6 (1) (b) in the GDPR: the necessity to process specific personal data to perform a specific contract with each specific data subject. Absent comprehensive documentation about the nature, volume and specific purposes of the Diagnostic Data processing, Microsoft is unable to demonstrate the necessity of the processing of these personal data and lacks the contract with the data subject to do so under this legal ground. 11.3.

Processing is necessary to comply with a legal obligation Article 6 (1) (c) GDPR reads: “processing is necessary for compliance with a legal obligation to which the controller is subject.” This legal ground can only be invoked for specific purposes if these purposes have been laid down in the law. The processing of personal data should follow directly from this law, or should be implicitly included. Though there is a general legal obligation in the GDPR to guarantee the security of personal data, the GDPR does not specify what personal data have to be processed for this security purpose. So, there is no specific legal obligation following from the GDPR to process Diagnostic Data or to retain (audit) log files for an extended period of time. However, Article 32 (1) (d) of the GDPR obliges organisations to have a process for regularly assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

Organisations need to periodically review the log files to detect if any incidents or breaches have occurred. The ICO explains: "If you operate automated processing systems (any IT database), you must keep logs for at least the following processing actions: e Collection e =6Alteration e Consultation e Disclosure (including transfers) e Combination « Erasure’®4 It follows from Article 28 GDPR that data controllers may only use data processors that provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 64 ICO, logging, URL: https://ico.org.uk/for-organisations/quide-to-data-protection/quide-to- law-enforcement-processing/accountability-and-qovernance/logging/ Page 44 of 64 179410127 0025 0972 179410127 11.4. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Even though logging is necessary, the legal security obligations in the GDPR are not specific enough for organisations to rely on this legal ground.

However, they may only use data processors that can provide adequate logging to ensure the security of the data processing. Processing is necessary for a task in the public interest or for the legitimate interests of the controller or a third party Article 6 (1) (e) GDPR reads: “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. Article 6 (1) (f) GDPR reads as follows: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." While the Council clearly is processing personal data in Dynamics CRM in the context of performing its public duties, this legal ground does not apply to the processing described in this DPIA.

The Council does not have any specific public duties to maintain contact lists of relations, or to organise events, including the registration of dietary preferences or allergies of invited attendees. The processing of these personal data in Dynamics CRM is not necessary for the Council to perform its public tasks even if such data processing does strengthen those public tasks. Other government organisations may well be able to rely on this legal ground for the processing of content data through Dynamics CRM, depending on the information they process and the tasks in the public interest assigned to them. Processing of Diagnostic Data by Microsoft for its own purposes is too far removed to be able to be justified on the basis of necessity to perform tasks in the public interest. There is no specific public interest served by using specific Microsoft services. Microsoft mistakenly claimed in its response to the initial Office 365 ProPlus DPIA report that it could rely on the legal ground of necessity for the greater public interest in fighting cybercrime and identity theft.

Microsoft has however not been specifically charged by any law or regulation to perform this task, which would be required to make this claim successful. Government organisations can seldomly rely on the legal ground of necessity of the processing for their legitimate interest. As the last sentence of Article 6 (1) GDPR specifies, this legal ground shall not apply to processing carried out by public authorities in the performance of their tasks. Whether this includes all activities by public authorities remains to be determined in decisions from Data Protection Authorities or jurisprudence. When government organisations do not perform a task in the public interest through the use of (specifically) Dynamics CRM as a database, the necessity for the legitimate interest is the only available legal ground. This requires the organisations to clearly specify their legitimate interest and to weigh it against the rights and freedoms and the interests of the data subjects.

If the rights, freedoms, or interests of the data subjects override the legitimate interests of the government organisation, the processing cannot be lawful. The Inrichtingsdocument® and other project documentation state that the Council does indeed rely on its legitimate interest for the bulk of the processing of personal data of external relations through Dynamics CRM. The documents do not specify 65 “Inrichtingsdocument CRM”, Raad van State, 11 April, 2019, bijlage 4 Page 45 of 64 0025 0973 12. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 exactly what that legitimate interest is and do not weigh the Council’s legitimate interest against the rights, freedoms, and interests of the data subjects. Therefore, while legitimate interest may be a valid legal ground, the Council has so far failed to meet the requirements attached to it. Processing of the content data as well as of the Diagnostic Data is therefore not legitimate as long as those requirements have not been met.

The processing of personal data by Microsoft as a processor falls within the scope of the legitimate interest of its Enterprise customers as data controllers. Only if Microsoft processes personal data in a role as data controller, the legal ground of the legitimate interest of Microsoft needs to be separately considered and weighed against the rights, freedoms, and interests of the data subjects. Special categories of personal data The GDPR forbids the processing of special categories of personal data, unless one of the exceptions listed in Article 9 (2) applies. Depending on the way an organisation implements Dynamics CRM, it is possible that special categories of personal data are included in the processing, as is the case with the Council. If they are, they may also be included in certain types of processing of Diagnostic Data by Microsoft. This has not been found to be the case at the Council.

