The European Commission's use of Microsoft 365 software has come under scrutiny by the EU's privacy watchdog.
As first reported by Reuters, the Commission's leveraging of Microsoft allegedly breaches privacy rules, while the European Data Protection Supervisor (EDPS) watchdog added that the bloc's executive failed to introduce adequate safeguards for personal data transferred to non-EU or non-European Economic Area (EEA) nations.
The EDPS mandated that the Commission must ensure compliance with privacy regulations and cease data transfers to the American business and its subsidiaries in third countries lacking established privacy agreements with the EU. Both directives were issued with a deadline of December 9.
The EDPS said in a statement:
The Commission has failed to provide appropriate safeguards to ensure that personal data transferred outside the EU/EEA are afforded an essentially equivalent level of protection as guaranteed in the EU/EEA(...) In its contract with Microsoft, the Commission did not sufficiently specify what types of personal data are to be collected and for which explicit and specified purposes when using Microsoft 365."
The EDPS directed the Commission to halt all data transfers stemming from its utilisation of Microsoft 365 to the Redmond-based tech giant and its affiliates and sub-processors situated in countries outside of Europe that are not covered by the EU's established data adequacy agreements, whose 16 members include the US, UK, Switzerland and South Korea. It was also told to ensure that its use of Microsoft 365 moving forward complies with its privacy rules.
The EDPS's ruling stemmed from a three-year investigation prompted by worries over the transfer of personal data to the US, initially sparked by revelations in 2013 by former US intelligence contractor Edward Snowden around US surveillance practices.
"Concerns raised by the European Data Protection Supervisor relate largely to stricter transparency requirements under the EUDPR, a law that applies only to the European Union institutions," a Microsoft spokesperson responded, affirming that it would review the EDPS' decision and cooperate to manage the concerns.
The European Commission had yet to reply to Reuters' request for comment.
Microsoft and the European Commission
Microsoft has had a complicated relationship with the European Commission for decades, but the last year has amplified that friction.
