The European Data Protection Supervisor found the European Commission's use of Microsoft 365 violates several provisions of EU Regulation 2018/1725, "the EU's data protection law for EU institutions, bodies, offices and agencies." Notably, the Commission allegedly did not take adequate safeguards to ensure personal data transferred outside the European Economic Area received the same level of protection once transferred to another jurisdiction. The EDPS mandated the Commission suspend all data flows through the use of Microsoft 365 before 9 Dec. Editor's note: 11 March 2024, 2:30 pm Eastern Time: The IAPP Daily Dashboard mistakenly reported the violation determined by the EDPS. The violation is corrected above.
12 March 2024
EDPS finds European Commission's use of Microsoft 365 violates EU data protection law
RELATED STORIES
Controllers, processors and subprocessors in chains
Notes from the IAPP Canada: Recommendations, calls to reform Privacy Act 'a good start'
A view from DC: Marriott and the minimum extent necessary
Retrospective: 2024 in state sectoral privacy law and AI law
Notes from the Asia-Pacific region: India's PM talks global governance for digital technology