The special categories of personal data have been found in the audit tables, but not in Diagnostic Data. Which exception applies for the government organisation implementing Dynamics CRM depends on the purpose for which it collects and stores the information in Dynamics CRM. A valid exception has to be fully applicable and the conditions under which it can be used have to be met. The government organisation has to be able to demonstrate that it meets these requirements. The exception would also have to apply to the recording of the special categories of data stored after removal in the audit tables. Of the defined exceptions that are available, only two can possibly be relied on by the Council when processing special categories of personal data: explicit consent, or apparent publication of the data by the data subject. The Dynamics CRM system implemented at the Council will connect the contact persons with the organisation they work for.

Given the constitution of the contacts of the Council, this can be revealing of the political or religious background of these contact persons, or possibly of other types of special categories of personal data. In these cases, the Council claims in the Inrichtingsdocument that the data subjects have themselves apparently made this information public, which is the exception provided in Article 9 (2) (c) GDPR®®. The specific implementation of Dynamics CRM by the Council also includes information about diets and allergies of attendees of events, that is used to make sure people receive the right meal. Since dietary requirements can reveal information about religion or health, and allergy information is always about health, these data types fall under the prohibition in Article 9 (1) GDPR. The Council claims to only record these dietary data when the data subject has given explicit consent to do so to protect their vital interests, as the Inrichtingsdocument phrases it.6?

This DPIA has not established how the Council records this explicit 6 “Inrichtingsdocument CRM”, Raad van State, 11 April, 2019, p. 6 57 Tbid. Page 46 of 64 0025 0974 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 consent, and whether it extends beyond a single event. Nor does it restrict access to these fields, based on a need-to-know basis. This leads to the conclusion that this processing goes beyond what is necessary for the purposes the Council collects these data and is therefore not legitimate. The storage of the dietary and allergy information in the audit tables for security purposes can be considered legitimate if the primary processing is legitimate. Storage of these data after the expiration of the retention period is not legitimate. 13. Purpose limitation Article 5 (1) (b) GDPR obliges data controllers to comply with the principle of purpose limitation. Data may only be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89 (1), not be considered to be incompatible with the initial purposes.”

Essentially, the above means that the controller must have a specified purpose for which he collects personal data and can only process these data for purposes compatible with that original purpose, unless the controller can meet additional requirements, that must be met before any further processing can take place. 13.1. Purposes of the Council of State The purposes of the Council for the processing of personal data in the scope of this DPIA have been formulated in Chapter 4 as: 1 Relationship management 2 Organisation of meetings and events, segmentation of contacts and sending of letters and (e-)mail(ing)s. As was mentioned in Chapter 4, this fails to include a specific and explicit purpose for maintenance and security of the service, which is an obvious purpose that should be added. The data processed through Dynamics CRM are collected during three processes. Data about contacts of the Council will be and have been collected for the purpose of relationship management and entered into the system by employees of the Council.

Data about meetings and especially about dietary requirements and allergies is collected through the registration process and fed into the Dynamics CRM system. Data about the use of the application is directly collected by the logging and auditing systems. The second purpose relies on the processing of data collected for the first purpose. It is essential then, to determine whether the second purpose is compatible with the first purpose, in the sense of Article 5 (1) GDPR. Article 6 (4) states how this determination needs to be executed: “...the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia: (a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing. (b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller.

Page 47 of 64 179410127 0025 0975 13.2. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 (c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10. (d) the possible consequences of the intended further processing for data subjects. (e) the existence of appropriate safeguards, which may _ include encryption or pseudonymisation.” The link (a) between purpose 1 and 2 is clear. The collection has taken place for the purpose of managing the relationship between the Council and the data subject. The data subject will expect the Council to organise events and meetings, and to send mailings, and the data subject will expect to be included in those communications. Even if the purpose has not been made explicit on the collection of the data, very few data subjects can be expected to object to this processing.

The processing therefore makes sense, within the context (b) of the relationship of the Council with the data subject. The personal data collected for purpose 1 can include data of a sensitive nature (c), particularly when the private contact details of prominent people are included. These data are however only collected with explicit consent of those people, who will expect that the data can be used for the specified purposes. The possible consequences of the intended processing for the data subjects (d) are limited. No significant negative effects on their rights and freedoms are to be expected under normal operating conditions. There are appropriate safeguards (e) in place, so it can therefore be concluded that the two purposes are to be seen as not incompatible in the sense of the GDPR. The third, implicit purpose of maintaining and securing the system is also a logical extension of purpose 1.

