I have a local Exchange server, which has several spam and email reception issues (Due to an expired subscription to a spam filtering system). I was looking at the Office 365 Exchange Online protection (https://products.office.com/en-us/exchange/microsoft-exchange-online-protection-email-filter-and-anti-spam-protection-email-security-email-spam) as a solution for our problems. Exchange Online Protection would act as a gateway for incoming and outgoing emails of my organization.
We looked into hosting our emails in Office 365 but then I faced the issue described below.
Office 365 services are hosted in the United States and we are located in Canada. This makes the data on the Office 365 servers under the USA PATRIOT Act (See this for more information https://www.congress.gov/bill/107th-congress/house-bill/3162). For people that are not aware of what the USA PATRIOT Act is, it is a law in the United States that allows the government to have access to any data that is hosted in the United States in order to protect citizens against potential threats.
I called the Office 365 team to have more information in what information is kept on their servers when using this "Spam Filtering" service. As per the answer they gave me, only the information in the header of the email is kept, for reporting and monitoring purposes.
I know from experience that email headers contain the following information:
- Email sender
- Email recipient
- Source server
- If the email contain an attachment
The emails that are sent from and to our organization contains information that we would not like the Government to see (Don't worry, nothing illegal, violent or dangerous for citizens).
My question is, how can keeping the header of the emails on the data center of Office 365 in the United States affect the privacy of my information since the content and attachment of emails are not under their control?
Second question: Would having the email header, and therefore the subject, sender and recipient information could lead the Government to force us to provide the information, even though we host the full content in Canada?
Let me know if there are any clarification required.