I would argue that there are two distinct kinds of trust here:
- Legal trust: Lawyers draft hundreds of pages specifying what may and may not be done with the data.
- Evidence-based trust: Looking at Microsofts actual track record, past privacy incidents, regulatory findings, and whether its data-handling practices have matched its disclosures and contractual commitments.
- Legal trust: Lawyers draft hundreds of pages specifying what may and may not be done with the data.
- Evidence-based trust: Looking at Microsofts actual track record, past privacy incidents, regulatory findings, and whether its data-handling practices have matched its disclosures and contractual commitments.
For the latter point, here is a nice summary from related to the use of Office prodducts in the Dutch goverment: https://www.privacycompany.eu/blog/new-dpia-on-microsoft-off...