Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Austria: NOYB files two complaints against Microsoft for violating children's privacy

On June 4, 2024, none of your business (NOYB) filed two complaints against Microsoft Corporation with the Austrian data protection authority (DSB), alleging that Microsoft 365 Education software violated the General Data Protection Regulation (GDPR).

Background of the complaints

NOYB filed two complaints against the use of Microsoft 365 in schools. The first complaint alleges a breach of information obligation while the second alleges unlawful processing of personal data by cookies.

With regard to the information obligation, NOYB alleges that when school children wanted to exercise their GDPR rights, Microsoft said that the schools were the data controllers, however, the schools have no control over the Microsoft system. According to NOYB, Microsoft infringed Articles 5(1)(a) and 12 to 15 of the GDPR and recommends the DSB to impose a fine taking into account that the alleged infringements affect all students and teachers using Microsoft 365 Education licences in Austria, including a large number of minors.

Regarding the use of cookies, NOYB alleges Microsoft violated Article 6(1) of the GDPR in conjunction with Article 5(1)(a) of the GDPR, for lack of legal basis for the data processing using cookies. According to the complaint, Microsoft did not provide complete information or a list of the cookie and tracking technologies it uses in the context of Microsoft 365 Education and did not take appropriate consent for tracking cookies. Further, NOYB alleges Microsoft violated Article 28(3)(a) of the GDPR, as it processed the complainant's personal data in excess of the processing order.

You can read the press release here and the complaints here and here.