The European Data Protection Supervisor found the European Commission's use of Microsoft 365 violates several provisions of EU Regulation 2018/1725, "the EU's data protection law for EU institutions, bodies, offices and agencies." Notably, the Commission allegedly did not take adequate safeguards to ensure personal data transferred outside the European Economic Area received the same level of protection once transferred to another jurisdiction. The EDPS mandated the Commission suspend all data flows through the use of Microsoft 365 before 9 Dec. Editor's note: 11 March 2024, 2:30 pm Eastern Time: The IAPP Daily Dashboard mistakenly reported the violation determined by the EDPS. The violation is corrected above.
12 March 2024
EDPS finds European Commission's use of Microsoft 365 violates EU data protection law
Related stories
A view from Brussels: Will the EU pause the AI Act?
Notes from the Asia-Pacific region: India's digital landscape marches ahead
Navigate 2025: Rise of AI brings novel litigation, copyright issues
Navigate 2025: How individuals' feelings inform AI governance practices
There's no opting-out of universal opt-outs