Bonum Certa Men Certa

EPO and Microsoft Collude to Break the Law -- Part X: The Spectre of GDPR…

Previous parts:



GDPR and Microsoft
More about Microsoft's run-ins with European data protection authorities



Summary: António Campinos and his friends may have put the EPO in legal "hot water", having already outsourced EPO data to a serial GDPR violator with a notorious track record in other aspects, too

In April 2019 it was reported that "the Spectre of GDPR" continued to haunt the hallowed halls of Redmond, this time in the shape of an investigation ordered by the EU Data Protection Supervisor (EDPS) into Microsoft products used by EU institutions.



The move by the EDPS was prompted by the outcome of the Data Protection Impact Assessment which had been commissioned by the Dutch Ministry of Justice and Security in 2018.

"The move by the EDPS was prompted by the outcome of the Data Protection Impact Assessment which had been commissioned by the Dutch Ministry of Justice and Security in 2018."The EDPS noted that any EU institutions using the applications investigated by the Dutch authorities would face similar issues including "increased risks to the rights and freedoms of individuals".

The report of the EDPS on the "Outcome of own-initiative investigation into EU institutions’ use of Microsoft products and services" was published on 2 July 2020.

The EDPS identified a number of serious issues calling for further action, including the following:

● The licensing agreement between Microsoft and the EU institutions was formulated in loose manner that effectively permitted Microsoft to act as a data controller which the EDPS found inappropriate.

● The lack of control by EU institutions over which sub-processors Microsoft used and the lack of meaningful audit rights presented significant issues which needed to be addressed.

● EU institutions were unable to control the location of a large portion of the data processed by Microsoft. Nor did they properly control what was transferred out of the EU/EEA and how. There was also a lack of proper safeguards to protect data that left the EU/EEA.

● EU institutions had few guarantees at their disposal to defend their privileges and immunities and to ensure that Microsoft would only disclose personal data insofar as permitted by EU law.

According to the EDPS, the EU institutions lacked sufficient clarity as to the nature, scope and purposes of the data processing carried out by Microsoft and the risks to data subjects for the purpose of complying with their transparency obligations towards data subjects.

The EDPS recommended that all EU institutions perform tests using a revised and comprehensive approach in order to monitor and stem the flow of personal data generated by Microsoft products and services and sent to Microsoft.

"The EDPS recommended that all EU institutions perform tests using a revised and comprehensive approach in order to monitor and stem the flow of personal data generated by Microsoft products and services and sent to Microsoft."It remains to be seen whether or not the EDPS' beef with Microsoft will be resolved in an amicable manner or whether it will result in the imposition of GDPR fines which, in serious cases, can be as much as 4% of a company's worldwide annual revenue.

Microsoft has also had its fair share of grief with the data protection authorities in the EPO's main host country, Germany.

Back in July 2019 it was reported that the data protection authority in the state of Hesse had issued a ruling that Microsoft’s Office 365 could no longer be used by schools following the closure of a German data centre which had been used by Microsoft to provide cloud services.

This ruling came after several years of domestic debate about whether German schools and other state institutions should be using Microsoft software at all.

To allay German privacy concerns, Microsoft had invested millions in a German cloud service, and in 2017 Hesse authorities agreed that local schools could use Office 365 as long as German data remained in the country. But in August 2018 Microsoft decided to shut down the German service which meant that, once again, data from local Office 365 users would be transmitted across the Atlantic.

"...in August 2018 Microsoft decided to shut down the German service which meant that, once again, data from local Office 365 users would be transmitted across the Atlantic."In view of the changed circumstances, the data protection commissioner decided that there was now an unacceptable risk that users' data could be accessed by US authorities.

More recently, in October 2020, it was reported that at the Conference of German Federal and State Data Protection Supervisory Authorities, a majority of Germany's regional data protection commissioners supported a finding that Microsoft Office 365 did not comply with GDPR standards. They also made clear that changes were urgently needed to comply with the CJEU Schrems II judgment on cross-border data transfers.

Once again, it's too early to say whether this matter will be resolved in an amicable manner or whether it will result in the imposition of GDPR fines.

However, for some time now German lawyers have been warning their clients about the potential financial risks of using non-GDPR compliant software, including many widely used Microsoft products.

For example, one Hamburg-based law firm published the following advice in July 2020:

"...for some time now German lawyers have been warning their clients about the potential financial risks of using non-GDPR compliant software, including many widely used Microsoft products.""Using MS-Teams, Skype and other Office 365 services violates data protection law and may result in million Euro fines. That’s the conclusion of two papers recently issued by the Berlin Commissioner for Data Protection and Freedom of Information. There is urgent need for action in many companies now."

Time will tell whether or not such warnings are justified. However, based on past experience Microsoft is unlikely to be given an easy ride by the German and other European data protection authorities and this may well have some unpleasant fallout for commercial users of its services and products.

In the meantime German scepticism about Microsoft has surfaced in the European Parliament.

