Microsoft alleged to divert their responsibily on schools and tracking children data

An Austrian privacy group, NOYB (None of Your Business), has filed two complaints against Microsoft with the Austrian data protection watchdog. The complaints allege that Microsoft is avoiding its responsibilities regarding children’s data privacy and is using schools as a scapegoat.

NOYB’s main point revolves around Microsoft’s 365 Education software suite. The group says that Microsoft is unfairly transferring its obligations as a data controller under the EU’s General Data Protection Regulation (GDPR) to schools.

What do data controllers do? According to GDPR, data controllers are responsible for how user data is processed. NOYB argues that schools lack the resources and expertise to handle these responsibilities, especially when it comes to auditing Microsoft’s data practices.

Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils’ data. Everyone knows that such contractual arrangements are out of touch with reality.

NOYB lawyer Maartje de Graaf said in a statement.

Microsoft, in response to the complaints, maintains that their M365 for Education products comply with GDPR and prioritize user and student privacy.

The second complaint is based on cookies embedded within Microsoft 365 Education.

These cookies, commonly used for advertising purposes, raise concerns that these can be used for user tracking, and hence, are impacting children.

Our analysis of the data flows is very worrying. Microsoft 365 Education appears to track users regardless of their age. This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA (European Economic Area).

Said NOYB lawyer Felix Mikolasch.

NOYB has urged the Austrian Data Protection Authority to investigate their claims and potentially fine Microsoft.

More here.