Data subjects can expect the processing to occur, even if they will often not be familiar with the details of the processing. However, if the collection of data in audit tables infringes on the right of the data subject to have their data deleted after they are no longer necessary for the purpose they were collected for, or after they requested deletion, that infringement exceeds the requirement of purpose limitation. Purposes for which Microsoft processes personal data Within the enrolment framework, Microsoft has been authorised to process personal data for three purposes. These are: 1 to provide and improve the service, 2 to keep the service up-to-date, and 3 to secure the service. These purposes are fulfilled with personal data collected during the use of Dynamics CRM and are supposed to be only about data subjects who are employees of the Council. These purposes are set by the Council and Microsoft acts as processor.

It is reasonable to expect that users will not be surprised or taken unaware that Microsoft is working to keep the service up-to-date or securing it. That their personal data might be used to achieve those secondary purposes is to be expected. Following Article 6 (4) GDPR, the link (a) between the further processing and the original collection is clear; the context (b) of the collection implies this role for Microsoft to Page 48 of 64 0025 0976 179410127 14. 14.1. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 the data subject; the nature (c) of the personal data collected of the employees of the Council is quite neutral and any direct negative impact on the rights and freedoms from the processing for these purposes is unlikely (d). As long as the appropriate safeguards are in place (e), the processing of the data needs to be seen as not incompatible with the purpose for which they were collected.

Any other purpose of Microsoft would not be compatible with the purpose the data was collected for. Therefore, the use of personal data for profiling, data analytics, market research and advertising purposes has been explicitly forbidden in the contract with SLM Rijk, for both the Customer Data and the Diagnostic Data. Necessity and proportionality Article 5 (1) (c) GDPR requires that every processing is limited to what is necessary to achieve the set purpose. It is therefore important to examine whether every processing is in fact necessary for the purposes for which the data controllers process personal data. The personal data which are processed must be necessary for the purpose pursued by the processing activity. The concept of necessity is made up of two related concepts: proportionality and subsidiarity. First it has to be assessed whether the same purpose can reasonably be achieved with other, less invasive means (subsidiarity).

If so, these alternatives have to be used. Second, proportionality demands a balancing act between the interests of the data subject and the data controller. The benefits of the processing for the data controller need to exceed the infringement it represents on the rights and freedoms of the data subjects. The processing should also not be excessive in relation to the purpose of the processing. If the purpose can be achieved by processing fewer personal data, then the amount of personal data processed should be decreased to what is necessary. Therefore, essentially, the data controller may process personal data insofar as is necessary to achieve the purpose, but may not process personal data he or she may do without. Assessment of the subsidiarity Processing personal data is only acceptable if the same goals cannot be reached using less intrusive means. The Council processes data through Dynamics CRM for two purposes, that are closely linked, and for additional purposes relating to maintenance and security.

In order to function as a highly visible and active public body, the Council has to collect and process the data of their contacts and is expected to regularly organise meetings and invite their contacts. For that reason, the personal data categories enumerated in Paragraph 2.2 are necessary. The processing of personal data of employees is indirectly linked to the stated purposes the Council is processing data for. Creating audit logs might be the only way to achieve important purposes, but since the purposes have not been made explicit, it is not possible to test them for subsidiarity. The audit logs contain data from the contacts of the Council that have been deleted, with the purpose of being able to restore them if a mistake was made. The alternative to actually delete the information would be less intrusive. Since no case has been made that the ability to restore deleted records is vital to the functioning of the Page 49 of 64 0025 0977 14.2. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Council, this part of the processing is not strictly necessary, but merely handy, and therefore not in accordance with the subsidiarity principle.

Prior to the contractual improvements achieved by SLM Rijk for Dutch government organisations in May 2019, Microsoft was of the opinion that government organisations were free to determine the purposes for which Diagnostic Data were processed, by (1) choosing whether or not to use the product, and (2) to determine the scope of the processing by selecting the appropriate settings. CRM products are widely available, many developed specifically for enterprise-level organisations, with hundreds or thousands of employees. Microsoft has many more direct competitors for this product, than it has for its operating system or for its Office suite. The realistic alternatives often come with the same or similar processings and involve similar risks to the rights and freedoms of the data subjects. From the perspective of the Council, there is no alternative that seems materially better at the protection of the rights and freedoms of the data subjects.

The data collected and processed by Microsoft for the three purposes agreed contractually are necessary parts of keeping the software running. Questions can be raised over the amount of data processed for these purposes. The audit logs in particular, often seem to be more handy than necessary, although only Microsoft can ultimately determine which parts of the logs might be removed. The risk that Microsoft would process data beyond the three stipulated purposes has been contractually removed. The processing of data for the tracking pixel in the newsletter is not strictly necessary for the purpose of sending newsletters. Microsoft is not transparent about the processing of telemetry data collected through Javascript. The purpose of this collection is unclear, which makes it impossible to determine the subsidiarity or proportionality. Assessment of the proportionality When the Council collects data about their contacts, the data subjects or their staff provide these for them.

