Fhyujk

I work in a lab where we conduct research on data acquire from human subjects. As we investigate the effects of different diseases and the related treatments, the data is highly sensitive in regards to data protection.

Most of the lab members work with Windows 10 and I am supposed to set up additional Windows 10 PCs. I have serious concerns about this as Windows 10 is known for sharing much data with Microsoft, e.g. every file which is related to a software crash may or may not be send to Microsoft and thereby unintentionally sharing sensitive health related information with Microsoft.

When mentioning these issues, they are usually waved aside with arguments like "nobody else cares about that" or "this would slow down our work". In general is there very little interest in data protection and the associated risks.

I know the risk of a data leak actually having a effect is rather small, yet I'd like to know how to back myself up in this situation. Should things for whatever reason go sour, I'd like to be on the safe side.

PS: Initially I thoughtof pasting this in "the workplace", but as academia is quite different from industry, I thought this would be a better fit.

Edit: I think I should add a little more background. I am in a PhD position actually hired for doing research. Yet due to my background in computer science, I am 'officially' responsible for everything related in our lab to electronic data processing.

The way I read your question is that you are not responsible for data protection but responsible for setting up Windows PCs. In that case I would share your concerns in an email to your group leader so that you have a (virtual) paper trail, and ask them whether they'd like you to set up the Windows PCs nevertheless or whether they'd like you to look for another solution.

Of course, if your actual responsibility is data protection and they are ignoring the very thing they've hired you for, you should probably start looking for another place to work.

A quick Google search on "windows 10 gdpr" retrieves a trove of documents from Microsoft with advice on GDPR compliance. SE discourages the posting of links, but the second hit on the Google search is "Windows and the GDPR: Information for IT Administrators and Decision Makers" and has a pretty thorough explanation of what data moves where. That (discouraged) link is currently https://docs.microsoft.com/en-us/windows/privacy/gdpr-it-guidance

According to the document itself, it takes 17 minutes to read. I think you'll feel better after you've done so.

There's a lot of paranoia about Microsoft, some of it possibly justified, but the hard fact is that MS cannot afford to ignore the GDPR or, in the U.S., HIPAA.

I did read the answer in Information Security SE, and did not find it helpful; the quotation from MS has to do with disclosure of data as required by law or legal process.

Make sure your advice is actually based on solid facts, and consider which are the most likely ways the data could leak out. Find out exactly what Windows 10 could report to Microsoft, and whether that is a real issue in your case.

Find out the actual regulations and laws about this in your country and maybe also university rules, if they exist. Being able to point to specific regulation is useful for such arguments.

In a typical academic settings, you probably don't have the means to really lock down stuff. I would focus on the most dangerous and common ways the computers could be compromised, Microsoft is far, far at the end of those worries in my opinion. I would mostly worry about the following cases:

• people taking the data home or on their private computers


• computers being compromised by malware


• computers, hard drives or USB drives being stolen or lost

You're focusing on a very remote and unlikely threat, that makes it much easier to dismiss your arguments. Focus on realistic and plausible threats, and be prepared to still fight an uphill battle.

Should things for whatever reason go sour, I'd like to be on the safe side.

The question is what you want to protect agains - a law suite directed at you, or being let go?

My suspicion (but I'm not a lawyer, obviously) is that there is very little danger of the former and close to no real protection against the latter.

The uncomfortable reality is that many people (in academia and outside) are not so much hiring an employee rather than buying insurance when filling roles such as for a data protection responsible (same with certain certifications in industry). They know (or at least strongly suspect) that what they do is not legal, don't want to change, and look for somebody who they can point to when things go south.

If any real legal trouble ever arises from the data protection issue, I fully suspect that it will be targeted at the university rather than individuals working there - and even if it is targeted at specific persons, it will be the managers in charge, not a lab technician with no authority to change the behavior of other employees. However, there is a very good chance that internally you will still be made the scapegoat (up to and including being let go), if for no other reason than that sh*t tends to roll downhill. In my experience with university management structures, no amount of paper trail can really protect you from this.

Of course you still should try as hard as you can to inform your lab on any relevant issues that you see, but given that you have no authority over them it will have to take the form of advise rather than strict rules. Being on good terms with the team (and having great soft skills) is probably your best bet of actually making a difference. It may also pay to be pragmatic here, and address big threats that don't require too much sacrifice from your team - the InfoSec Stack Exchange may be a very good resource to get information on what these might be (I suspect the usage of Windows is not one of these cases).

Note: there are jobs were you end up personally responsible for certain kinds of problems (functional safety in automotive is an example that comes to mind). However, these are typically characterized in that you need explicit qualifications to even be legally allowed to carry out this job. A company cannot just appoint a random engineer to now be legally responsible for safety certification. Part of the mandatory training for such jobs is also explicit information on what you end up responsible for, and what the expected course of action in case of non-compliance is.