Let artificial intelligence (AI) do the work in the company? What has sounded like science fiction so far, Microsoft wants to make possible in the future. With Microsoft 365 Copilot, Microsoft will offer its business customers a paid-for AI tool in the future. We will explain below what impact Copilot will have on data protection.
Microsoft 365 Copilot
Microsoft 365 Copilot is a new AI solution from Microsoft, that will be implemented in Microsoft 365 to help businesses optimise their performance. Copilot integrates large AI language models, known as Large Language Models (LLMs), which are based on large amounts of text data and used to generate text-based content, into Microsoft 365 apps and the Microsoft Graph application. Based on the aforementioned approach, the special feature of Copilot is said to be that the LLMs do not generate content based on arbitrary data sources as is usually the case, but instead generate company-specific and contextual responses by accessing the data of the respective business customer from Microsoft Graph in real time. Copilot is intended to be included in the Microsoft 365 E3, E5, Business Standard and Business Premium subscriptions as a paid add-on subscription in the future. The exact date is not yet known.
The data protection issue
Since Copilot requires an analysis of all business data, privacy concerns are quickly being raised. Pursuant to Microsoft, however, the new business model will guarantee business customers greater data privacy and data security in addition to the benefit of contextual content generation. As to the use of Copilot, Microsoft says it will adopt the company’s existing Microsoft 365 security and privacy policies, isolate and protect company-related data within the Microsoft 365 tenant, and companies are said to keep full control of their own data. In addition, the company data will not be used for training purposes. Moreover, Microsoft promises to adhere to the Microsoft AI Principles and Microsoft Responsible AI Standards. It remains to be seen how these promises will be contractually backed. However, since Copilot will be part of the Microsoft 365 product family, the existing data protection and compliance obligations will also be relevant here, so that the Microsoft Products and Services Data Protection Addendum (DPA) will probably apply.
Implications for practice
Due to the complexity and the wide range of possible usages of Copilot, it is not possible to make a blanket statement on its use in conformity with data protection. The specific use in the company and the circumstances of the individual case are decisive. As a new member of the Microsoft 365 product family, Copilot will in all likelihood also encounter heavy criticism from the data protection supervisory authorities. However, companies should not be deterred by this criticism, but should examine the possibility of a data protection-compliant use of the AI tool in the specific individual case. The following steps can be helpful:
- Companies should analyse which contractual agreements apply to the use of Copilot and how these are integrated into any existing contractual relationships.
- Once the contractual basis is established, companies should subject the use of Copilot to a (supplementary) data protection impact assessment, which can be used to demonstrate compliance with data protection obligations as well as the assessment and documentation of risks and appropriate remedial measures.
Further information is contained in our one-pager on the data protection-compliant use of Microsoft 365 (.pdf) and in our one-pager on data protection impact assessment (.pdf).
back