The data subjects provide content to the Council for the processing of their data for these purposes, and they are free to request termination of the processing. The interests of the Council and of the data subject are therefore closely aligned. This is true in particular for the processing of dietary requirements, in order to prevent triggering an allergy, for instance. The data subject will have provided this information personally and has a clear interest in a careful consideration of this information. The processing is therefore proportionate in relation to the specific event the data was collected for. It is also proportionate to retaining that information for use in future events if the data subject has consented to that retention. Collecting data in audit tables about changes to the database, including the personal data that was changed, is important for the purpose of maintaining the integrity and in order to repair mistakes.

This conflicts to some degree with the requirement to irreversibly delete data after it is no longer necessary for the purpose for which it was collected. The ICO explains: “Jt is important that you do not record the data itself in your logs of erasure, as there is no need to retain a duplicate record of what you have erased. The requirement is to produce metadata which displays, for example, what a specific person on a specific date erased. The ‘what’ does not have to detail the content of the Page 50 of 64 0025 0978 179410127 LS. 15.1. 15.2. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 record/information that has been deleted — it can simply record that record X was updated by a specific individual.”®® This statement can be nuanced for two different scenarios. In the first case, personal data have to be irreversibly deleted because of a legal obligation (the data subject has objected, or the organisation does not have a legal ground to continue the data processing).

In the second case, an organisation needs to have a limited recovery option to correct accidental deletions. In order to comply with the proportionality principle, the organisation must limit this recovery period to the absolute minimum, and take organisational measures to make employees aware of the risks of changing or deleting personal data. In general, the data subjects run little risk by the processing of data for the purposes investigated in this DPIA, the proper and secure functioning of the application is also in the interest of the data subjects, as it reduces the risk of data breaches. However, Microsoft has not been forthcoming with information about the content of some of the Diagnostic Data collected. Microsoft failed to respond to the data subject request for access filed in the context of this DPIA. The proportionality of unclear processings cannot be determined. In sum, the processing of data in the audit tables leads to a risk of illegitimate processing if the Council does not remove deleted data in a timely manner.

The purpose of collecting telemetry data through Javascript is unclear and _ its proportionality cannot be determined. Otherwise, the processings by the Council, investigated in this DPIA are proportional to their purposes. Rights of data subjects The GDPR grants data subjects a number of privacy rights. Right to information Firstly, under Articles 13 and 14 GDPR, data subjects have a right to information. This means that data controllers must provide people with easily accessible, comprehensible and concise information in clear language about, inter alia, their identity as data controller, the purposes of the data processing, the intended duration of the storage and the rights of data subjects. In general, the data controller can adequately inform the data subjects who are contacts of the government organisation of the inclusion of their data in Dynamics CRM. As has been highlighted in previous sections of this DPIA, Microsoft does not provide information about the processing of Diagnostic Data through Dynamics CRM.

Microsoft does not provide this information in a technical language for admins, nor in a clear and simple language for employees or other data subjects whose personal data may be involved in this data processing. As a result, the government organisations, as joint data controllers with Microsoft, are unable to adequately inform their employees or other users of the processings. Right to access Secondly, under Article 12 GDPR, data subjects have the right to request access to personal data about them that are subject to processing. Upon request, data ®8 ICO, Logging, In brief, URL: https://ico.org.uk/for-organisations/guide-to-data- protection/guide-to-law-enforcement-processing/accountability-and-governance/logging/ Page 51 of 64 0025 0979 15.3. 15.4. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 controllers must inform data subjects whether they are processing personal data about them.

If this is the case, the data controller should provide the data subject with a copy of the personal data processed, with additional information, such as the purposes of processing, the recipients to whom data have been transmitted and the period for which personal data are to be stored. The government organisation implementing Dynamics CRM has the ability to fully answer any request by a contact person whose personal data are stored in Dynamics CRM. The Diagnostic data that is collected in logfiles and audit tables can also be retrieved and be provided to a data subject (an employee of the government organisation). Microsoft provides no information about the meaning of the data collected in the logfiles, which means that the government organisation cannot be sufficiently transparent about the data and the implications of their collection to the data subjects. Microsoft engages to “comply with reasonable requests by Customer to assist with Customer's response to such a data subject request.”©?

However, the request filed with Microsoft by an employee of the Council for the purposes of this DPIA has not been answered. Under the OST, Microsoft is a processor for these data and should have responded to this request by alerting the data controller, and making all data collected through JavaScript and other means to the data controller. Not following up on this request is a violation of the rights of the employee under the GDPR. In sum, when users of Dynamics CRM (employees) exercise their data access rights under the GDPR they only obtain information about the use of Dynamics CRM as contained in hard-to-read logfiles and audit tables - if enabled. Microsoft did not provide access to Diagnostic Data collected by them regarding the use of Dynamics CRM. Nor did it provide insight into the meaning of much of the Diagnostic Data collected. When other data subjects exercise their data access rights, the Council is able to supply them with a full overview of the data concerning them that are stored in Dynamics CRM.

