Microsoft faces scrutiny over privacy practices in Education Suite

Austrian data protection group noyb has raised alarms over Microsoft 365 Education's data practices, claiming it tracks users regardless of age, affecting hundreds of thousands of students in the EU and EEA.

Felix Mikolasch, a data protection lawyer at noyb, emphasized the urgency for authorities to protect minors' rights.

Noyb has asked the Austrian Data Protection Authority (DPA) to investigate and potentially fine Microsoft if General Data Protection Regulation (GDPR) violations are confirmed. Microsoft responded, asserting compliance with GDPR and a commitment to user privacy.

Microsoft provides such vague information that even a qualified lawyer can’t fully understand how the company processes personal data in Microsoft 365 Education. It is almost impossible for children or their parents to uncover the extent of Microsoft’s data collection,

said Maartje de Graaf, data protection lawyer at noyb, in a statement.

Despite Microsoft's base in Ireland, noyb believes the Austrian DPA can handle the complaints locally due to their relevance to Austrian schools and students. This could lead to quicker resolution and enforcement.

The EU has imposed significant fines for children’s data protection breaches, including penalties on Meta and TikTok. Microsoft 365 also faces broader legal scrutiny in the EU, with compliance issues identified by the European Data Protection Supervisor and German authorities.