Austria’s data protection authority has determined that Microsoft “illegally” tracked students using its education software and must grant them access to their data, a privacy campaign group said Friday.
Austria-based privacy campaign group Noyb (None of Your Business) in 2024 lodged a complaint against the company, accusing its Microsoft 365 education software of violating EU data protection rights for children.
Noyb said that Microsoft 365 Education installed cookies that collect browser data and are used for advertising purposes, a practice likely affecting millions of students and teachers across Europe.
In a statement on Friday, Noyb announced that the regulator had issued a decision this week, which “finds that Microsoft 365 Education illegally tracks students and uses student data for Microsoft’s own purposes”.
Microsoft was ordered to provide users, including the complainant — a minor represented by her father — access to their personal data.
The Austrian data protection authority confirmed that it issued a decision on Wednesday but did not give any further details.
While not responding to requests by users for access to data related to its education software, Microsoft “tried to shift all responsibility to local schools” or other national institutions, Noyb said.
“The decision… highlights the lack of transparency with Microsoft 365 Education,” Noyb data protection lawyer Felix Mikolasch said in the statement.
“It is almost impossible for schools to inform students, parents and teachers about what is happening with their data,” he added.
Microsoft said in a statement sent to AFP that the company would review the decision and decide “on next steps in due course”.
“Microsoft 365 for Education meets all required data protection standards, and institutions in the education sector can continue to use it in compliance with GDPR,” it added, referring to the EU’s landmark General Data Protection Regulation.
Noyb, founded by the online privacy activist Max Schrems, has launched several legal cases against technology giants, often prompting action from regulatory authorities over violations of the GDPR.
It has filed more than 800 complaints in various jurisdictions on behalf of internet users.