Right of rectification and erasure Thirdly, under Article 16 to 17 GDPR, data subjects have the right to have inaccurate or outdated information corrected, incomplete information completed and - under certain circumstances - personal information deleted. The government organisation has the ability to delete data from Dynamics CRM when a data subject who is a contact person of the Council so requests. It can also update data, where necessary. In the current setup, however, the deleted or outdated data will still be available for some time in de audit tables. This enables the government organisation to reverse a mistaken deletion or correction, but at the same time infringes on the right of the data subject to have their data deleted or incorrect data corrected. As was discussed in Section 14.2 of this DPIA, this can only be legitimate if the recovery data is stored for a short time only. Right to object to processing, including profiling Fourthly, under Article 21 GDPR, data subjects have the right to object to an exclusively automated decision if it has legal effects.

When processing data about the use of Dynamics CRM there are no known decisions that the Council or Microsoft makes that have legal consequences or other noteworthy consequences for the rights and freedoms of the data subjects. Therefore, this specific right of objection does not apply in this case. 69 OST May 2019, p. 8. Page 52 of 64 0025 0980 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 15.5. Right to data portability This right has no meaning for the processings investigated for this DPIA, as the right to data portability is limited to processings that rely on consent or contract. 15.6. Conclusion Where Content Data are concerned, the government organisation is able to honour the rights of the data subject, but only if the processing of data in audit tables is limited to a very short period, if the data subject has requested deletion or correction. For Diagnostic Data, the government organisation using Dynamics CRM _ lack information about the meaning of the logfiles and lack insight into any processing of Diagnostic Data by Microsoft.

Page 53 of 64 179410127 0025 0981 16. 16.1. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Part C. Discussion and Assessment of the Risks This part concerns the description and assessment of the risks for data subjects. This part starts with an overall identification of the risks in relation to the rights and freedoms of data subjects, as a result of the processing of metadata and content in the Diagnostic Data. The risks are described for government employees, and for other data subjects that interact with government, in the case of this DPIA contact persons of the Council. Risks Identification of risks The processing of personal data through Dynamics CRM by the Council and the associated Diagnostic Data by Microsoft results in seven risks, that arise in two distinct domains: the processing of the content data by the government organisation and the processing of Diagnostic Data both by Microsoft and the government organisation.

These risks have been enumerated below, split out between risks that apply at least in part to Microsoft and risks that apply strictly for the government organisation. In addition, four risks were found to be unique to the particular situation at the Council of State. Those risks have been added at the end. Risks that apply mostly to the government organisation deploying Dynamics CRM are: Risk 1. Possible unlawful further processing of special categories of data in audit tables. Risk 2. Tracking pixels require consent. Risk 3. Inability to remove data after expiration of retention period. Risks that apply at least in part to the processing by Microsoft are: Risk 4. Inability to exercise data subject rights. Risk 5. Lack of transparency about the processing of logging data. Risk 6. Lack of transparency about NPS related processing. Risk 7. Transfer of limited set of Diagnostic Data to USA: possible unlawful access.

Four of the risks discovered by this DPIA apply strictly to the situation at the Council. These depend on the type of data collected by the Council or on specific circumstances unique to the council. Risk 8. Inability to delete contact person data after expiration of retention period. Risk 9. Incomplete documentation of legitimate interest. Risk 10. Unlawful processing of special categories of data. Risk 11. Incomplete record of safeguards for sharing data with external parties. These risks have to be assessed against the likelihood of the occurrence of these risks and the severity of the impact. The UK data protection commission ICO provides the following guidance: "Harm does not have to be inevitable to qualify as a risk or a high risk. It must be more than remote, but any significant possibility of very serious harm may still be enough to qualify as a high risk. Equally, a high probability of widespread but more minor harm Page 54 of 64 0025 0982 179410127 16.2.

1. Risk 2. Risk 3. 16.3. Risk 4. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 might still count as high risk.””° In order to weigh the severity of the impact, and the likelihood of the harm for these generic risks, this report combines a list of specific risks with specific circumstances of the specific investigated data processing. Assessment of risks related to government organisations Possible unlawful further processing of special categories of data in audit tables The fact that all changes to the Dynamics database get recorded in the audit tables creates the risk that Dynamics CRM processes special categories of personal data in violation with the prohibition to process these data. The processing of these data is prohibited unless an exception can be shown to apply. Depending on the exception that applies to the processing of these data by the government organisation, the exception may not apply to the further processing in the audit tables.

In addition, depending on the exception, additional restrictions on access to these data may be circumvented by their inclusion in the audit tables, where set restrictions do not necessarily apply. The default retention period of three months for the audit tables may also be too long to be legitimate. This implies that the risk will certainly and systematically occur (high likelihood) if special categories of personal data are processed through Dynamics CRM, and the audit tables are turned on. The impact associated with the risk is high because of the sensitive nature of the data. Tracking pixels require consent When sending newsletters, by default Dynamics CRM will include a tracking pixel in each mail sent, that allows Dynamics to determine when and how often an email is opened by the receiver. Under the ePrivacy Directive this use of a recipient’s device requires consent. There is a severe risk that the government organisation neglects to get consent from all subscribers for this tracking behaviour.

