Microsoft under EU scrutiny for alleged children's data collection
Microsoft is facing allegations of violating children's privacy in the European Union, following two complaints filed by Austrian advocacy group Noyb. The complaints revolve around Microsoft's 365 Education software, which Noyb claims installs cookies that "analyze user behavior, collect browser data and are used for advertising" without schools' awareness. The group also accuses Microsoft of being "consistently vague" about its use of student data, suggesting possible secret tracking of children.
Potential impact on hundreds of thousands of students
According to Felix Mikolasch, a data protection lawyer at Noyb, the data flows from Microsoft 365 Education are "very worrying." He suggests that the software seems to track the users regardless of their age. This practice could potentially affect hundreds of thousands of students across the EU and European Economic Area (EEA). Mikolasch has called for authorities to enforce minors' rights more effectively in light of these allegations.
Noyb accuses Microsoft of shifting GDPR responsibilities
Noyb also alleges that Microsoft is transferring its General Data Protection Regulation (GDPR) responsibilities onto schools, without offering any insight into its privacy policies and data collection practices. Maartje de Graaf, another data protection lawyer at Noyb, stated that "Microsoft holds all the key information about data processing in its software, but is pointing the finger at schools when it comes to exercising rights." She argues that under these circumstances, schools are unable to fulfill transparency and information obligations.
Microsoft responds to Noyb's allegations
In response to the complaints lodged by Noyb, a spokesperson for Microsoft stated that their education software, M365, complies with GDPR and other privacy laws wherever applicable. The company emphasized its commitment to "thoroughly protect the privacy of our young users." Furthermore, Microsoft expressed its readiness to answer any queries from data protection agencies regarding these allegations.
