Microsoft Ireland Operations Limited

Summary 1. The Complainant’s 1 TB OneDrive account (a cloud-based file hosting service), was suspended by Microsoft on 3 February 2020, due to a serious breach of Microsoft’s Services Agreement (“MSA”) arising from the discovery of child sexual exploitation and abuse imagery (“CSEAI”) by scanning software (PhotoDNA). 2 2. On 17 August 2020, the Complainant made an access request to Microsoft seeking access to the files contained in the suspended account. On 18 August 2020, a member of Microsoft’s Norwegian OneDrive team responded to the access request, noting the account had been locked due to a violation of the Microsoft Services Agreement. On 6 September 2020, Microsoft declined to provide the files or the reason the account was suspended, stating “Microsoft deactivated the access to our account due to a serious violation against Microsofts’ [sic] service agreement https://www.microsoft.com/servicesagreement#3_codeOfConduct. As mentioned in the Agreement, you will no longer have access to services which require a Microsoft account.” Further, on 11 September 2020, Microsoft informed the Complainant of the result of his appeal. Microsoft stated “We have evaluated your appeal and verified that your account was locked due to serious violations against Microsofts’ service agreement. https://www.microsoft.com/servicesagreement#3_codeOfConduct. According to our terms, we cannot reactivate your account nor provide information as to why it was locked. This represents Microsofts’ final communication in connection with this account.” 3. On 17 November 2020, the Complainant complained to the Norwegian Data Protection Authority, Datatilsynet (“NO SA”). 4. On 28 February 2021, the Complainant’s data was permanently deleted by Microsoft in line with Microsoft’s standard data retention policy.

Resources Guidance Decisions Law Blogs Podcasts Publications Case Studies Inquiry into Microsoft Ireland Operations Limited Area: Cross Border Private Company Topic: DS Rights Articles: 12 , 17 Decision Date: 15 November 2023 On 15 November 2023, following an inquiry concerning a complaint received against Microsoft Ireland Operations Limited (Microsoft), the Data Protection Commission (DPC) adopted a decision. The DPC commenced this inquiry on 29 June 2023, on foot of a complaint that Microsoft failed to comply with two erasure requests submitted by the complainant in March and October 2021. The scope of the inquiry concerned an examination and assessment of the following: Whether Microsoft’s handling of the complainant’s erasure requests was compliant with Articles 12 and 17 of the GDPR. As the processing under examination constituted 'cross border' processing, the DPC’s decision was subject to the cooperation and consistency mechanism outlined in Article 60 of the GDPR and pursuant to Article 60(3) of the GDPR, the DPC submitted its draft decision to the supervisory authorities concerned for their opinion. As the DPC received no relevant and reasoned objections to the draft decision from the supervisory authorities concerned within the statutory period, the supervisory authorities concerned were deemed to be in agreement with the draft decision of the DPC and are bound by it in accordance with Article 60(6) of the GDPR. The DPC adopted its decision in respect of this complaint in accordance with Article 60(7) of the GDPR.