This is a risk with medium impact, but that will systematically occur. Microsoft has updated Dynamics to create the option to switch off this behaviour. Inability to remove data after expiration of retention period. Dynamics CRM offers the option to add data to undefined property fields for each contact person. These properties can contain any type of information. They appear to be most useful to record temporary information, for instance participation in events. The properties can be inactivated, which makes them invisible, but which does not in fact delete the information from the database. The properties can be reactivated. This means that there is a chance that the data will persist after the retention period expires. The impact of this risk is low, as longs as the data collected are not very sensitive. The likelihood of this risk is high since this default behaviour is likely not to be well understood by the users of the system.

Assessment of risks related to Microsoft Inability to exercise data subject rights An employee of the Council has filed a data access request with Microsoft in order to obtain additional information about the Diagnostic Data collected during the execution of the testing scenarios. No response was received, while there are clearly at least some data collected by Microsoft that are not explained to the data controller. If Microsoft considers itself a data processor for these data, it should have forwarded 70 TCO, How do we do a DPIA?, URL: https://ico.org.uk/for-organisations/quide-to- dataprotection/quide-to-the-general-data-protection-requlation-qdpr/data-protection- impactassessments-dpias/how-do-we-do-a-dpia/ Page 55 of 64 0025 0983 Risk 5. Risk 6. Risk 7. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 the request to the data controller. If it considers itself a data controller for these data, it should itself have responded to the data subject, but in that case, it would have been in violation of the amended OST.

Whatever the reason behind the lack of response, the data subject was clearly not able to exercise their rights. The violation of the rights of a data subject is a high impact risk. Lack of transparency about the processing of logging data Dynamics CRM generates several types of logging data. Some of these are accessible by Microsoft, and some, like the logfiles, have not been demonstrated to be available to Microsoft, though the absence of evidence should not be taken as evidence of absence without more detailed information from Microsoft. Microsoft does not provide any explanation of the meaning of data collected in the logfiles. This means that the government organisation cannot adequately inform the data subjects (its employees) about the processing of Diagnostic Data. Microsoft also collects Diagnostic Data itself, at least through the JavaScript library. Although this DPIA has only found limited amounts of personal data sent to Microsoft in this way, Microsoft has not disclosed any information about the purpose or meaning of the data processed.

Additionally, Microsoft has the ability to unilaterally change the Diagnostic Data that it collects in this way. This situation leads the conclusion that there is a high chance that personal information is being processed without the required level of transparency. The impact of this processing is medium, since the data found to be processed in this way is of limited sensitivity. Lack of transparency about NPS related processing Dynamics CRM sometimes collects Diagnostic Data on whether the user of the system has been approached for a NPS measurement. This is a common market research tool. Processing of personal data for such purposes was excluded from the OST. It is unclear whether this is a remnant of functionality no longer in use, or something that was not activated. No documentation has been found detailing the use of this part of Dynamics. This lack of transparency means that the government organisation cannot fully inform the data subjects (its employees) of this processing.

This processing seems to be activated by default and cannot be shut down. The impact of the processing is low, since no evidence has been found that the data is shared with any other party than the government organisation, and only a single indicator is stored, showing that the NPS questionnaire hasn’t been activated. Transfer of limited set of Diagnostic Data to USA: possible unlawful access The transfer of personal data outside of the European Economic Area (EEA) poses a risk in itself, because the standard of protection of personal data in most countries in the world is lower than in the European Union.7! As has been explained in paragraph 12, there are risks related to unlawful further processing of personal data (i) through orders to Microsoft Corporation from USA law enforcement authorities, security agencies and secret services, (ii) through rogue 71 The GDPR applies in the European Economic Area.

This includes the member states of the EU and Iceland, Liechtenstein and Norway. Page 56 of 64 0025 0984 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 administrators at Microsoft and at sub processors, and (iii) through hostile state actors. While Microsoft undertakes to ensure a uniformly high standard of protection, this protection cannot be guaranteed against government interference of third countries outside the EEA. Therefore, there is a non-negligible risk that information held by Microsoft in a data centre in a third country can be accessed by local governments, through a hack or by forcing an administrator to do so. With regard to the risk of hacks through rogue administrators or hostile state actors, on-premise local hosting does not offer better guarantees for a timely detection of new risks, and implementation and monitoring of up-to-date security measures. Microsoft has a very large number of dedicated security staff and controls the legitimacy of access to personal data with technical and organisational measures that are regularly audited.

