Key Takeaways
1. Microsoft faces privacy issues in Europe after being found to have illegally tracked students using its 365 Education platform.
2. The Austrian Data Protection Authority ruled that Microsoft did not provide students access to their personal data and shifted GDPR responsibilities onto schools.
3. The ruling highlights violations of Article 15 of the GDPR, which requires clear information on data processing and sharing.
4. Microsoft claims compliance with data protection standards but faces criticism for transferring responsibility to educational institutions.
5. The case reflects broader concerns about how tech companies manage data from minors in educational settings, especially post-pandemic.
Microsoft is currently dealing with a significant privacy challenge in Europe. This comes after Austria’s Data Protection Authority determined that the company “illegally” tracked students using its 365 Education platform. This decision was based on a complaint from the Austrian privacy group, noyb. They claimed that Microsoft did not allow students to access their personal data and pushed the responsibilities of GDPR onto schools.
Background of the Issue
The problem traces back to the COVID-19 pandemic, a time when many schools adopted Microsoft 365 for online learning. With this shift to a digital platform, new privacy concerns emerged as student information was managed through a corporate cloud service.
When students voiced concerns or sought access to their data, Microsoft directed them back to their respective schools. This was problematic since schools were only able to provide limited data information.
Regulatory Findings
The authority found that this method contravened Article 15 of the GDPR. It stated that Microsoft, acting as the data controller, is required to provide comprehensive information on how user data is processed and if it’s shared with outside parties.
Furthermore, the Austrian authority instructed Microsoft to clarify certain technical phrases like “internal reporting,” “business modelling,” and “improvement of core functionality.” Additionally, national and federal education bodies were mandated to ensure similar transparency within a timeframe of ten weeks.
Microsoft’s Response
Microsoft asserted its compliance by stating, “Microsoft 365 for Education meets all required data protection standards,” and indicated it would review the ruling. Nevertheless, data protection attorney Max Schrems from noyb emphasized that this situation illustrates a wider problem. “Big Tech providers try to get all the power, but shift all responsibilities to European customers,” stated Schrems.
The software giant also contended that its subsidiary in Ireland was in charge of 365 Education, claiming that jurisdiction lies there. However, the Austrian authority dismissed this argument, indicating that key decisions were made by Microsoft in the US.
Conclusion
This case underscores an escalating global issue regarding how large tech companies manage data collected from minors in educational environments, particularly after the pandemic, when a greater number of students rely on platforms like Microsoft 365 and Google Classroom for remote learning. If the ruling is upheld, it could significantly alter the way technology companies handle data responsibilities within Europe’s educational landscape.
Source:
Link
