Bonum Certa Men Certa

EPO and Microsoft Collude to Break the Law -- Part IX: Know Your Vendor…

Previous parts:



A big brother-like spy
The never-ending saga of Microsoft's run-ins with European data protection authorities



Summary: Microsoft is one of the world's worst offenders when it comes to privacy, but vendor assessment by the EPO conveniently overlooks the law

Even before GDPR came into effect in May 2018, data protection regulators in some European countries were starting to have their doubts about whether Microsoft's flagship product, its Windows operating system, was compliant with European data protection standards.



The first national authority to kick into action was the French National Data Protection Commission (CNIL).

Following an investigation which concluded in June 2016, CNIL issued Microsoft with a formal notice to comply with French data protection regulations. CNIL also ruled that the decision should be made public, given the scale of the violations in question.

"Following an investigation which concluded in June 2016, CNIL issued Microsoft with a formal notice to comply with French data protection regulations. CNIL also ruled that the decision should be made public, given the scale of the violations in question."No fewer than six violations of the French Data Protection Act were identified by CNIL, including continued transfer of data based on Safe Harbor principles despite the fact that the Safe Harbour Agreement had been invalidated by the CJEU in October 2015.

Microsoft was given three months – until 30 September 2016 – to end the identified violations of French Data Protection law or else face the prospect of a fine of up to €150,000.

In June 2017, it was reported that Microsoft had scaled back the volume of data it collected from Windows 10 PCs by "almost half". This led CNIL to announce that Windows 10 was no longer in breach of the country's data protection laws and that it had decided to close the case.

But that was only the first chapter in the never-ending saga of Microsoft's run-ins with European data protection authorities.

"Microsoft was given three months – until 30 September 2016 – to end the identified violations of French Data Protection law or else face the prospect of a fine of up to €150,000."A few months later in October 2017, it was reported that the Dutch data protection authority (Autoriteit Persoonsgegevens) had come to the conclusion that Microsoft was in breach of Dutch data protection law due to the way it processed the personal data of Windows 10 users.

According to the Dutch data watchdog, Microsoft made it impossible for users to give their valid consent to their personal data being processed due to the multiple ways in which that data might subsequently be used.

The Dutch regulator noted that Microsoft had promised to end its "violations", but warned that a failure to do so could lead it to impose a sanction.

After some back and forth with the regulator, Microsoft submitted a revised version of its software in April 2018. However, in the course of testing the revised version the Dutch agency found fresh grounds for concern, discovering what it called in a press release "new, potentially unlawful, instances of personal data processing".

"After some back and forth with the regulator, Microsoft submitted a revised version of its software in April 2018. However, in the course of testing the revised version the Dutch agency found fresh grounds for concern, discovering what it called in a press release "new, potentially unlawful, instances of personal data processing"."In the meantime GDPR had entered into force, and this led the Dutch data protection authority to refer its concerns to the competent lead EU privacy regulator under the new regulations. This was the national data protection authority where Microsoft's regional HQ for the EU is located, namely the Irish Data Protection Commission.

And so the seriously under-resourced Irish DPC added the Microsoft GDPR non-compliance case to an already long list of files concerning the cross-border data processing activities of multiple tech giants which had accumulated on its docket since the GDPR came into force in May 2018.

According to the most recently available reports from May 2020 the Microsoft case is still pending before the Irish Data Protection Commission.

The situation in the Netherlands became even hotter for Microsoft with the decision of the Dutch Ministry of Justice and Security in 2018 to commission a Data Protection Impact Assessment (DPIA) to be carried out on a range of Microsoft products, including Office 365.

"The situation in the Netherlands became even hotter for Microsoft with the decision of the Dutch Ministry of Justice and Security in 2018 to commission a Data Protection Impact Assessment (DPIA) to be carried out on a range of Microsoft products, including Office 365."The DPIA was commissioned because this was a clear-cut case of data processing on a large scale (by 300,000 government employees) which involved personal data, including data that could be potentially used to track the activities of employees.

The aim of the exercise was to assess the extent to which Microsoft's Office Online and the Mobile Office Apps could be deployed in a GDPR-compliant manner by Dutch government organisations.

The scope of the investigation included the five most commonly used Office 365 applications – Word, PowerPoint, Outlook, Excel and Microsoft Teams – in Office Online and the Mobile Office apps, in combination with the use of cloud storage services.

The final report [PDF], which was published in November 2018, identified a number of serious data protection risks, in particular the following:

● Loss of control over the use of personal data; ● Loss of confidentiality; ● Inability to exercise rights; ● Re-identification of pseudonymised data; ● Unlawful (further) processing.

It was noted that effective risk mitigation was outside of the users' control and could only be carried out by Microsoft.

"It was noted that effective risk mitigation was outside of the users' control and could only be carried out by Microsoft."The investigation found an unacceptable lack of control by users over the processing of personal data by Office 365 mobile applications. Because of this government organisations were advised to create policies for their employees stating that they were not to use mobile Office 365 applications.

As we shall see in the next part, the investigation by the Dutch authorities into the GDPR-compliance of Microsoft products prompted the European Data Protection Supervisor to announce its own investigation into Microsoft products used by EU institutions.