These risks (of access to personal data by law enforcement authorities and security agencies in the USA) apply equally to the Customer Data stored on Microsoft's cloud servers as well as to the Diagnostic Data, and they apply worldwide. Even though Microsoft provides guarantees with regard to storage of Customer Data in datacentres in the Netherlands and Ireland, USA courts reserve the right to request access to these data under the USA CLOUD Act. This act essentially extends jurisdiction of the US-American courts to all data held by American corporations, even when that data are stored in data centres outside of the territory of the United States. As explained in section 5.2 of this report, Microsoft bi-annually publishes a transparency report about the amount of law enforcement requests it has received. Microsoft explains that very few law enforcement requests relate to Enterprise cloud customers.72 According to the OST, Microsoft will in principle always inform the data controllers if the company receives such a request.

Microsoft has explained that there is a very high legal bar for blind requests in the Enterprise environment (where Microsoft would get a nondisclosure order). In the OST, Microsoft says: "Microsoft will not disclose Customer Data to law enforcement unless required by law. If law enforcement contacts Microsoft with a demand for Customer Data, Microsoft will attempt to redirect the law enforcement agency to request that data directly from Customer. If compelled to disclose Customer 72 Microsoft writes in its transparency report about law enforcement requests, in answer to a question about the number of requests for data from Enterprise customers: “In the second half of 2018, Microsoft received 61 requests from Jaw enforcement around the world for accounts associated with enterprise cloud customers. In 39 cases, these requests were rejected, withdrawn, or law enforcement was successfully redirected to the customer.

In 22 cases, Microsoft was compelled to provide responsive information: 15 of these cases required the disclosure of some customer content and in 7 of the cases we were compelled to disclose non- content information only. Of the 15 instances that required disclosure of content data, 8 of those requests were associated with U.S. law enforcement.” In answer to question about the effects of the CLOUD Act Microsoft writes: “In the second half of 2018, Microsoft received 4,369 legal demands for consumer data from law enforcement in the United States. Of those, 103 warrants sought content data which was stored outside of the United States. In the same time frame, Microsoft received 36 legal demands from law enforcement in the United States for commercial enterprise customers who purchased more than 50 seats. Of those demands, 1 warrant resulted in disclosure of content data that was stored outside of the United States.”

Microsoft, Law Enforcement Requests Report, URL: https://www.microsoft.com/en- us/corporate-responsibility/lerr/. Page 57 of 64 179410127 0025 0985 16.4. Risk 8. Risk 9. Risk 10. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Data to law enforcement, Microsoft will promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so.”7? For the Dynamics CRM system, the main reasons of concern are the access by law enforcement of data stored and processed in the EEA and the access to Diagnostic Data transferred to the USA, in particular as related to the Azure AD. The chance of Customer Data being accessed seems low in light of the statistics shared by Microsoft. The impact of such transfer on the rights and freedoms of the data subjects could be medium. The chance of Diagnostic Data being intercepted in the USA seems medium to high, whereas the impact on the rights and freedoms of those data subjects is minimal, given that the data are not very sensitive.

Assessment of risks specific to the Council of State Inability to delete contact person data after expiration of retention period The Council implementation of Dynamics CRM includes the collection of records of updated and deleted data in the audit tables. These data contain the old values for every edit, and a record of all deleted data. While these audit tables, when implemented correctly, might help to prevent and correct mistakes, and can help to determine and mitigate the damage done during a severe data breach, it also creates a risk for the rights and freedoms of the data subjects, as the data contained are themselves probably incorrect, out of date, or obsolete. In particular, it is clear that these tables currently do not respect any reasonable retention period, since data have been found that were older than the claimed three months they were supposed to be available for. After the purpose for which the data were collected has expired, the data need to be definitively deleted, but in fact get transferred to these audit tables.

This risk will certainly and systematically occur. The impact is medium. Incomplete documentation of legitimate interest The Council processes Diagnostic Data and most content data to pursue its legitimate interests. This legal ground requires that the controller assesses whether these legitimate interests are not overridden by the interests, fundamental rights or freedoms of the data subjects. This assessment has not taken place, which means that the legal ground cannot be valid. Starting the processing without this assessment, and a conclusion that the interests, fundamental rights and freedoms of the data subjects do not override the interest of the Council, is a violation of the rights of the data subjects. However, a preliminary consideration of the interests, rights and freedoms involved suggests that the Council should be able to successfully stake a claim to such a legitimate interest, which lowers the impact to medium, whereas the chance that the risk occurs is high until the Council fulfils the assessment.

Unlawful processing of special categories of data The fact that all changes to the Dynamics database get recorded in the audit tables creates the risk that Dynamics CRM processes special categories of personal data in violation with the prohibition to process these data. The processing of these data is prohibited unless an exception can be shown to apply. The Council processes two types of special categories of personal data: political or religious affiliation, and health data. In the case of political affiliation, the Council relies on the exception that the data subjects have clearly made this information public. This is sufficient to make the processing of these data legitimate, including 73 Microsoft OST, June 2019. Page 58 of 64 0025 0986 179410127 Risk 11. 16.5. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 retaining the data in the audit tables after deletion or updates, as long as the retention period is limited.

