Where does the data end up?

Data protection complaint about Microsoft in schools

Microsoft software is ubiquitous in Austrian classrooms.

(Bild: stock.adobe.com)

The data protection organization noyb has filed two complaints with the Data Protection Authority (DPA) against Microsoft in connection with its 365 Education service. The organization, co-founded by activist Max Schrems, accused the software provider on Tuesday of shifting responsibility for data protection to schools and secretly tracking children. Due to the potentially large number of people affected, noyb is proposing a fine against Microsoft.

"Only Microsoft has all the important information on data processing. But when it comes to exercising GDPR rights, the company points the finger at schools", says Maartje de Graaf, data protection lawyer at noyb, according to the press release. Authorities and schools have no realistic possibility of influencing Microsoft's approach or determining how data is processed, it continued.

"Unrealistic implementation"
noyb also criticized the "unrealistic implementation". In Austria, for example, local school directors have been tasked with determining "purposes and means" in accordance with Article 4(7) GDPR. They are also supposed to ensure that international software companies such as Microsoft comply with the regulation - "which is completely detached from the reality of data processing".

It is also unclear what actually happens to the data of children who use Microsoft 365 Education. "The information provided by Microsoft is so vague that even lawyers cannot fully understand how 365 Education processes personal data," explained de Graaf.

Cookies without consent
Several cookies were also installed without the complainant's consent. According to Microsoft, these cookies analyze user behavior, collect browser data and are used for advertising. "Microsoft 365 Education appears to track users regardless of their age. Hundreds of thousands of pupils and students in the EU and EEA are likely to be affected by this practice," said Felix Mikolasch, data protection lawyer at noyb, according to the press release.

noyb is now calling on the DPA to investigate data processing by Microsoft 365 Education. Research by the data protection experts was unable to provide any clarity, meaning that Microsoft is in breach of the transparency provisions of the GDPR. The company had also ignored the right to information.