SURF advises school boards not to use Microsoft 365 Copilot for the time being. This is because research shows that there are privacy risks associated with using the generative AI tool. SURF remains in discussions with Microsoft to resolve these risks, but based on existing risks, advises against use for the time being.
By 2024 SURF Vendor Compliance along with external privacy experts from Privacy Company, conducted a Data Protection Impact Assessment (DPIA) on Microsoft 365 Copilot. This looked at employee and adult student usage because Microsoft does not make the paid education license available to minors for the time being. This revealed a number of privacy risks for users.
The risks include a lack of transparency from Microsoft. It is not clear what personal data Microsoft collects and stores about the use of Microsoft 365 Copilot. Furthermore, the information users receive when they make a request for access is incomplete and incomprehensible. In addition, it is likely that Microsoft 365 Copilot generates incorrect and incomplete personal data, and users do not notice that they are working with incorrect data because they rely too much on the generative AI tool.
SURF remains in discussions with Microsoft to implement mitigating measures. At the moment, however, SURF has no choice but to conclude that the identified high risks are insufficiently mitigated. Therefore, the advice to educational and research institutions is not to use Microsoft 365 Copilot for the time being. Based on SURF's findings, school boards are also advised not to use COpilot for the time being. As soon as the situation changes, SURF will keep its members informed and school boards will also be informed of this via SIVON.
