03.16.21

Gemini version available ♊︎

EPO and Microsoft Collude to Break the Law — Part X: The Spectre of GDPR…

Posted in Europe, Microsoft, Patents at 8:57 am by Dr. Roy Schestowitz

Previous parts:

GDPR and Microsoft
More about Microsoft’s run-ins with European data protection authorities

Summary: António Campinos and his friends may have put the EPO in legal “hot water”, having already outsourced EPO data to a serial GDPR violator with a notorious track record in other aspects, too

In April 2019 it was reported that “the Spectre of GDPR” continued to haunt the hallowed halls of Redmond, this time in the shape of an investigation ordered by the EU Data Protection Supervisor (EDPS) into Microsoft products used by EU institutions.

The move by the EDPS was prompted by the outcome of the Data Protection Impact Assessment which had been commissioned by the Dutch Ministry of Justice and Security in 2018.

“The move by the EDPS was prompted by the outcome of the Data Protection Impact Assessment which had been commissioned by the Dutch Ministry of Justice and Security in 2018.”The EDPS noted that any EU institutions using the applications investigated by the Dutch authorities would face similar issues including “increased risks to the rights and freedoms of individuals”.

The report of the EDPS on the “Outcome of own-initiative investigation into EU institutions’ use of Microsoft products and services” was published on 2 July 2020.

The EDPS identified a number of serious issues calling for further action, including the following:

• The licensing agreement between Microsoft and the EU institutions was formulated in loose manner that effectively permitted Microsoft to act as a data controller which the EDPS found inappropriate.

• The lack of control by EU institutions over which sub-processors Microsoft used and the lack of meaningful audit rights presented significant issues which needed to be addressed.

• EU institutions were unable to control the location of a large portion of the data processed by Microsoft. Nor did they properly control what was transferred out of the EU/EEA and how. There was also a lack of proper safeguards to protect data that left the EU/EEA.

• EU institutions had few guarantees at their disposal to defend their privileges and immunities and to ensure that Microsoft would only disclose personal data insofar as permitted by EU law.

According to the EDPS, the EU institutions lacked sufficient clarity as to the nature, scope and purposes of the data processing carried out by Microsoft and the risks to data subjects for the purpose of complying with their transparency obligations towards data subjects.

The EDPS recommended that all EU institutions perform tests using a revised and comprehensive approach in order to monitor and stem the flow of personal data generated by Microsoft products and services and sent to Microsoft.

“The EDPS recommended that all EU institutions perform tests using a revised and comprehensive approach in order to monitor and stem the flow of personal data generated by Microsoft products and services and sent to Microsoft.”It remains to be seen whether or not the EDPS’ beef with Microsoft will be resolved in an amicable manner or whether it will result in the imposition of GDPR fines which, in serious cases, can be as much as 4% of a company’s worldwide annual revenue.

Microsoft has also had its fair share of grief with the data protection authorities in the EPO’s main host country, Germany.

Back in July 2019 it was reported that the data protection authority in the state of Hesse had issued a ruling that Microsoft’s Office 365 could no longer be used by schools following the closure of a German data centre which had been used by Microsoft to provide cloud services.

This ruling came after several years of domestic debate about whether German schools and other state institutions should be using Microsoft software at all.

To allay German privacy concerns, Microsoft had invested millions in a German cloud service, and in 2017 Hesse authorities agreed that local schools could use Office 365 as long as German data remained in the country. But in August 2018 Microsoft decided to shut down the German service which meant that, once again, data from local Office 365 users would be transmitted across the Atlantic.

“…in August 2018 Microsoft decided to shut down the German service which meant that, once again, data from local Office 365 users would be transmitted across the Atlantic.”In view of the changed circumstances, the data protection commissioner decided that there was now an unacceptable risk that users’ data could be accessed by US authorities.

More recently, in October 2020, it was reported that at the Conference of German Federal and State Data Protection Supervisory Authorities, a majority of Germany’s regional data protection commissioners supported a finding that Microsoft Office 365 did not comply with GDPR standards. They also made clear that changes were urgently needed to comply with the CJEU Schrems II judgment on cross-border data transfers.

Once again, it’s too early to say whether this matter will be resolved in an amicable manner or whether it will result in the imposition of GDPR fines.

However, for some time now German lawyers have been warning their clients about the potential financial risks of using non-GDPR compliant software, including many widely used Microsoft products.

