Data protection with Zoom video conferencing software

In the last two years, the use of video conferencing, especially with Zoom software, has increased dramatically. In offices and classrooms, it is difficult to provide an engaging remote experience while also maintaining effective communication with classmates and teammates.

For this reason, it is often advisable to use services for video and online conferences, classes, meetings, or webinars—such as Zoom. However, when using such a tool, the GDPR’s requirements regarding Privacy and Data protection must be adhered to, even in times of crisis. When selecting the appropriate solution, a company or organization should carefully review and weigh the legal and technical considerations and document the decision-making process.

When using Zoom, various types of data are processed. It is up to the user to decide how much identifying information to provide. Providing a name is generally required to start an online meeting or enter the meeting room. When creating an account or adding additional personal data, Zoom processes the following data:

• User data:
  First Name, Last Name, Phone Number (optional), Email Address, Password (if “Single Sign-On” is not used), profile picture (optional), department (optional)

• Meeting metadata:
  Topic, description (optional), participants' IP addresses, device/hardware information.
• If recording (optional):
  An MP4 file containing all video, audio, and presentation recordings; an M4A file containing all audio recordings; and a text file of the online meeting chat.
• When dialing in by telephone:
  o Information about the incoming and outgoing call number, country name, start and end time. If required, further connection data such as the IP address of the device.

In April 2020, the Federal Trade Commission (FTC) criticized Zoom for its vague definition of end-to-end—Encryption (E2E) and the hypocritical storage of cryptographic keys. Zoom later added its E2E settings to ensure that data remains between two Zoom users. However, this setting is not enabled by default and must be manually enabled in Zoom's settings.

Another problem Zoom encountered was “Zoom-bombing,” which allowed anyone with a Zoom ID code to join a call. This prompted Zoom to add a waiting room feature that allows the administrator to admit users to a call one at a time, as well as to set up password-protected calls, etc. Since the Zoom password could be hacked in less than 30 minutes, Zoom replaced the six-digit password with alphanumeric characters and administrator-generated passwords.

Many other security issues were discovered: the sale of data to Facebook from users who signed up for the social platform via Zoom, and to software that downloads to iOS devices; as well as the ability to turn on participants’ cameras and forcibly add users to a call. Chat boxes were also a problem, as hackers could manipulate them to create malicious GIF files, which have since been banned. Other file types that hackers sent to users via the chat box included compressed files such as .zip files, Untitled.html, Untitled.Properties, Untitled.rtf, and Untitled.txt. The admin can still decide which types of files are allowed to be sent in the chat box.

Video conferencing for companies does not necessarily have to be a security risk. In addition to the location of the Server and the service provider, the following aspects should also be considered when selecting the appropriate software:

• Is there a business version of the tool you're looking for? These versions often offer even higher security standards. Is business use permitted?
• Does the video conferencing system offer privacy-friendly process and configuration options (Art. 25(2) of the GDPR)?
• Is the data transmitted in encrypted form? How is the information encrypted (e.g., end-to-end)?
• Is an explicit Consent required for transmission or recording on the screen?
• Are call logs and recordings deleted after the call ends? If not, can this be changed?
• Are participant behavior profiles created? If so, can this function be switched off?
• For all Tracking- For monitoring, logging, screen-sharing, and recording features, it is advisable to always check whether these features are absolutely necessary and/or can be disabled in the settings

Although Zoom has been criticized on several occasions, the company continuously collaborates with security researchers to identify vulnerabilities and has addressed most of the most alarming security issues. Users should nevertheless be wary of phishing emails containing Zoom invitations, which are sent with common subject lines such as “Zoom invite” and prompt customers to log in. Zoom administrators and users are also advised to create password-protected meetings, use the waiting room feature, and lock the session once all participants are present.

Nonetheless, it is always safest to seek advice from the data protection experts at 2BAdvice to ensure that the tools used by your employees comply with data protection standards.