A group filed a formal complaint alleging that Microsoft education software which is extensively used in schools around Europe, is probably tracking hundreds of thousands of students.
The Austrian data protection authority (DPA) confirmed on Tuesday that it has received two complaints from a nonprofit privacy rights organisation, noyb, against Microsoft over its cloud-based educational software suite, Microsoft 365 Education.
The first complaint claimed that data processing is not done transparently. noyb noted that Microsoft’s contracts with schools try to place the onus of GDPR compliance on them.
The second complaint focused on how Microsoft 365 Education software uses tracking cookies. According to reports, these cookies track user behaviour and gather surfing data, maybe for marketing purposes.
According to Noyb, these tracking methods take place without the users’ awareness or consent, and there doesn’t seem to be any legal basis for them under the General Data Protection Regulation (GDPR).
Noyb expressed concern that the data of kids is being processed illegally and criticised the internet giant for providing “consistently vague” information about how children’s data is utilised.
“Microsoft provides such vague information that even a qualified lawyer can’t fully understand how the company processes personal data in Microsoft 365 Education.
It is almost impossible for children or their parents to uncover the extent of Microsoft’s data collection,” said Maartje de Graaf, data protection lawyer at noyb, in a statement.
As noted by Felix Mikolasch, another NOYB data protection attorney, the programme tracks users irrespective of their age. “This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA. Authorities should finally step up and effectively enforce the rights of minors,” he said.
According to a Microsoft representative, the software “complies with GDPR and other applicable privacy laws” and the corporation fully safeguards the privacy of its younger customers.
“We are happy to answer any questions data protection agencies might have about today’s announcement,” the spokesman concluded.
We earlier reported that Microsoft and Cloud Infrastructure Services Providers in Europe (CISPE), a cloud advocacy group supported by Amazon, are getting close to an agreement to drop an antitrust lawsuit that was submitted to the European Commission.
