Privacy rights organisation noyb has lodged two complaints with Austria’s data protection authority against Microsoft, alleging violations of children’s data protection rights through its ‘365 Education’ services.
The non-profit organisation claims that Microsoft’s services breach the General Data Protection Regulation (GDPR) when pupils attempt to exercise their data protection rights.
According to noyb, Microsoft designates schools as the "controller" of students' data, yet the schools lack actual control over the data processing systems.
The complaint alleges that Microsoft is trying to shift most of its legal responsibilities under GDPR onto the schools that use Microsoft 365 Education services.
As a result, access requests to Microsoft often go unanswered, and schools are unable to fulfil these requests because they do not possess the necessary data.
“This take-it-or-leave-it approach by software vendors such as Microsoft is shifting all GDPR responsibilities to schools,” said Maartje de Graaf, a data protection lawyer at noyb.
De Graaf added that while Microsoft holds all the critical information about data processing, it deflects responsibility to schools, leaving them unable to meet transparency and information obligations.
De Graaf also criticised Microsoft for providing such vague information that even qualified lawyers struggle to fully understand how personal data is processed in Microsoft 365 Education.
She emphasised the difficulty for children and their parents in uncovering the full extent of Microsoft’s data collection.
Microsoft has not yet responded to these allegations.
Follow us