For dietary and allergy information the Council relies on explicit consent, but this DPIA was unable to determine whether that explicit consent extends to the processing of these data beyond the single event the data were collected for. The collection and storage of special categories of personal data without explicit consent or a different legitimate exception, and with limited options for definitive removal and no measures to restrict access to the information, is not legitimate. This implies that the risk will certainly and systematically occur (high likelinood), whereas the impact associated with the risk is high because of the sensitive nature of the data. Incomplete record of safeguards for sharing data with external parties The Council included an option in Dynamics CRM to share data with Webservice.nl in order to validate addresses. When sharing data with external parties, there is a risk for the data subjects that their data will now be exploited for the purposes the new data controller wishes to pursue.

Since contracts between the controller and the online service provider Company.info have not been provided, this has to be considered a risk for the rights and freedoms of the data subjects. The data shared consists only of postal codes and house numbers, with no further context than that the Council has an unspecified purpose with the people living or working at the address. This leads to the conclusion that the impact of this risk is low, whereas the chance that the risk occurs is high. Summary of risks This DPIA describes ten separate risks, one of which occurs both for the Council and Microsoft. Six are high risks, and the rest is low risk. The risk of unlawful access to data after international transfers has been plotted as two separate risks: 7a for access by law enforcement in the USA and 7b for interception of those data in the USA. When plotted in the matrix, as proposed by the ICO”, the risks look like this: 74 Copied from the DPIA guidance from the UK data protection commission, the ICO.

URL: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulationgdpr/data- protection-impact-assessments-dpias/how-do-we-carry-out-a-dpia/ Page 59 of 64 0025 0987 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Figure 8 - Risk matrix before applying measures Serious harm peduui jo Aiseaas Some impact Minimal impact Remote Reasonable More likely possibility than not Likelihood of harm (occurence) Page 60 of 64 179410127 0025 0988 17. 17.1. DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Part D. Description of risk mitigating measures Part D describes the proposed (counter-)measures. In Part C of this DPIA, it became clear that eleven risks have been identified. Four of these risks were assessed as low risks with limited or minimal impact for the rights and freedoms of the data subjects. Seven risks were classified as high risks for which mitigating measures need to be taken.

Tracking pixels require consent. Update Dynamics CRM to include GDPR options and switch off use of tracking pixels in newsletters. Inability to exercise data subject rights. Perform a specific audit on whether Microsoft acts according to the agreed contractual measures. Update procedures to ensure that data subject rights are respected and requests from data subjects are followed up properly. Lack of transparency about the processing of logging data. Provide detailed documentation about the meaning of all Diagnostic Data collected. Deactivate by default the JavaScript library, or: Page 61 of 64 179410127 0025 0989 17.2. 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Risk | High risk Measures Council of Measures Microsoft no. State Provide detailed documentation about the content and purposes of the data processing through the JavaScript library 8 Inability to delete Limit the retention of Limit the retention of contact person data data in audit tables to data in audit tables to after expiration of what is necessary for the retention terms as retention period. the purposes for which | set by the data the data are collected controller and provide and implement controls to delete data procedures to make in audit tables after the sure no data is kept set retention limit beyond what is expires. necessary. 9 Incomplete Formulate and assess documentation of the legitimate interest legitimate interest of the Council for the indicated processings, and balance this legitimate interest with the interests, rights and freedoms of the data subjects. 10 Unlawful processing of Update the procedure special categories of to ask consent for data. processing of dietary and allergy information to include long-term storage and processing in audit tables, or: Stop processing of dietary and allergy information beyond the use for a single event.

Assessment of risks after taking mitigating measures If the measures described above are taken, the risks will be mitigated sufficiently and no high risks will remain. Risk number 9 will be resolved once the proper assessment of the legitimate interest, including the weighing of interests against the interests and rights and freedoms of the data subjects, has been made. The outcome of this assessment is expected to be positive, so the Council can rely on this ground insofar as necessary for the data processing activities related to the organisation of events. Risk 2 can be fully resolved by applying the proposed measure to stop using the tracking pixel. Page 62 of 64 0025 0990 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 The other high risks will be mitigated to low risks by applying the measures. Since no high risks are remaining after the implementation of the mitigating measures there is no obligation to consult the Data Protection Authorities and the personal data processing activities can start.

Page 63 of 64 179410127 0025 0991 179410127 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Conclusion At the time of writing, the use of Dynamics CRM implies seven high risks to the rights and freedoms of the data subjects. Most of these are based on incomplete implementation of protections and can be mitigated to an acceptable level. If Microsoft can improve its transparency and the way it collects Diagnostic Data, and the other measures are implemented in the design of the application at the governmental organisation, the use of Dynamics CRM is not a high risk to the rights and freedoms of the data subjects Page 64 of 64 0025 0992 DPIA Microsoft Dynamics CRM | FINAL REPORT | 23 February 2021 Appendix page i of i 179410127 0025 0993