For example, one Hamburg-based law firm published the following advice in July 2020:

“…for some time now German lawyers have been warning their clients about the potential financial risks of using non-GDPR compliant software, including many widely used Microsoft products.”“Using MS-Teams, Skype and other Office 365 services violates data protection law and may result in million Euro fines. That’s the conclusion of two papers recently issued by the Berlin Commissioner for Data Protection and Freedom of Information. There is urgent need for action in many companies now.”

Time will tell whether or not such warnings are justified. However, based on past experience Microsoft is unlikely to be given an easy ride by the German and other European data protection authorities and this may well have some unpleasant fallout for commercial users of its services and products.

In the meantime German scepticism about Microsoft has surfaced in the European Parliament.

In February 2020, Klaus Buchner – a university professor, physicist, and MEP for the green-conservative Ecological Democratic Party – submitted the following question to the EU Commission:

Subject: Microsoft Windows 10 in European local authorities

IT is part of our critical infrastructure, and in European local authorities as well IT means Microsoft Windows and Microsoft Office. It is as if European drivers could only buy cars made by one US manufacturer. As a result, European local authorities and European industry are totally dependent on a foreign monopoly supplier and are required to kow-tow to a foreign legal system and comply with foreign court judgments, which apply to Microsoft in the EU as well. To make matters worse, Windows 10 systematically transmits personal data to Microsoft. Little is known about how that data is used. The upshot is that local authorities may find themselves facing legal action for breaches of the data protection rules and the German Industrial Constitution Law. Background: ‘[...] The Data Protection Officers of the Federal Government and the Länder see little scope for using Microsoft’s Windows 10 operating system in accordance with the law […]’

Instead, standard programmes could be developed at EU level and made available to local authorities free of charge. This standard software could also be hosted in regional data centres in the EU and interested local authorities could transfer their IT operations to those centres. Of course, each local authority would be required to tailor the standard programmes to local needs and operate them independently, either from their own data centres or in an EU cloud.

1. Are there alternatives to monopoly costs and data protection problems?
2. Does the Commission see any scope for offering greater support for the use of free openware such as Linux and OpenOffice / LibreOffice?

The answer which came back from EU Commissioner Thierry Breton was for the most part the usual hot air which didn’t really address the elephant in the room.

“In the meantime German scepticism about Microsoft has surfaced in the European Parliament.”However, Breton took advantage of the opportunity to plug the Commission’s ongoing efforts to promote an “EU cloud initiative” which would “offer credible European alternatives to non-EU providers”.

And with that, we conclude our potted history of Microsoft’s long-running and continuing problems with European data protection authorities.

In the next part we will take a look at some “close encounters” between the software behemoth of Redmond and other regulatory authorities, in particular the trust-busters on both sides of the Atlantic.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. IRC Proceedings: Wednesday, October 20, 2021

    IRC logs for Wednesday, October 20, 2021



  2. [Meme] EPO Legal Sophistry and Double Dipping

    An imaginary EPO intercept of Administrative Council discussions in June 2013...



  3. Links 21/10/2021: PostgreSQL JDBC 42.3.0 and Maui Report

    Links for the day



  4. [Meme] [Teaser] “Judge a Person Both by His Friends and Enemies”

    Fervent supporters of Team Battistelli or Team Campinos (a dark EPO era) are showing their allegiances; WIPO and EPO have abused staff similarly over the past decade or so



  5. 'Cluster-Voting' in the European Patent Office/Organisation (When a Country With 1.9 Million Citizens Has the Same Voting Power as a Country With 83.1 Million Citizens)

    Today we examine who has been running the Finnish patent office and has moreover voted in the EPO during the ballot on unlawful "Strike Regulations"; they voted in favour of manifestly illegal rules and for 8.5 years after that (including last Wednesday) they continued to back a shady regime which undermines the EPO's mission statement



  6. The EPO’s Overseer/Overseen Collusion — Part XVIII: Helsinki's Accord

    The Finnish outpost has long been strategic to the EPO because it can help control the vote of four or more nations; evidence suggests this has not changed



  7. [Meme] Living as a Human Resource, Working for Despots

    The EPO has become a truly awful place/employer to work for; salary is 2,000 euros for some (despite workplace stress, sometimes relocation to a foreign country)



  8. Links 20/10/2021: New Redcore Linux and Hospital Adoption of GNU Health

    Links for the day



  9. IRC Proceedings: Tuesday, October 19, 2021

    IRC logs for Tuesday, October 19, 2021



  10. Links 19/10/2021: Karanbir Singh Leaves CentOS Board, GPL Violations at Vizio

    Links for the day



  11. [Meme] Giving the Knee

    The 'knee' champion Kratochvìl and 'kneel' champion Erlingsdóttir are simply crushing the law; they’re ignoring the trouble of EPO staff and abuses of the Office, facilitated by the Council itself (i.e. facilitated by themselves)