Recent Techrights' Posts

Walmart Vizio TVs Scream At Immigrants to Leave America
Reprinted with permission from Ryan Farmer
How Corporations Such as Microsoft Try to Crush Critics and Dissolve Activism
Stay focused
Wikipedia Can Lower Its Hosting Bill by Going More Static, Not Just by Caching, But It Would Not Solve Its Biggest Problems (Bribes and AstroTurfing)
For about 15 years we had a Wiki in this site
Urgent Need for SLAPP Litigation Transparency
Microsofters really want to shut us up
On Shutdowns and 2,000 More Layoffs at Microsoft (10,000 Microsoft Staff May Have Already Been Laid Off in 2025)
Microsoft tries to hide and belittle mass layoffs; its data centre business also flounders, so it issues puff pieces about some anniversary over and over again
Open Source Initiative (OSI) Privacy Fiasco in Detail: A "Deep Dive" Into the Complaint at the California Privacy Protection Agency
There are many facets to it and it may be the first complaint of several
Microsoft Problems in Europe Even Before the Cheeto Tariffs
The case of Romania, Europe's notorious Microsoft fan
Oman in 2025: GNU/Linux Growing to 5%
what can Microsoft do about it except sabotage the PCs?
Microsoft Shares Collapse Again (Down $101), Fifth Round of Microsoft Mass Layoffs in Less Than 100 Days in 2025
disaster
 
Links 08/04/2025: Microsoft Shrinking, Oracle's Clown Computing Cracked
Links for the day
Stolen Credit Card and LinkedIn. DHS Spies on Immigrant Social Media.
Reprinted with permission from Ryan Farmer
At 50, Microsoft Has Over 100 Billion Dollars in Debt and Less Than 25% "Market Share" (Windows)
statCounter basically sees less than a quarter of Web requests coming from Windows
linuxhint.com Died 12 Months Ago (After Adopting Image Slop)
Zombie sites
LLM Slop Will Eventually Stop Due to High Costs, Worse Training Sets (Polluted Models Ingesting Their Own Junk), and No Real Returns
This too shall pass
Courage is Contagious
I became a witness to acts of great courage from EPO examiners
Gemini Links 08/04/2025: Gabbro 0.1.4 and Disillusioned With Social Control Media
Links for the day
Microsoft Windows in Jordan: From 99% Down to 10%
This is becoming more "normal"
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, April 07, 2025
IRC logs for Monday, April 07, 2025
Gemini Links 07/04/2025: Stock Market, Galène, and DMT Entities
Links for the day
During the Weekend We Said Fedora DEI Requires Proprietary Software, Now the Chat About It Is No Longer Accessible Over the Open Web
is this just a coincidence and an habitual change in Element?
Links 07/04/2025: US Measles Fatalities and China Launches HDMI and DisplayPort Alternative
Links for the day
Links 07/04/2025: More Cuts to Science Funding, Snail-speed Internet in Germany
Links for the day
Gemini Links 07/04/2025: Leasehold and Safe Gifts
Links for the day
In Some Countries, Laptops and Desktops Become a Dying Breed (Even Before Tariffs), Windows Has Nowhere to Go
expect more GNU/Linux on new and existing laptops
When the Credibility or 'Quality' of Clients Ceases to Matter, It's About Helping Rich Companies Like Microsoft Censor Critics (No Matter the Risks)
Bad ideas typically result in undesirable outcomes
UAE: GNU/Linux and Android at Record Levels, Windows at New Lows and Falling Below Apple
Even iOS is measured as bigger than Windows this month
Links 07/04/2025: Reddit Occupied (Social Control Media Controlled by Oligarchy), Demise of Globalisation Ongoing
Links for the day
Windows Has Fallen to All-Time Lows in Switzerland Since GNU Celebrated 40th Anniversary (GNU’s 40th Birthday in Biel, Switzerland)
GNU/Linux has been doing well in Switzerland
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, April 06, 2025
IRC logs for Sunday, April 06, 2025
Links 07/04/2025: Leaving Gemini/smolweb and Mastodon Migrations
Links for the day
In Iraq, Windows 3.1 (Percent)
There's also zero
One Person's Take on Jef Spaleta, the New Fedora Project Leader
"With a little searching, I wonder what else may be found regarding Microsoft."
Links 06/04/2025: Flood, Cool Gemini Capsule, and Long Form
Links for the day
Links 06/04/2025: Science, Politics, and Pricier Goods
Links for the day
LLM Slop Has Virtually Killed unixmen.com and Many Other Sites
There's no longer any incentive to write real articles in there
Sharp Declines for Microsoft Windows in Bangladesh (Pop. ~175,000,000), Big Gains for GNU/Linux
Microsoft Windows has been having a really hard time in poor countries
Links 06/04/2025: Fake Reviews, Privatisation Heists, and "AI" as Smokescreen for Impoverishing Humans
Links for the day
Taking a Moral Stand Against Strategic Lawsuits Against Public Participation (SLAPPs) and the Worst Offenders/Facilitators
Any other stance would sidle with moral depravity or moral hazard
Links 06/04/2025: Many New Acts of Repression and Elements of Financial Depression
Links for the day
In Qatar GNU/Linux Rose From Under 1% to Over 4% in Two Years (or Over 5% If Counting ChromeOS)
It's a big improvement compared to what we saw last year
LLM Scrapers Are a Nuisance, But They're Also a Reminder It's Time to Make Your Site Static
Perhaps the best protection is the ability to endure surges
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, April 05, 2025
IRC logs for Saturday, April 05, 2025
Links 06/04/2025: Attacks on Education, Fake Patents, and Fake (Illegal) Patent Courts
Links for the day
France: Apple and Microsoft Down, GNU/Linux Up to New Record Levels
How will tariffs against France impact things in the coming months?