In February 2020, Klaus Buchner - a university professor, physicist, and MEP for the green-conservative Ecological Democratic Party - submitted the following question to the EU Commission:

Subject: Microsoft Windows 10 in European local authorities

IT is part of our critical infrastructure, and in European local authorities as well IT means Microsoft Windows and Microsoft Office. It is as if European drivers could only buy cars made by one US manufacturer. As a result, European local authorities and European industry are totally dependent on a foreign monopoly supplier and are required to kow-tow to a foreign legal system and comply with foreign court judgments, which apply to Microsoft in the EU as well. To make matters worse, Windows 10 systematically transmits personal data to Microsoft. Little is known about how that data is used. The upshot is that local authorities may find themselves facing legal action for breaches of the data protection rules and the German Industrial Constitution Law. Background: ‘[...] The Data Protection Officers of the Federal Government and the Länder see little scope for using Microsoft’s Windows 10 operating system in accordance with the law […]’

Instead, standard programmes could be developed at EU level and made available to local authorities free of charge. This standard software could also be hosted in regional data centres in the EU and interested local authorities could transfer their IT operations to those centres. Of course, each local authority would be required to tailor the standard programmes to local needs and operate them independently, either from their own data centres or in an EU cloud.

1. Are there alternatives to monopoly costs and data protection problems? 2. Does the Commission see any scope for offering greater support for the use of free openware such as Linux and OpenOffice / LibreOffice?


The answer which came back from EU Commissioner Thierry Breton was for the most part the usual hot air which didn't really address the elephant in the room.

"In the meantime German scepticism about Microsoft has surfaced in the European Parliament."However, Breton took advantage of the opportunity to plug the Commission's ongoing efforts to promote an "EU cloud initiative" which would "offer credible European alternatives to non-EU providers".

And with that, we conclude our potted history of Microsoft's long-running and continuing problems with European data protection authorities.

In the next part we will take a look at some "close encounters" between the software behemoth of Redmond and other regulatory authorities, in particular the trust-busters on both sides of the Atlantic.

Recent Techrights' Posts

With Workers Back From a Holiday Weekend, Microsoft Layoffs Carry on, More Waves to Come
Now it's Monday and people are bad to work, even some journalists
You Need Not Wave a Rainbow Flag This Month to Basically Oppose Arseholes Looking to Disrupt and Divide the Community
Don't fall for it
What Miguel de Icaza and Microsoft Lunduke Have in Common
Similar aims, different methods
The 'Corporate Neckbeard' is Not the "Good Guy"
Works for IBM
Microsoft's Nat Friedman Became Unemployed the Same Time the SLAPPs Against Techrights Started Coming From His Friends (Weeks After We Had Exposed Scandals About Him and the Serial Strangler, His Best Friend, Who Got Arrested a Few Days Later)
Nat Friedman is not "Investor, entrepreneur"
Weeding Out Extremism in Our Community
To me it seems like Microsoft Lunduke is rapidly becoming like a "hate preacher" who operates online, breeding an extremist ideology or trying to soften its image
Censorship Versus Fact-Checking and Quality Control
It's not censorship but a matter of quality control
Gemini Links 07/07/2025: BaseLibre Numerical System and TUI Rant
Links for the day
 
