On February 28, 2024, the Danish data protection authority (Datatilsynet) issued its opinion on Region Syddanmark's planned migration to Microsoft 365.

Background to the opinion

Shortly after the publication of the Datatilsynet's decision regarding the use of Google Workspace (the Chromebook Case), the Region of Syddanmark approached Datatilsynet with two questions that the case raised in relation to Region Syddanmark's own intended migration to Microsoft 365.

Findings of the Datatilsynet

The Datatilsynet noted that the Region Syddanmark forwarded a number of documents regarding the intended use of Microsoft 365. Based on this information, the Datatilsynet highlighted that there is an issue, similar to the Chromebook Case, regarding the passing on of personal data to the cloud service provider - in this case, Microsoft - for its use own purposes, which the region must address. In addition, the Datatilsynet noted that it is not clear on the scope of Microsoft's data processing.

Outcomes

Following the investigation, the Datatilsynet stated that the Region Syddanmark must address issues regarding the transfer of personal data to Microsoft for its own purposes.

As such, the Datatilsynet specified that Region Syddanmark must map, clarify, and assess:

• which categories of persons will the region process personal data about as part of the use of Microsoft 365;

• what personal data will the region process about these categories of people, and to what extent will metadata about these people be collected and processed;

• what legal basis will form the background for the region's processing of personal data;

• for what specific purposes will Microsoft concretely process information as part of keeping 'products up-to-date and performing and improving users' productivity, reliability, efficiency, quality, and security', and in what role;

• how are the aggregated statistics generated concretely, including in particular whether the aggregation or anonymization takes place before information is passed on to Microsoft; and

• will the legal basis in question be able to form the basis for passing on the personal data in question to Microsoft for the purposes described above.

You can read the press release here and the opinion here, both only available in Danish.