Microsoft announced on Monday 18 November an update to the privacy protection provisions in the terms and conditions of its online service contracts. The announcement was immediately welcomed on Twitter by the European Data Protection Supervisor (EDPS), who considered that it demonstrated “Microsoft’s serious approach to the privacy concerns raised by the EDPS”.
Since April (see EUROPE 12231/9), the EDPS has been investigating whether contracts between Microsoft and European institutions fully complied with European data protection rules. At the end of October, it reported that the preliminary results of the survey revealed “serious concerns” about Microsoft’s role as a subcontractor for the European institutions using its products and services (see EUROPE 12353/1).
The announced update is based on the agreement reached in early May between the Dutch Ministry of Justice and Security and Microsoft on the new general privacy terms and conditions for the Dutch government’s digital workstations. But Microsoft has also announced that these new contractual terms will be available to all customers of its online services, both public and private, worldwide.
In concrete terms, the update will reinforce Microsoft’s responsibility for data protection for a set of processing operations that the company performs when providing online services. Microsoft will therefore specify that it acts as controller when data are processed for specific administrative and operational purposes related to the provision of online services covered by this contractual framework, such as Azure, Office 365, Dynamics and Intune.
Work on updating has already begun, and Microsoft expects to be able to offer these new contractual provisions in early 2020. (Original version in French by Marion Fontana)