European Commission's Use Of Microsoft 365 Violates GDPR

You know it's bad when an entity you authorized says you violated the law that you helped enact.

The European Data Protection Supervisor (EDPS) is an independent body that oversees the privacy practices of European institutions, such as the European Commission itself. In an order on March 11, 2024, the EDPS has determined that the European Commission has violated several provisions of Regulation 2018/1725 (essentially the GDPR as it applies to EU institutions) through its use of the Microsoft 365 product, including by failing to provide appropriate safeguards for trans-border flows of personal data.

The EDPS also found that the data processing agreement (DPA) between the European Commission and Microsoft failed to sufficiently specify the types of personal data to be processed by Microsoft and the specific purposes for the transfer. It should come as a reminder for all entities subject to the GDPR (either directly or as a processor) to ensure that the