The European Data Protection Supervisor found the European Commission's use of Microsoft 365 violates several provisions of EU Regulation 2018/1725, "the EU's data protection law for EU institutions, bodies, offices and agencies." Notably, the Commission allegedly did not take adequate safeguards to ensure personal data transferred outside the European Economic Area received the same level of protection once transferred to another jurisdiction. The EDPS mandated the Commission suspend all data flows through the use of Microsoft 365 before 9 Dec. Editor's note: 11 March 2024, 2:30 pm Eastern Time: The IAPP Daily Dashboard mistakenly reported the violation determined by the EDPS. The violation is corrected above.
12 March 2024
EDPS finds European Commission's use of Microsoft 365 violates EU data protection law
Related stories
Notes from the IAPP Canada: Take a deep breath and dive in on AI training
Notes from the Asia-Pacific region: More new problems to solve as AI, data march forward
Notes from the IAPP Europe: It's a GDPR week
Proposed moratorium on state-level AI regulation heads to US Senate
'We cannot be left behind:' How Canada is balancing AI regulation, innovation