Microsoft sued for allegedly sharing Office 365 customer data

Lawsuit alleges firm also used data to derive business insights and develop services

Microsoft is routinely sharing business customers’ data, including personal and corporate information, with Facebook and other third parties despite publicly claiming it doesn’t, according to a lawsuit.

Although the company claims to keep Office 365 and Microsoft Exchange business customers’ data secure, Microsoft is being sued for allegedly sharing the content of business customers’ emails, documents, contacts, and other information, without their consent.

A lawsuit filed with the US District Court, Northern District of California also claims Microsoft inappropriately uses its business customers’ data to derive insights and develop new products and services which it sells to others.

The class-action lawsuit has accused the company of misrepresenting its privacy and security practices, violating federal and state laws, and illegally sharing customer data with the likes of Facebook, other third-parties, and subcontractors.

“Like a mantra, Microsoft has repeatedly promised business customers that it will use their content and data exclusively to provide them with the purchased services; that, solely for those purposes, it will share their data with its subcontractors and certain others only on a need-to-know basis; and that it will never share the customer’s data with third parties at all,” the lawsuit said. 

“In fact, contrary to its representations, Microsoft has regularly shared - and continues to share- its business customers’ data with Facebook and other third parties. 

“The details shared even when neither the customers nor their contacts are Facebook users. And, once Facebook obtains the data, harmful consequences can follow, as demonstrated by the data harvesting debacle orchestrated by Cambridge Analytica targeting the 2016 national election, using data obtained by Facebook.”

The information allegedly being shared includes the content of business customers’ emails, documents, contacts, calendars, location data, audio files, and video files, among other forms of data. Those taking legal action are concerned that Microsoft has shared such data with “hundreds of subcontracts” that have since suffered data breaches, in addition to the likes of Facebook app developers

Related Resource

To encrypt, or not to encrypt: What is the regulation?

Secure compliance with the right mix of technology and information

Download now

Also in a violation of public statements, Microsoft has apparently used business data to develop new products and services to sell to others, to glean business intelligence, and to derive general commercial benefit.

Data-sharing with Facebook has garnered particular attention in the lawsuit, particularly given how routinely it finds itself reeling from data breaches and data-sharing complaints. The social media giant, as of last February, was the subject of ten major GDPR investigations, for example.

The lawsuit claims that although Facebook is not necessary to provide Office 365 or Exchange Online services to Microsoft’s business customers, the company routinely and automatically shares its customers’ contacts with the company without consent.

Even if a customer discovers and disables Facebook-sharing, the fact the software shares this data by default from the very start means the damage is done. This is compounded by a Microsoft-written explanation in technical instruction that once contacts are transferred to Facebook, they cannot be deleted from Facebook systems except by Facebook.

Moreover, because Microsoft shares data with Facebook, the lawsuit asserts this customer data is accessible not just by Facebook, but also by whichever entity Facebook shares the data with, and whichever entity those entities share the data with “ad infinitum”.

“We’re aware of the suit and will review it carefully," a Microsoft spokesperson told IT Pro.

"However, while the allegations themselves are not very specific, as we understand them we don’t believe they have merit. We have an established history of both robust privacy protections and transparency, and we’re confident that our use of customer data is consistent with the instructions of our customers and our contractual commitments.”

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Most Popular

The top 12 password-cracking techniques used by hackers

The top 12 password-cracking techniques used by hackers

5 Oct 2020
The enemy of security is complexity

The enemy of security is complexity

9 Oct 2020
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

5 Oct 2020