[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvPyT7RrFzwOCrdTHaAxppNmjrJ43TQlFo42x2_L6DMk":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"8a521290-d9d0-4e1e-beef-2aba3cbda43d","EDPS - 2021-0518","edps-2021-0518-b3b20a","EU LAW CLEAN-UP ← Older revision Revision as of 12:54, 17 July 2026 Line 41: Line 41: |GDPR_Article_Link_6= |GDPR_Article_Link_6= |EU_Law_Name_1= Article 9 of Regulation (EU) 2018\u002F1725 as specific rule for EU institutions |EU_Law_Name_1= Article 9 Regulation (EU) 2018\u002F1725 |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Name_2=Articles 4(1)b, 6, 29 and 48 of Regulation (EU) 2018\u002F1725 corresponding to the above articles of the GDPR |EU_Law_Name_2=Article 4(1)b Regulation (EU) 2018\u002F1725 |EU_Law_Link_2=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Link_2=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Name_3=Articles 4(2), 26(1) and 46 of Regulation (EU) 2018\u002F1725 |EU_Law_Name_3=Article 4(2) Regulation (EU) 2018\u002F1725 |EU_Law_Link_3=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Link_3=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Name_4= |EU_Law_Name_4=Article 6 Regulation (EU) 2018\u002F1725 |EU_Law_Link_4= |EU_Law_Link_4=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |EU_Law_Name_5= |EU_Law_Name_5=Article 29 Regulation (EU) 2018\u002F1725 |EU_Law_Link_5= |EU_Law_Link_5=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj |National_Law_Name_1= |National_Law_Name_1= Line 71: Line 71: |Initial_Contributor=lszabo |Initial_Contributor=lszabo | | }} |EU_Law_Name_6=Article 48 Regulation (EU) 2018\u002F1725|EU_Law_Link_6=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj|EU_Law_Name_7=Article 26(1) Regulation (EU) 2018\u002F1725|EU_Law_Link_7=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj|EU_Law_Name_8=Article 46 Regulation (EU) 2018\u002F1725|EU_Law_Link_8=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj}} The EDPS reprimanded the Commission and ordered to bring processing related to use of Microsoft 365 in line with EU data protection rules and suspended the data flows to countries for which there is no adequacy decision with effect 9th December 2024 The EDPS reprimanded the Commission and ordered to bring processing related to use of Microsoft 365 in line with EU data protection rules and suspended the data flows to countries for which there is no adequacy decision with effect 9th December 2024 Line 112: Line 112: Another issue was that the “EU storage guarantee” offered by Microsoft did not cover all types of data. Some data may be accessible to recipients in third countries. The “EU Data Boundary” also has numerous exceptions and exclusions which cover customer data, service generated data, diagnostic data and professional services data. Another issue was that the “EU storage guarantee” offered by Microsoft did not cover all types of data. Some data may be accessible to recipients in third countries. The “EU Data Boundary” also has numerous exceptions and exclusions which cover customer data, service generated data, diagnostic data and professional services data. Further unauthorised disclosure or personal data: A specific reference was made to Article 9, which concerns transmission of personal data by EU institutions to recipients established in the EU. According to the EDPS, this article is also applicable to transmission of personal data to processors of EUIs. Therefore all transmission of personal data should be in the public interest and if the data subject’s legitimate interests may be prejudiced, the controller has to weigh the competing interests and establish that it is proportionate to transmit the personal data. The purpose of management and functioning of the Commission, use of products the staff is familiar with etc. was not found to be the purpose of processing of the personal data by MS. As long as the purposes are not specified, specific and explicit, it is not possible to do this balancing. Further unauthorised disclosure or personal data: A specific reference was made to Article 9 Regulation (EU) 2018\u002F1725, which concerns transmission of personal data by EU institutions to recipients established in the EU. According to the EDPS, this article is also applicable to transmission of personal data to processors of EUIs. Therefore all transmission of personal data should be in the public interest and if the data subject’s legitimate interests may be prejudiced, the controller has to weigh the competing interests and establish that it is proportionate to transmit the personal data. The purpose of management and functioning of the Commission, use of products the staff is familiar with etc. was not found to be the purpose of processing of the personal data by MS. As long as the purposes are not specified, specific and explicit, it is not possible to do this balancing. In addition, the EDPS found that the