  12. Josef Kratochvìl Rewarded Again for Covering Up EPO Corruption and the EPO Bribes the Press for Lies Whilst Also Lying About Its Colossal Privacy Violations

    Corrupt officials and officials who actively enable the crimes still control the Office and also the body which was supposed to oversee it; it's pretty evident and clear judging by this week's press statements at the EPO's official Web site



  13. [Meme] Sorry, Wrong Country (Or: Slovenia isn't Great Britain)

    Team UPC is trying to go ahead with a total hoax which a high-level European court would certainly put an end to (if or when a referral is initiated)



  14. How Denmark, Iceland, Finland, Norway and Sweden Voted on Patently Unlawful Regulations at the EPO

    We look back and examine what happened 8 years ago when oppressed staff was subjected to unlawful new “regulations” (long enjoyed by António Campinos, the current EPO autocrat)



  15. The EPO’s Overseer/Overseen Collusion — Part XVII: The Non-Monolithic Nordic Bloc

    We start our investigation of how countries in northern Europe ended up voting on the unlawful “Strike Regulations” at the EPO and why



  16. Proof That Windows “11” is a Hoax

    Guest post by Ryan, reprinted with permission



  17. Firefox Becomes as Morally Reprehensible as Apple, Facebook, or Uber

    Guest post by Ryan, reprinted with permission



  18. Links 19/10/2021: GNU dbm 1.22 and Godot 3.4 RC 1

    Links for the day



  19. [Meme] [Teaser] GitHub an Expensive and Dangerous Trap (Also: Misogyny Hub)

    The ongoing Microsoft GitHub exposé will give people compelling reasons to avoid GitHub, which is basically just a subsidised (at a loss) trap



  20. Norway Should Have Voted Against Benoît Battistelli's Illegal (Anti-)'Strike Regulations' at the European Patent Office

    Benoît Battistelli‘s EPO faced no real and potent opposition from Norwegian delegates, who chose to abstain from the vote on the notorious and illegal so-called ‘Strike Regulations’ (they’re just an attack on strikes, an assault on basic rights of labourers)



  21. Links 19/10/2021: Sequoia PGP LGPL 2.0+, Open RAN Adoption

    Links for the day



  22. [Meme] [Teaser] Benoît Battistelli, King of Iceland

    Later today we shall see how the current deputy of the head of the EPO‘s overseeing body was in fact likely rewarded for her complicity in Benoît Battistelli‘s abuses against EPO staff, including staff from Iceland



  23. IRC Proceedings: Monday, October 18, 2021

    IRC logs for Monday, October 18, 2021



  24. Links 19/10/2021: MyGNUHealth 1.0.5 and Ubuntu 22.04 Now Developed

    Links for the day



  25. [Meme] [Teaser] Thrown Under the Bus

    Tomorrow we shall look at Danish enablers of unlawful EPO regulations, Jesper Kongstad and Anne Rejnhold Jørgensen



  26. The World Needs to Know What Many Austrians Already Know About Rude Liar, the Notorious 'Double-Dipper'

    Today we publish many translations (from German) about the Austrian double-dipper, who already became the subject of unfavourable press coverage in his home country; he’s partly responsible for crushing fundamental rights at the EPO under Benoît Battistelli‘s regime



  27. The EPO’s Overseer/Overseen Collusion — Part XVI: The Demise of the Austrian Double-Dipper

    Friedrich ‘Rude Liar’ Rödler is notorious in the eyes of EPO staff, whom he was slandering and scandalising for ages while he himself was the real scandal



  28. Links 18/10/2021: Porteus Kiosk 5.3 and Ventoy 1.0.55

    Links for the day



  29. [Meme] [Teaser] More to Life Than Patents

    Greedy sociopaths oughtn’t be put in charge of patent offices; this is what’s dooming the EPO in recent years (all they think about is money



  30. Microsoft GitHub Exposé — Part II — The Campaign Against GPL Compliance and War on Copyleft Enforcement

    Microsoft contemplated buying GitHub 7.5 years ago; the goal wasn’t to actually support “Open Source” but to crush it from the inside and that’s what Microsoft has been doing over the past 2.5 years (we have some details from the inside)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts