In a significant move, advocacy group None of Your Business (NOYB) has lodged two complaints with Austria’s privacy watchdog, accusing Microsoft of shifting its responsibility for protecting children’s personal data onto schools.

The complaints center around Microsoft’s 365 Education suite and raise serious concerns about compliance with the General Data Protection Regulation (GDPR). As online education tools became essential during the COVID-19 pandemic, this case highlights the critical issue of data protection in digital learning environments.

Growing Concerns Over Online Education Tools

The use of online educational tools surged during the COVID-19 pandemic as schools transitioned to remote learning. Microsoft’s 365 Education suite, which includes Word, Excel, Microsoft Teams, PowerPoint, and Outlook, became integral to this shift. However, NOYB alleges that Microsoft is not taking proper responsibility for the data protection of students using these tools.

The First Complaint: Data Controller Responsibilities

NOYB’s first complaint focuses on Microsoft’s role as a data controller. According to EU privacy rules under the General Data Protection Regulation (GDPR), a data controller is responsible for processing users’ personal data. 

NOYB claims that Microsoft is avoiding this responsibility by passing it onto schools, which are not equipped to handle such duties. “Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils’ data.

Everyone knows that such contractual arrangements are out of touch with reality,” said NOYB lawyer Maartje de Graaf. “This is nothing more than an attempt to shift the responsibility for children’s data as far away from Microsoft as possible.”

Microsoft’s Response

Microsoft has responded by stating that its M365 for Education complies with GDPR and other applicable privacy laws. A Microsoft spokesperson said, “We thoroughly protect the privacy of our young users and are happy to answer any questions data protection agencies might have about today’s announcement.”

The Second Complaint: Tracking Cookies

The second complaint from NOYB addresses the use of tracking cookies within the Microsoft 365 Education suite. These cookies, used by advertisers to track consumer behavior, allegedly track students regardless of their age, without proper consent.

“Our analysis of the data flows is very worrying. Microsoft 365 Education appears to track users regardless of their age. This practice is likely to affect hundreds of thousands of pupils and students in the EU and EEA,” said NOYB lawyer Felix Mikolasch.

Call for Investigation and Enforcement

NOYB is urging the Austrian Data Protection Authority to investigate these complaints thoroughly and to impose fines if violations of the GDPR are confirmed. Even experienced lawyers find the information Microsoft provides regarding the processing of children’s data to be too ambiguous and difficult to understand.

Broader Implications and Previous Penalties

If the Austrian Data Protection Authority finds Microsoft in violation of GDPR, the implications could be severe, potentially resulting in significant fines. GDPR complaints related to children’s data have previously led to substantial penalties. 

For instance, Meta received a €405 million fine for Instagram-related breaches, and TikTok was fined €345 million for failing to protect minors’ data.

NOYB believes that the Austrian DPA is competent in investigating these complaints, given their local relevance to Austrian schools and students. This could lead to swifter decision-making and potential enforcement actions against Microsoft.

Final thoughts 

The outcome of this investigation could have far-reaching implications for the use of online educational tools and the protection of children’s data. 

As NOYB’s complaints highlight significant concerns, it is crucial for tech companies and educational institutions to ensure robust data protection practices, especially when it comes to vulnerable groups like children. The tech industry will be closely watching the developments in this case.

The information is taken from Yahoo News and AOL