EU raises "serious concerns" over Microsoft's role as data processor

EPDS tells EU organisations that outsourcing any data processing means they’re still responsible

The European Data Protection Supervisor has expressed "serious concerns" that Microsoft may have violated data protection laws through product and service agreements with EU institutions, preliminary results of an investigation have revealed.

The early results follow an initial probe by the Dutch data regulator into the data collection practices of Windows Pro and Windows 10 Home, based on their testing of changes to Microsoft's data collection policies.

Advertisement - Article continues below

After finding issues with Microsoft's data practices in 2018, the Minister of Justice and Security warned users to ditch OneDrive and Office 365 in the interim before demanding changes from the software giant.

Further checks in August of the changes Microsoft had since implemented showed that despite "concrete improvements", the company was still remotely collecting some forms of data from its users. This, according to investigators, constituted a potential violation of the General Data Protection Regulation (GDPR).

The EDPS, an independent organisation that manages the application of GDPR across the continent, has subsequently weighed in with the results of its own probe into contracts Microsoft has agreed with EU institutions.

The EDPS also organised an EU software and cloud suppliers customer council in the Hague on 29 August, which led to the creation of the Hague Forum.

Advertisement
Advertisement - Article continues below

This collective aims to discuss how to take back control over IT services offered by big tech companies, while establishing how institutions can establish standard contractual terms instead of accepting vendor-led user agreements.

Advertisement - Article continues below

"We expect that the creation of The Hague Forum and the results of our investigation will help improve the data protection compliance of all EU institutions," said assistant EDPS Wojciech Wiewirowski.

"The agreement reached between the Dutch Ministry of Justice and Security and Microsoft on appropriate contractual and technical safeguards and measures to mitigate risks to individuals is a positive step forward.

"Through The Hague Forum and by reinforcing regulatory cooperation, we aim to ensure that these safeguards and measures apply to all consumers and public authorities living and operating in the EEA."

The EDPS also warned that outsourcing the processing of personal data still means organisations are accountable for the activities conducted on their behalf.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/policy-legislation/general-data-protection-regulation-gdpr/355337/ico-will-reduce-gdpr-fines-due-to
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
Visit/security/privacy/355304/nhs-working-with-apple-google-coronavirus-tracking-app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020
Visit/policy-legislation/data-protection/355250/health-sites-sharing-users-medical-data-with-major-tech
data protection

Health sites are 'unlawfully' sharing medical data with Facebook and Google

7 Apr 2020
Visit/policy-legislation/data-protection/355184/supreme-court-finds-morrisons-was-not-liable-for-2014
data protection

Supreme Court rules Morrisons was not liable for 2014 data breach

1 Apr 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020