- Enforcing jurisdiction
- Ireland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Microsoft Ireland Operations Limited – Complaint Upheld (Ireland, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Irish Data Protection Commission upheld a complaint against Microsoft after the company suspended a user's OneDrive account without providing clear reasons. This ruling underscores the importance of transparency in handling user accounts.
What happened
Microsoft suspended a user's OneDrive account without adequately informing them of the reasons.
Who was affected
A user whose OneDrive account was suspended and locked without proper explanation.
What the authority found
The DPC found that Microsoft did not properly communicate the reasons for the account suspension to the user.
Why this matters
This decision highlights the need for companies to be clear and transparent when managing user accounts. Businesses should ensure they have processes in place to communicate effectively with users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Microsoft Ireland Operations Limited (the controller) suspended a user’s (the data subject) OneDrive account in February 2020 for a serious breach of the controller’s Services Agreement after scanning software allegedly discovered child abuse imagery (CSEAI) across the data subject’s account. The data subject subsequently made an access request for the files in the suspended account but the controller informed them that the account was locked and declined to provide the files or the reason for the suspension of the account, mentioning only that there was a serious violation of its Service Agreement. The data subject filed a complaint with the Norwegian DPA (Datatilsynet), which was passed to the Irish DPA (DPC) as the competent lead supervisory authority. The controller permanently deleted the data subject’s account in line with its standard data retention policy in February 2021. In its response to the DPA, the controller claimed that the discovery of CSEAI by an image-matching technology was subject to human review. Furthermore, it claimed that it relied on Article 15(4) GDPR for declining to provide the requested data to the data subject. Moreover, the controller responded to DPA inquiries specifying that it did not have knowledge as to whether a police investigation had taken place. Following these exchanges, the controller informed the data subject of the reason for his account’s suspension. The controller further informed the DPA that the data subject’s access requests were interpreted by the controller’s customer service team as requests to reactivate the account and were not forwarded to the privacy response team. The data subject protested that the controller, among other things, removed private files from other family members’ computers, suspended access to files which did not contain offending material, locked his account without providing reasons and made the data subject responsible for files that others uploaded in his shared folders. The DPA f
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (1)
Other enforcement actions involving Microsoft Ireland Operations Limited in IE
Details
Decision Date
1 September 2025
Authority
Data Protection Commission
About this data
Cite as: Cookie Fines. Microsoft Ireland Operations Limited - Ireland (2025). Retrieved from cookiefines.eu
Last updated: