EU Data Regulator Finds ‘Serious Concerns’ Over Microsoft Contracts

The EU’s data protection authority said on Monday it has uncovered “serious concerns” over the way citizens’ data is treated under contracts between Microsoft and EU agencies.

In April the European Data Protection Supervisor (EDPS) began an investigation into whether Microsoft’s contracts with EU institutions such as the European Commission are fully compliant with the GDPR data protection regulations introduced last year.

Such agencies outsource the processing of large amounts of citizens’ personal data to software and services groups such as Microsoft, which are considered “data processors” under the GDPR.

As “data controllers”, however, the EU agencies themselves remain accountable under data protection law and are obliged to ensure the compliance of their arrangements with processors.


“Though the investigation is still ongoing, preliminary results reveal serious concerns over the compliance of the relevant contractual terms with data protection rules and the role of Microsoft as a processor for EU institutions using its products and services,” the EDPS said.

It cited risk assessments carried out by the Dutch Ministry of Justice and Security as indicating that similar issues are faced by member states’ public authorities.

The EDPS cited amended terms, technical safeguards and settings agreed between the Dutch ministry and  Microsoft as showing that there is “significant scope for improvement” in contracts between public administrations and software and online services providers.

The data protection authority said it wants similar deals to be put into place for other public and private bodies in the EU, as well as for individuals in the region.

It has established a forum aimed at “taking back control” of IT services and products by collectively creating standard contracts rather than accepting the terms and conditions supplied by providers.

‘Step forward’

“The EDPS encourages all concerned parties to join the forum and help us to set fair contractual terms for public administration,” the agency said.

The Dutch deal with Microsoft is a “positive step forward” and should be applied to all consumers and public authorities in the region, said the assistant EDPS, Wojciech Wiewiórowski.

Microsoft said it was “committed” to helping customers comply with the GDPR and other applicable laws.

“We are in discussions with our customers in the EU institutions and will soon announce contractual changes that will address concerns such as those raised by the EDPS,” the company said in a statement.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Judge Approves US Searches Of Passenger Electronic Devices

US border agents only need “reasonable suspicion” and no search warrant to search travellers’ smartphones and laptops

1 hour ago

Apple AR Glasses Set For 2023 Debut – Report

Rumour mill. Apple's augmented reality venture will reportedly deliver its long-rumoured AR glasses released sometime in 2023

18 hours ago

Microsoft Pledges To ‘Honour’ California’s Privacy Rules

Redmond pledges to roll out California's strict CCPA privacy laws across the entire United States

18 hours ago

Plusnet CEO Steps Down As BT Tightens Grip

Long-serving boss of Yorkshire-based Internet Service Provider steps down as BT tightens grip

19 hours ago

Google Signs Healthcare Deal With US Firm Ascension

Privacy worry? Search engine giant Google to gain access to health data on millions of Americans

20 hours ago

Labour Party Claims It Was Hit By Large-Scale Cyberattack

Weeks before the general election, the Labour Party claims its systems have been subjected to a cyberattack

23 hours ago