The Use of Google and Microsoft Encrypted Email in Finland

The use of Google’s and Microsoft’s encrypted email services in Finland is technically possible, but it involves certain challenges and risks that should be considered, particularly from the perspectives of privacy and information security.

Benefits

1. Ease of use:
   • Google Workspace and Microsoft 365 offer integrated encryption solutions that are relatively easy to use, especially for organisations already using their ecosystems.
   • These services provide user-friendly tools for email encryption and security management.
2. Reliability and scalability
   • Google and Microsoft are global technology companies with the resources to provide highly scalable and reliable services.
   • They have advanced systems in place to protect their services against common cybersecurity threats, such as distributed denial-of-service (DDoS) attacks.
3. Security features:
   • Both offer advanced security features, including two-factor authentication, advanced threat protection, and enterprise-grade encryption.

Challenges and risks

1. Data protection and GDPR:
   • Although Google and Microsoft state that they comply with the GDPR, they operate data centres around the world, which means that your data may be transferred to or processed outside the EU.
   • This may result in the data being subject to, for example, the U.S. Cloud Act or other national legislation that may require the service provider to disclose data to authorities without the user's consent.
2. Provider-managed encryption:
   • Google and Microsoft offer server-side encryption solutions in which the service provider manages the encryption keys. This means that the service provider can technically access the data.
   • This provides a lower level of security than end-to-end encryption, where only the sender and the recipient have access to the encryption keys.
3. Confidentiality:
   • For organisations that process sensitive information, such as those in healthcare or legal services, using large international service providers may involve risks, as these services do not always provide full transparency regarding how data is processed.
4. Dependence on large technology companies:
   • Users and organisations are fully dependent on Google’s or Microsoft’s solutions and service updates. If security issues arise, users have limited ability to influence how those issues are resolved.

Recommendation

Google’s and Microsoft’s encrypted email solutions may be suitable for general business needs, but in Finland it is worth considering local or EU-based encrypted email services, such as:

• Luottoposti (Finland): Offers strong encryption and strict GDPR compliance.
• ProtonMail (Switzerland): Uses end-to-end encryption and is designed with privacy in mind.
• Tutanota (Germany): Provides strong privacy protection and full compliance with EU data protection legislation.

Using these services provides stronger data protection and better compliance with local legislation, which can be particularly important for organisations and individuals that process sensitive information.