FOLLOW US

A prominent Austrian advocacy group is urging the country's data protection authority to take a closer look at how Microsoft is protecting children's personal information, arguing the tech giant is unfairly trying to "shift" its responsibility under European Union privacy law to the schools that use its educational software and is secretly tracking minors' online activities.

In a pair of complaints filed with Austria's privacy regulator Tuesday, advocacy group NOYB accuses Microsoft of trying to "dodge" its transparency and accountability obligations under the EU's General Data Protection Regulation by "contractually dumping" most of its legal responsibilities on schools that provide Microsoft 365 Education services to their students and by keeping tabs on these users without consent.

While Microsoft insists the schools are the ultimate "data controllers" and are primarily responsible for ensuring their students are able to exercise their rights under the data privacy law while using educational technology, the advocacy group contends these schools "have no realistic way of complying" with these obligations, including responding to students' requests to access their data, because Microsoft maintains control over the systems and information contained within them.

"Microsoft holds all the key information about data processing in its software, but is pointing the finger at schools when it comes to exercising rights," Maartje de Graaf, a data protection lawyer at NOYB, said in a statement.

The advocacy group contends schools and other local authorities lack the "power to influence how Microsoft actually processes user data," which allows the tech company to "dictate the terms and conditions of contracts with anyone who wants to use their products" in the educational space, where software vendors such as Microsoft have captured an "enormous" share of the market.

"Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils' data," de Graaf said. "Everyone knows that such contractual arrangements are out of touch with reality."

Microsoft also fails to give schools clear information about what actually happens to students' data, according to the group, which called "trying to find out exactly what privacy policies or documents apply to the use" of the product "an expedition in itself."

"Microsoft provides such vague information that even a qualified lawyer can't fully understand how the company processes personal data in Microsoft 365 Education," de Graaf said. "It is almost impossible for children or their parents to uncover the extent of Microsoft's data collection."