This is what you need to know about the storage of your TU Delft emails

Have you ever wondered where the thousands of emails and calendar items in your Outlook are stored? Now that TU Delft’s Executive Board has decided to change this, it has become a pertinent question. Hence, four things you need to know about saving your TU Delft emails. 

Servers
At present – and for many years now – the emails and calendar items in your TU Delft Outlook environment are stored in local TU Delft Exchange servers. The IT Department arranges the maintenance and management of these servers. However, Microsoft recently informed TU Delft that it will soon stop delivering updates and new functionalities for the current arrangement. If TU Delft does not take action, it may incur security risks. 

The solution is that all employees’ emails and calendar items in Outlook will be transferred (migrated) to a Microsoft server in Europe. The Executive Board took this final decision in summer. 

IT believes that this is the best option because:

• it is cheaper: a license has already been issued and no server management will be required;
• usage is more convenient, for example because after the migration employees can work more easily with people at different universities; 
• security is guaranteed; and,
• there are a lot of disadvantages in other options. 

The migration must be done before the start of the new 2024-2025 academic year, says an IT spokesperson. 

Right to consent or to advise?
The email migration was not decided in a split second. The issue has been the subject of discussion for several months at consultation meetings between the Executive Board and the Works Council (OR). The OR also has an IT committee that has had frequent discussions with the IT department. 

Prior to the issue being tabled, there was first a discussion about how much of a say the OR would have. While the Executive Board viewed the issue as belonging to the OR’s right to give advice, the OR believed that it should have the right of consent as the email migration involves the processing of personal data. 

The OR even sought legal support in forcing the right of consent, but lost out when the Executive Board upheld its position. The next step would be to go to court, but the majority of the OR thought that that was a step too far. They preferred to first to push its points through its right to give advice. 

The OR submitted its advice on 28 August containing the points that it considers important. The Executive Board has said it is willing to accede to most of the points. 

Privacy and data security
Without exception, the OR’s points concern privacy and data security. One point is what would happen with the emails on the Microsoft server should the American Government demand access? By extension, in that case would confidential research data, organisational information about finances, personal details about sick staff members, and reports on the performance of staff members be well protected? 

The Executive Board and IT take all sorts of measures to avoid risks. The Microsoft servers in Europe fall under European laws such as the General Data Protection Regulation (GDPR). But other measures are still needed to protect the data. After receiving advice from the OR, TU Delft has agreed to comply with the regulations in the Central Government’s data protection impact assessments. 

Apart from this, for years now employees are asked not to share any sensitive personal data in their Outlook emails. For those who need it, a separate encryption tool can be installed for emails containing sensitive data and this is emphatically supported by the OR. 

IT’s baseline is that that data simply should not be shared in Outlook. A spokesperson suggests referring to the Security & Privacy @TU Delft intranet page for guidelines and regulations. She also suggests apps that can be used to store sensitive information such as MyHR, Brightspace and Project Data. Furthermore, before the actual migration, there will be a mandatory training for a ‘significant proportion of employees’ on safe handling of data and emails. 

Despite these measures, the OR is still apprehensive as employees do not always adhere to rules and regulations and because old emails too will migrate to the Microsoft cloud. The advice of the OR is to find an alternative storage option for old emails, but IT views all the data in Outlook as a whole and does not believe this is necessary. They believe that highly sensitive data should simply not be contained in emails, regardless of where it is stored. 

European alternative
Despite all the protective measures, the OR would rather have seen ‘a European non-Big Tech solution’ instead of Microsoft. On the intranet it states that it hopes that the ‘dependence on a major commercial entity […] will only be for a short while’.  However, at present, IT sees too many negative points about alternatives as suggested by the OR. Not only would it be a lot more expensive than continuing with Microsoft, but it would be a lot more complicated for users. IT expects that employees will barely notice any changes in continuing with Microsoft. 

That said, IT is keeping an eye on the market, assures the spokesperson. It has also freed up people to participate in the development of European alternatives in Surf context (Surf is the ICT cooperative of education and research). If and when there will be serious email and calendar software contender to Microsoft is up in the air. 

• Sources used in the production of this article include: the Executive Board decision, the OR’s advice, the Executive Board’s response to it, and answers from IT and the OR to Delta’s questions.