European Commission’s use of Microsoft 365 infringes data protection law for EU institutions and bodies

The National Centre for Personal Data Protection (NCPDP), for information purposes, communicates the fact that, following its investigation, the European Data Protection Supervisor (EDPS) has found that the European Commission (EC) has infringed several provisions of Regulation (EU) 2018/1725, the EU Data Protection Act for EU institutions, bodies, offices and agencies, including those on transfers of personal data outside the EU/European Economic Area (EEA), imposing corrective measures. At the same time, the EC failed to provide adequate safeguards to ensure that personal data transferred outside the EU/EEA benefit from an adequate level of protection equivalent to that guaranteed in the EU/EEA. In addition, in its contract with Microsoft, the EC did not sufficiently specify what types of personal data are to be collected and for what purposes when using Microsoft 365. The EC’s breaches as data controller also relate to data processing, including transfers of personal data, carried out on its behalf.

The EDPS has therefore decided to order the EC, since 9 December 2024, to suspend all data flows resulting from the use of Microsoft 365 to Microsoft and its affiliates and subcontractors located in non-EU/EEA countries that are not subject to a adequacy decision and to bring its processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. The EC must demonstrate compliance with both provisions by 9 December 2024.

The EDPS considers that the corrective measures it imposes are appropriate, necessary and proportionate, taking into account the seriousness and duration of the breaches found. Many of the breaches found relate to all processing operations carried out by or on behalf of the EC when using Microsoft 365 and impact on a large number of individuals. The EDPS also takes into account the need not to compromise the EC’s ability to perform its public interest tasks or to exercise its duties as an official authority vested in it, as well as the need to give it adequate time to implement the envisaged suspension of relevant data flows and to bring data processing into compliance with Regulation (EU) 2018/1725.

The NCCDP, as the national supervisory authority for personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.