“Microsoft provides such vague information that even a qualified lawyer can’t fully understand how the company processes personal data in Microsoft 365 Education,” de Graaf said. “It is almost impossible for children or their parents to uncover the extent of Microsoft’s data collection.”
Additionally, the advocacy group claims Microsoft’s educational software deploys cookies that analyze and collect information about users’ behaviors for advertising and profiling purposes despite not having a valid legal basis or permission from schools, the children or their parents.
“Microsoft 365 Education appears to track users regardless of their age,” Felix Mikolasch, a data protection lawyer at NOYB, said. Mikolasch said the practice “is likely to affect hundreds of thousands of pupils and students” across the EU and called on national data protection authorities to “finally step up and effectively enforce the rights of minors.”
The advocacy group is asking the Austrian Data Protection Authority to “investigate and factually analyze what data is being processed by Microsoft 365 Education,” noting that it couldn’t fully ascertain this information through Microsoft’s privacy documentation or the group’s own research. The group is also urging the regulator to impose a fine on Microsoft for its alleged failure to adhere to its transparency and data access rights under the GDPR, which allows authorities to recover fines of up to €20 million ($21.8 million) or 4% of its global annual revenue.
