Microsoft 'illegally' tracked students via 365 Education

Austria's data protection authority ruled that Microsoft illegally tracked students through its 365 Education platform and violated GDPR by failing to provide complete information about data processing. Microsoft attempted to shift GDPR compliance responsibility to schools and education authorities, who lacked control over student data. When a complainant requested access to their data, Microsoft redirected them to their school, which couldn't provide complete information. The authority ordered Microsoft to disclose full details about data transmission, explain vague terms like 'business modelling,' and reveal any third-party data transfers. Microsoft must also stop deflecting data protection obligations to educational institutions.