After the EU Data Protection Commissioner (EDPS) accused the EU Commission of illegally using Microsoft products, now the situation is being reported against them. The Commission wants the EU Court of Justice to cancel the EDPS investigation report on the use of Microsoft 365. Apparently the EU Commission wants to continue using this software as before.
Advertisement

The EU Commission’s lawsuit (case T-262/24) dated May 17, 2024 was filed earlier this month Published in the Official Journal of the EUreported Patrick Breyer, European MP from the Pirate Party. Microsoft itself is also taking action against the EDPS before the EU Court of Justice (Case T-265/24(The plaintiffs have accused the data protection officer of “legal and factual errors in identifying violations” or “misinterpretation and application” of EU rules. The Microsoft lawsuit contains four causes of action, which the EU Commission has 13.
EU data protection officer Wojciech Wiebroński spent three years investigating the legal aspects of the use of Microsoft 365 in the EU Commission. In March this year he said the Commission had violated several requirements of the special data protection regulation for EU institutions. In particular, the Commission did not ensure adequate protection of personal information going to third countries such as the United States via MS 365.
“Disproportionate measures”
Among other things, the Commission defends itself against the accusation that it did not specify in the interinstitutional licence agreement what types of personal data should be processed and for what purposes. It also considers the EDPS’ conclusion that the Commission did not provide sufficiently clearly documented instructions to be incorrect.
In March, the data protection officer urged the EU Commission to suspend all data traffic resulting from the use of Microsoft 365 to Microsoft and its affiliates and sub-processors in countries outside the EU or EEA by December 9, 2024 at the latest. Like Microsoft, the EU Commission believes the data protection officer has “ordered disproportionate remedial measures” that were based on unfounded assumptions of a breach EU Regulation 2018/1725says Microsoft.
Wieworowski launched the investigation after the European Court of Justice (ECJ) declared the “Privacy Shield” between the EU and the United States unacceptable in July 2020. He said at the time that many contracts for cloud services were concluded before this fundamental decision and would be re-examined.
(Application)
