Microsoft Faces Privacy Complaints Over Education 365 Software in Austria

The privacy advocacy group NOYB (None of Your Business) has filed two complaints with Austria's privacy regulator against Microsoft, alleging that the company's Education 365 software violates the data protection rights of hundreds of thousands of students in the European Union.

NOYB's first complaint centers on Microsoft's alleged attempt to shift its responsibility as a data controller under EU privacy rules (GDPR) to schools. According to NOYB lawyer Maartje de Graaf, this system is impractical for schools. "Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils' data. Everyone knows that such contractual arrangements are out of touch with reality," she said.

The second complaint focuses on the use of tracking cookies in Microsoft's 365 Education suite, which includes programs like Word, Excel, Microsoft Teams, PowerPoint, and Outlook. NOYB claims that these cookies allow advertisers to track users, including minors, without their consent. Felix Mikolasch, another lawyer for NOYB, expressed concern over this practice, stating, "Our analysis of the data flows is very worrying. Microsoft 365 Education appears to track users regardless of their age. This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA."

Microsoft has responded to these allegations by asserting that its Education 365 software complies with GDPR and other applicable privacy laws. A Microsoft spokesperson stated, "M365 for Education complies with GDPR and other applicable privacy laws, and we thoroughly protect the privacy of our young users."

Why this matters: This matter has significant implications for the privacy and data protection of hundreds of thousands of students in the EU and EEA. If Microsoft is found to be in violation of GDPR, it could face substantial fines and be forced to make significant changes to its Education 365 software.

NOYB is urging the Austrian Data Protection Authority to investigate these complaints and impose fines on Microsoft if violations are confirmed. The advocacy group argues that the current system unfairly burdens local schools with compliance responsibilities they are not equipped to handle.

The outcome of this investigation could have significant repercussions for Microsoft, especially considering the scale of potential fines under GDPR, which can reach up to 4% of a company's global annual turnover. This case also highlights broader concerns about the transparency and accountability of tech giants in handling minors' data, which could hit their reputation.

The investigation unfolding, the focus will remain on how Microsoft addresses these serious allegations and whether the Austrian Data Protection Authority will take decisive action to protect the privacy rights of students across the EU and EEA.

Key Takeaways

• NOYB files 2 complaints against Microsoft's Education 365 software in Austria.
• Microsoft allegedly shifts data controller responsibility to schools, violating GDPR.
• Tracking cookies in Education 365 suite allow advertisers to track users without consent.
• Microsoft faces potential fines up to 4% of global annual turnover if found guilty.
• Investigation outcome may impact Microsoft's reputation and handling of minors' data.