Microsoft Under Fire in Austria for Tracking Student Data on 365 Education

Microsoft is facing yet another issue with the service it offers. This time, it needs to clarify some issues in Austria. Austrian regulators say the company broke privacy laws.

According to them, the company is tracking students' data using its 365 Education platform. The decision has raised new worries about how tech giants handle user data. In fact, some users worry whether they even truly follow GDPR rules.

Austria’s Data Protection Authority sided with a complaint from the privacy group noyb. The group said Microsoft wasn’t open about how it used student data.

When students asked for access to their personal data, Microsoft told them to contact their schools. But schools didn’t have full control or details about what happens to the data once it went through Microsoft’s systems.

The regulator said this broke GDPR’s Article 15, which gives users the right to know what’s being done with their data. The ruling said the company, not the schools, is to tell users how it collects, stores, and shares data.

This issue began during the COVID-19 lockdowns. This was the period when schools switched to online learning tools like M365.

It made online learning easier, but it also meant a lot of student data was being stored on its servers. The group noyb said the company never really told the public what it was doing with all that data.

They said the company must clarify what some terms really mean. Some of these terms are

Austrian education authorities were also told to do the same within ten weeks.

Microsoft said its 365 Education products already meet the EU data protection standards.

The company said it will review the ruling. But privacy lawyer Max Schrems, who leads noyb, said the case shows a bigger problem.

“Big Tech companies want to keep the control but push the responsibility onto their European customers,” he said.

The company argues that its Ireland branch was responsible for the education platform, not its US headquarters. But, Austrian officials did not agree with this claim

They said key decisions were made in the US, so the company can’t shift responsibility elsewhere.

This case could have a big effect across Europe. More schools are now using tools like M365 and Google Classroom for everyday learning.

Because of that, regulators are keeping a closer eye on how these companies use and protect student data.