Commission did not ensure that transfers take place “solely to allow tasks within the competence of the controller to be carried out”. In addition, the EDPS found that the Commission did not ensure that transfers take place “solely to allow tasks within the competence of the controller to be carried out”. Line 121: Line 121: == Comment == == Comment == Although reference to the limitation of transmission of personal data to recipients subject to the GDPR, based on Article 9 EUDPR is specific to EU institutions, there are points of general interest: Although reference to the limitation of transmission of personal data to recipients subject to the GDPR, based on Article 9 Regulation (EU) 2018\u002F1725 is specific to EU institutions, there are points of general interest: - precise definition of data transmitted to or accessed by processors and the purposes for which they are used - precise definition of data transmitted to or accessed by processors and the purposes for which they are used - processors should only use data for the purposes of the controller even when improving services or ensuring security, if this is not the case, they are controllers - processors should only use data for the purposes of the controller even when improving services or ensuring security, if this is not the case, they are controllers","The European Data Protection Supervisor (EDPS) issued a reprimand against the European Commission for non-compliant processing of personal data through Microsoft 365. The decision found that Microsoft's 'EU storage guarantee' and 'EU Data Boundary' contain numerous exceptions allowing data access from third countries, and that the Commission failed to ensure proper data transfer safeguards under GDPR articles. The EDPS suspended data flows to countries without adequacy decisions effective December 9, 2024.","EDPS reprimands EU Commission over Microsoft 365 data processing violations and suspends third-country data flows.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=EDPS_-_2021-0518&diff=52391&oldid=42245","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F5\u002F52\u002FLogoEDPS.png\u002F747px-LogoEDPS.png","2026-07-17T12:54:35+00:00","2026-07-17T14:00:18.437404+00:00",7,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft 365","product",{"name":24,"type":19},"European Data Protection Supervisor (EDPS)","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":25,"icon":27,"name":28,"slug":29},null,"GDPR","gdpr",[31,36,41,46],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":47},{"id":48,"icon":27,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18,24,21],{"controls":54,"vendors":127},[55,84,110],{"slug":56,"name":57,"problem":58,"products":59},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":85,"name":86,"problem":87,"products":88},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":106,"product_name":107,"url":108,"description":109},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":111,"name":112,"problem":113,"products":114},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[115,121],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":123,"url":125,"description":126},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[128],{"slug":129,"name":18,"logo_path":130,"roles":131},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[132],"affected",{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":149},"eu-commission-reprimanded-for-unlawful-data-transfers-via-microsoft-365","EU Commission Reprimanded for Unlawful Data Transfers via Microsoft 365","The European Commission failed to ensure that its use of Microsoft 365 complied with GDPR data transfer requirements, particularly by not verifying that contractual guarantees (such as the 'EU Data Boundary') were free of exceptions permitting third-country access. This case illustrates that vendor marketing claims about data residency and sovereignty do not substitute for rigorous legal and technical due diligence. Organizations cannot outsource accountability for data protection compliance to cloud providers — they remain the data controller and bear ultimate responsibility. The EDPS's suspension of data flows underscores that non-compliance carries real operational consequences, not just financial penalties.",[138,139,140,141,142,143,144,145,146,147,148],"GDPR Article 44 — General principle for transfers","GDPR Article 46 — Transfers subject to appropriate safeguards","GDPR Article 28 — Processor obligations","GDPR Article 30 — Records of processing activities","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 PT-7 (Specific Categories of Personally Identifiable Information)","NIST Privacy Framework GV.PO-P2 (Privacy risk management policies)","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management","ITIL Service Design — Supplier Management Process","ENISA Cloud Security Guide for SMEs — Third-country transfer risk",{}]