Noyb files lawsuit against Microsoft for violating children’s privacy

The Austrian privacy foundation Noyb is taking Microsoft to court. The organization believes the Redmond-based hard- and software company violates children’s privacy rights by giving schools no control over Microsoft 365 Education.

During the corona pandemic, schools in the European Union increased their spendings to implement a digital environment for students. Noyb, which is an acronym for ‘None of your business’, welcomes these modernization efforts.

At the same time the privacy foundation feels that software vendors like Microsoft have too much influence on how user data is actually processed. Instead of making personalized agreements on what data is collected, they offer a take-it-or-leave-it scenario where all the decision-making power and profits lie with Microsoft.

In practice, this leads to a situation where Microsoft is trying to avoid its legal responsibilities under the GDPR and insists that local authorities and schools are accountable for upholding privacy laws.

“Microsoft holds all the key information about data processing in its software, but is pointing the finger at schools when it comes to exercising rights. Schools have no way of complying with the transparency and information obligations,” Maartje de Graaf, data protection lawyer at Noyb, says.

She claims Microsoft has lost its grasp on reality. “Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils’ data. Everyone knows that such contractual arrangements are out of touch with reality. This is nothing more but an attempt to shift the responsibility for children’s data as far away from Microsoft as possible.”

Noyb: ‘Authorities should enforce the rights of minors more effectively’

De Graaf also mentions there’s a lack of transparency, therefore forcing schools and pupils to read through a maze of privacy policies, documents, terms and contracts. The information Microsoft provides is consistently ambiguous about what actually happens to children’s data when using Microsoft 365 Education.

“Microsoft provides such vague information that even a qualified lawyer can’t fully understand how the company processes personal data in Microsoft 365 Education. It is almost impossible for children or their parents to uncover the extent of Microsoft’s data collection,” De Graaf emphasizes.

There’s one more issue at hand. If a user doesn’t consent to tracking, Microsoft 365 Education still installs tracking cookies. These cookies not only analyze a user’s behaviour, they also collect browser data and are used for advertising. And Microsoft has no legal basis for this processing, which is laid down in article 6 of the GDPR.

“Our analysis of the data flows is very worrying,” Felix Mikolasch, data protection lawyer at Noyb, explains. “Microsoft 365 Education appears to track users regardless of their age. This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA. Authorities should finally step up and effectively enforce the rights of minors.”

Noyb wants the Datenschutzbehörde (DSB), the Austrian data protection authority, to find out what data is being collected and processed by Microsoft 365 Education. If the tech company violates any European privacy rules, the DSB should impose a hefty fine on Microsoft.