The European Commission sanctioned… by Europe, for its misuse of Microsoft 365 on personal data

The European Data Protection Supervisor (EDPS) singled out the European Commission on Monday for violating the law on the data protection of EU institutions when using the Microsoft 365 environment.

What is the height of the height for the European Union when it comes to personal data? Let one of its major authorities sanction one of its fundamental institutions. This is what happened with the EDPS who, on Monday March 11, 2024, announced that he had noted that the European Commission had “ violates several key data protection rules when using Microsoft 365 “. A detail of this statement is necessary.

The European Commission failed to comply with EU rules on personal data when using Microsoft 365

The European Data Protection Supervisor is categorical that the Commission has breached several provisions of the 2018 Regulation on the protection of information for the institutions, bodies and agencies of the European Union. The EDPS, the independent supervisory authority of the European Union, considers that Brussels “ has not provided elements capable of ensuring that personal data transferred outside the EU and the European Economic Area (EEA) benefit from a level of protection essentially equivalent to that guaranteed in the EU/ EEA “.

Here, the authority is targeting the contract between the European Commission and Microsoft. And more particularly, she was interested in the use of the Microsoft 365 application suite (Word, PowerPoint, Outlook, Excel), and in what the Commission did with the information collected, as data controller.

As long as the services are based in the Cloud, EU institutions have an obligation to ensure that the processing of personal data in and outside the EU/EEA “ comes with robust guarantees and measures » in terms of data protection, as the monitoring body reminds us. The latter believes that this is far from being the case on the Brussels side. He thus made a radical decision.

The European Controller no longer wants Brussels to transfer data via Microsoft 365 applications

The EDPS has ordered the European Commission to suspend all data transfers arising from its use of Microsoft 365 to Microsoft and its various subsidiaries located outside the European Union or the EEA. This suspension will be effective from December 9, 2024. By this date, the Commission must have ensured compliance with European Regulation (2018/1725) of processing resulting from its use of Microsoft 365.

The controller adds another layer by indicating that the violations noted are numerous and that they affect a large number of people. The Commission will have to show its credentials. For example, it will have to map all its data transfers, so that it can be identified which personal data has been transferred to which recipients, in which third countries, for what purposes and subject to what guarantees.

The EDPS makes it clear that he is banging his fist on the table, in that he indicates, in the annex to his decision, that he has noted the infringements “ continuously » until March 8, 2024, date of publication of the EDPS to the Commission.