The European Data Protection Supervisor (EDPS) recently determined that the European Commission’s use of Microsoft 365 violates the bloc’s stringent data protection rules.
The bombshell investigation
The EDPS initiated its investigation into the Commission’s use of Microsoft 365 back in May 2021, fueled by concerns over transatlantic data transfers and compliance with the EU’s General Data Protection Regulation (GDPR).
The crux of the issue lies in the fact that Microsoft, as a US-based company, is subject to US laws like the CLOUD Act, potentially granting US authorities access to data stored on Microsoft’s servers.
After careful examination, the EDPS concluded that the Commission failed to implement sufficient safeguards for data transfers to the US.
This leaves EU citizen data potentially vulnerable to access by US intelligence agencies, raising serious questions about privacy and data sovereignty.
Key breaches
The EDPS didn’t just raise a general alarm about Microsoft 365 – they pinpointed exactly where the Commission went wrong.
First off, there weren’t enough safeguards in place when sending personal data outside of Europe. That’s a huge red flag, especially after that whole Privacy Shield agreement got tossed out in the Schrems II decision, which made it clear that US surveillance could be an issue.
Then there’s the question of whether the Commission really needed Microsoft 365 in the first place. They couldn’t really explain why it was so essential. This makes us wonder if they were processing way more data through Microsoft than was actually necessary.
And finally, it seems like the Commission’s initial privacy check before they started using Microsoft 365 wasn’t thorough enough. That’s a big deal – doing that assessment properly is how you spot those privacy risks and deal with them before they become a problem.
EU orders Microsoft 365 to shut down if the requirements are not met
The EDPS verdict isn’t just a warning shot across the bow. This is a serious ultimatum with major consequences.
The Commission now has a tight deadline, December 9th, 2024, to completely halt all data flows to Microsoft and its US partners resulting from their use of the Microsoft 365 suite.
Failure to comply could lead to substantial fines and damage the reputation of the EU’s central administrative body.
This puts them in a tight spot.
Do they scramble to find an alternative way to handle their data in a way that complies with EU law, or do they face the potential consequences of defiance?
Featured image credit: Microsoft.
