FOLLOW US

A prominent Austrian advocacy group is urging the country's data protection authority to take a closer look at how Microsoft is protecting children's personal information, arguing the tech giant is unfairly trying to "shift" its responsibility under European Union privacy law to the schools that use its educational software and is secretly tracking minors' online activities.

In a pair of complaints filed with Austria's privacy regulator Tuesday, advocacy group NOYB accuses Microsoft of trying to "dodge" its transparency and accountability obligations under the EU's General Data Protection Regulation by "contractually dumping" most of its legal responsibilities on schools that provide Microsoft 365 Education services to their students and by keeping tabs on these users without consent.

While Microsoft insists the schools are the ultimate "data controllers" and are primarily responsible for ensuring their students are able to exercise their rights under the data privacy law while using educational technology, the advocacy group contends these schools "have no realistic way of complying" with these obligations, including responding to students' requests to access their data, because Microsoft maintains control over the systems and information contained within them.

"Microsoft holds all the key information about data processing in its software, but is pointing the finger at schools when it comes to exercising rights," Maartje de Graaf, a data protection lawyer at NOYB, said in a statement.

The advocacy group contends schools and other local authorities lack the "power to influence how Microsoft actually processes user data," which allows the tech company to "dictate the terms and conditions of contracts with anyone who wants to use their products" in the educational space, where software vendors such as Microsoft have captured an "enormous" share of the market.

"Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils' data," de Graaf said. "Everyone knows that such contractual arrangements are out of touch with reality."

Microsoft also fails to give schools clear information about what actually happens to students' data, according to the group, which called "trying to find out exactly what privacy policies or documents apply to the use" of the product "an expedition in itself."

"Microsoft provides such vague information that even a qualified lawyer can't fully understand how the company processes personal data in Microsoft 365 Education," de Graaf said. "It is almost impossible for children or their parents to uncover the extent of Microsoft's data collection."

Additionally, the advocacy group claims Microsoft's educational software deploys cookies that analyze and collect information about users' behaviors for advertising and profiling purposes despite not having a valid legal basis or permission from schools, the children or their parents.

"Microsoft 365 Education appears to track users regardless of their age," Felix Mikolasch, a data protection lawyer at NOYB, said. Mikolasch said the practice "is likely to affect hundreds of thousands of pupils and students" across the EU and called on national data protection authorities to "finally step up and effectively enforce the rights of minors."

The advocacy group is asking the Austrian Data Protection Authority to "investigate and factually analyze what data is being processed by Microsoft 365 Education," noting that it couldn't fully ascertain this information through Microsoft's privacy documentation or the group's own research. The group is also urging the regulator to impose a fine on Microsoft for its alleged failure to adhere to its transparency and data access rights under the GDPR, which allows authorities to recover fines of up to €20 million ($21.8 million) or 4% of its global annual revenue.

Microsoft and the Austrian Data Protection Authority couldn't be reached for comment Tuesday.