Microsoft Corporation – Complaint Upheld (Austria, 2026)

The Federal Ministry of Education, Science and Research provides Austrian federal schools with access to Microsoft 365 Education for IT-supported teaching. The Microsoft Corporation (the controller) is a leading global technology company that develops and provides Microsoft 365 Education for the education sector. The Microsoft Corporation operates worldwide and is headquartered in the United States. Microsoft Ireland Operations Limited is a subsidiary of the controller, however, fundamental decisions that significantly influence the direction, design, and operation of Microsoft products are taken at the controller's headquarters. The data subject was a pupil attending an Austrian school that used Microsoft 365 Education for teaching purposes. She was provided with a school Microsoft account and, while logged into this account and creating a document using the browser-based version of Microsoft Word, several cookies were installed on her device. These cookies were set without her consent, and the controller made no attempt to obtain such consent. Schools had little or no possibility to influence or configure the cookie settings. The data subject’s representatives lodged a complaint with the Austrian Data Protection Authority (DSB), alleging violations of Article 6 GDPR in connection with the installation of tracking cookies without a legal basis, as well as violations of Article 5(1)(a) GDPR and Article 28(3) GDPR. The Austrian Data Protection Authority (DSB) held that the Microsoft Corporation qualifies as a controller within the meaning of Article 4(7) GDPR, as it determines the purposes and means of processing in connection with Microsoft 365 Education. In assessing controllership, the DSB examined the relationship between Microsoft Corporation and Microsoft Ireland Operations in light of the CJEU’s broad interpretation of the concept of controller. Referring to settled CJEU case law, the DSB emphasized that data protection liability may arise where an entity issues binding guidelines, technical specifications, protocols, or contractual frameworks governing data processing, even if the actual processing is carried out by another entity. Likewise, active involvement in the development of a digital product and the specification of key parameters suffices to establish controllership, even where technical implementation is delegated to another body. Microsoft Corporation’s influence extends beyond mere strategic oversight. It developed Microsoft 365 Education, continues to lead its technical development, sets binding corporate guidelines, and determines the technical and organizational parameters of data processing, including the use of cookies for its own business and analytical purposes. So, the DSB concluded that Microsoft Corporation must be regarded as a controller under Article 4(7) GDPR. The DSB further found that the cookies set during the use of Microsoft 365 Education constitute personal data within the meaning of Article 4(1) GDPR, as they enable the individualization of users and may be combined with additional information. These cookies were not technically necessary, as they served analytics, tracking, and operational purposes rather than the provision of the expressly requested service. As no valid consent was obtained and no other legal basis under Article 6(1) GDPR applied, the processing was unlawful and violated the principles of lawfulness and fairness under Article 5(1)(a) GDPR. In particular, reliance on legitimate interests under Article 6(1)(f) GDPR was excluded due to the prior breach of [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng e-privacy] consent requirements. Consequently, the DSB ordered the controller to cease the use of technically unnecessary cookies without valid consent within four weeks.