EU Data Regulator Finds ‘Serious Concerns’ Over Microsoft Contracts

The EU’s data protection authority said on Monday it has uncovered “serious concerns” over the way citizens’ data is treated under contracts between Microsoft and EU agencies.

In April the European Data Protection Supervisor (EDPS) began an investigation into whether Microsoft’s contracts with EU institutions such as the European Commission are fully compliant with the GDPR data protection regulations introduced last year.

Such agencies outsource the processing of large amounts of citizens’ personal data to software and services groups such as Microsoft, which are considered “data processors” under the GDPR.

As “data controllers”, however, the EU agencies themselves remain accountable under data protection law and are obliged to ensure the compliance of their arrangements with processors.

Compliance

“Though the investigation is still ongoing, preliminary results reveal serious concerns over the compliance of the relevant contractual terms with data protection rules and the role of Microsoft as a processor for EU institutions using its products and services,” the EDPS said.

It cited risk assessments carried out by the Dutch Ministry of Justice and Security as indicating that similar issues are faced by member states’ public authorities.

The EDPS cited amended terms, technical safeguards and settings agreed between the Dutch ministry and  Microsoft as showing that there is “significant scope for improvement” in contracts between public administrations and software and online services providers.

The data protection authority said it wants similar deals to be put into place for other public and private bodies in the EU, as well as for individuals in the region.

It has established a forum aimed at “taking back control” of IT services and products by collectively creating standard contracts rather than accepting the terms and conditions supplied by providers.

‘Step forward’

“The EDPS encourages all concerned parties to join the forum and help us to set fair contractual terms for public administration,” the agency said.

The Dutch deal with Microsoft is a “positive step forward” and should be applied to all consumers and public authorities in the region, said the assistant EDPS, Wojciech Wiewiórowski.

Microsoft said it was “committed” to helping customers comply with the GDPR and other applicable laws.

“We are in discussions with our customers in the EU institutions and will soon announce contractual changes that will address concerns such as those raised by the EDPS,” the company said in a statement.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

UK’s CMA Readies Cloud Sector “Behavioural” Remedies – Report

Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector

6 hours ago

Former Policy Boss At X Nick Pickles, Joins Sam Altman Venture

Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…

8 hours ago

Bitcoin Rises Above $96,000 Amid Trump Optimism

Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…

10 hours ago

FTX Co-Founder Gary Wang Spared Prison

Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…

10 hours ago