EU Data Regulator Finds ‘Serious Concerns’ Over Microsoft Contracts

The EU’s data protection authority said on Monday it has uncovered “serious concerns” over the way citizens’ data is treated under contracts between Microsoft and EU agencies.

In April the European Data Protection Supervisor (EDPS) began an investigation into whether Microsoft’s contracts with EU institutions such as the European Commission are fully compliant with the GDPR data protection regulations introduced last year.

Such agencies outsource the processing of large amounts of citizens’ personal data to software and services groups such as Microsoft, which are considered “data processors” under the GDPR.

As “data controllers”, however, the EU agencies themselves remain accountable under data protection law and are obliged to ensure the compliance of their arrangements with processors.


“Though the investigation is still ongoing, preliminary results reveal serious concerns over the compliance of the relevant contractual terms with data protection rules and the role of Microsoft as a processor for EU institutions using its products and services,” the EDPS said.

It cited risk assessments carried out by the Dutch Ministry of Justice and Security as indicating that similar issues are faced by member states’ public authorities.

The EDPS cited amended terms, technical safeguards and settings agreed between the Dutch ministry and  Microsoft as showing that there is “significant scope for improvement” in contracts between public administrations and software and online services providers.

The data protection authority said it wants similar deals to be put into place for other public and private bodies in the EU, as well as for individuals in the region.

It has established a forum aimed at “taking back control” of IT services and products by collectively creating standard contracts rather than accepting the terms and conditions supplied by providers.

‘Step forward’

“The EDPS encourages all concerned parties to join the forum and help us to set fair contractual terms for public administration,” the agency said.

The Dutch deal with Microsoft is a “positive step forward” and should be applied to all consumers and public authorities in the region, said the assistant EDPS, Wojciech Wiewiórowski.

Microsoft said it was “committed” to helping customers comply with the GDPR and other applicable laws.

“We are in discussions with our customers in the EU institutions and will soon announce contractual changes that will address concerns such as those raised by the EDPS,” the company said in a statement.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Cryptocurrency Warning From Bank Of England Governor

Blunt message from Bank of England governor Andrew Bailey, warning people only to buy cryptocurrency…

20 hours ago

Jeff Bezos Offloads $2 Billion In Amazon Shares

Needs some spending money...Amazon CEO Jeff Bezos has this week sold nearly $2 billion worth…

20 hours ago

Twitter Suspends Account Sharing Trump Posts

Shutdown again. An account has been suspended by Twitter for sharing the posts from Donald…

22 hours ago

IBM Claims Breakthrough With 2 Nanometer Chip

Research boffins at IBM are touting a major leap forward in performance and energy efficiency…

2 days ago

Twitter Now Prompts Users To Revise ‘Harmful Replies’

Trolls beware. Twitter releases feature that will deliver a 'reconsider prompt' for users, if they…

2 days ago

Old Routers Pose Security Risk, Warns Which?

Elderly routers that can no longer receive firmware updates posed security risk to millions of…

2 days ago