Layoffs and Shutdowns at IBM, Not Just Microsoft
Same as Microsoft
The FSF's (Free Software Foundation, Inc.) 2025 Summer Fundraiser Already Past Halfway Line
This is where GNU/Linux actually started
Mozilla Had No Good Reason to Outsource Firefox Development to Microsoft
What does Mozilla plan to do when GitHub shuts down?
Mozilla Firefox Did Not Die, It Got Killed
To me it'll always look like Mozilla got killed by its sponsors, especially Google, which had a conflict of interest as a sponsor
Dalai Lama Succession as Evidence That Determined, Motivated People Can Reach Their Nineties
And we need to quit talking about their death all the time
Dan Neidle, Whom Brett Wilson LLP SLAPPed (on Behalf of Corrupt Rich Tax Evaders), Still Fighting the Good Fight
Neidle fights for the poor people
Wayland Should Start by Dumping Its Very Ugly Logo
Wayland wins the "ugliest logo" award every year
Stop Focusing on Hair Colours, Focus on Corporate Agenda
If someone commits a crime, it does not matter if his or her hair was mostly white or there was no hair or a wig or whatever
Links 07/07/2025: Science, Conflicts, and a Fictional K-pop Group
Links for the day
Gemini Links 07/07/2025: Being a Luddite and Announcement of Gotify
Links for the day
Links 07/07/2025: XBox Effectively 'Dead', DMCA Subpoena Versus Registrar
Links for the day
The Nasty Smear (and Stereotype) of "Neckbeard" or "Greybeard" is Ageism
This is the sort of stuff they might try to volley at critics of Wayland
Why Many of Us Use X Server and Will Continue to Use It For Many Years to Come
Don't make this about politics
Brett Wilson LLP Uses Threats to Demand Changes to Pages or Removal of Pages Without Even Revealing Which Staff Member Does That (Sometimes People From Another Firm!)
This has been in the public for years
Dan Neidle Said "It Really Then Became a Job of Tormenting" Lawyers Like Brett Wilson LLP (Who Threatened Him for Exposing Crimes, Just Like They Threatened My Wife a Few Months Later)
he and his wife decided to take on the evil people and their evil lawyers
Large Language Models (LLMs) Externalise Their Cost to the Free Software Foundation (FSF)
"The forty-sixth Free Software Bulletin is now available online!"
Reinforcing the Allegations Some More, Bryan Lunduke Digs His Own Grave
In his latest episodes he merely repeats his own lies, which I debunked using evidence right from his own mouth
Global Warming and Free Software as a Force of Mitigation
we'll need to think about Software Freedom, not just brands like "Linux"
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 06, 2025
IRC logs for Sunday, July 06, 2025
[Video] "Copyleft Isn't a Bug."
"Copyleft isn’t a bug. It’s a feature. GNU GPL forced the world to treat code like a public good."
Being in Social Control Media Means Exposing Oneself to Heckling
Richard Stallman does not (either himself or directly) post to any social control media
Links 06/07/2025: Airlines Perils, Scams, and Breaches
Links for the day
Two Risks to Companies: The Microsoft Culture and the Microsoft Tools
Novell was killed by a form of "social engineering" by Microsoft
It's Hard to Trust People Who Worked - Not Only Those Who Still Work - at Microsoft
Bryan Lunduke is just what people would call an "arsehole of a person"
For the Second Time, Bryan Lunduke From Microsoft is Siccing Racist Trolls and Vandals at Me
You're only reinforcing the point we made yesterday
Links 06/07/2025: End to End Encryption at Risk, Reuters Twitter ("X") Account Withheld in India
Links for the day
Gemini Links 06/07/2025: Tinylog and Certification Rotation
Links for the day
Links 06/07/2025: Climate Change and "The Right to Criticise"
Links for the day
PCLinuxOS Sites Coming Back, Gradually
let's just be patient
Social Control Media, Even If Based on Free Software, Still Has Many Problems
a distraction from what actually mattered and still matters
IBM is Not Your Master
IBM makes friends with people who exclude the majority of the population: women
Help Fund the Free Software Foundation (FSF)
If you have some dollars to spare, go support the FSF
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, July 05, 2025
IRC logs for Saturday, July 05, 2025
A Short History of Attacks on Techrights (and Boycott Novell Before That)
good opportunity to tell again the story of several (not all) attempts to silence us
The Mainstream Media Took 4 Days to Realise Microsoft Shut Down Its Operations in Pakistan and Fired Everybody
We estimate that Microsoft has had about 29,000 layoffs since January
Leadership in Free Software
Don't let IBM lead. It's a terrible flag bearer.
“Twibel” Actions Against Comedians (and Why It's a Truly Low Blow)
they try to make up in quantities for a lack of merit or quality
Linux Foundation Apparently Flirting With Slop (Marketing by LLM-Generated SPAM)
The Web is in a really bad state!
COVID-19 Sped Up Site Improvements in Techrights
A few months later we created our very own IRC network
Gemini Links 05/07/2025: Negative Questions and 'Touching Grass' (Going Outside)
Links for the day
Links 05/07/2025: Dalai Lama Succession as 90th Birthday Approaches, 40 deg C in China
Links for the day
Links 05/07/2025: Hungary and US Defecting to Russia, "Google's Hotseat Hypocrisy"
Links for the day
Gemini Links 05/07/2025: 4th of July 2025 and "Zig Roadmap 2026"
Links for the day
How to Combat the Exploitation and Abuse by Microsoft GitHub
Not to mention corruption and crimes against women
Bryan Lunduke is Actually Sending His Audience to Attack People
"[Lunduke] is actually sending his audience to attack people."
Even The Right Wing is Rejecting Bryan Lunduke
no wonder he became so irrelevant and marginal
Microsoft's MSN Helps Microsoft Spread Lies About the Layoffs' Scale (Well Over 25,000 People Laid Off This Year)
There seem to be monopolies on lies and on truth
The Death of X Has Been Greatly Exaggerated (by Compromised Media)
X.Org Server is alive and well
Rewriting Things in Rust
How far would you go?
In 2025 Everything is "AI". Remember Blockchains?
Talk about what companies and things (services, products, software) actually do, not the labels they use
Julian Assange Has Been Free for a Year
Julian Assange and I disagreed on some things
Monopolies and Scalping
Monopolies gravitate towards price hikes
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, July 04, 2025
IRC logs for Friday, July 04, 2025
Microsoft's August Layoffs Wave: "August is Confirmed for Additional Performance Based Cuts"
"August is confirmed for additional performance based cuts from the recent connects along with additional organizational cuts."
What Microsoft Reputation Laundering (With a Weaponised Law Degree) Looks Like in a Foreign Continent
You would expect this in uncivilised and primitive countries
Slopwatch: LLMs 'Write' Fake or Distorted 'News' About "Linux"
LLM slop disguised as news