Dirección General de Innovación y Formación del Profesorado – Complaint Upheld (Spain, 2025)

In November 2020, the Regional Ministry of Education and Sports of Andalusia, acting as controller, entered into a collaboration agreement with Microsoft Ireland Operations Limited, acting as processor, for the provision of cloud-based educational services to public schools wishing to use them. The services covered by the agreement included Microsoft Office Online applications, such as Outlook, Word, Excel, PowerPoint and OneNote, as well as Exchange, Forms, OneDrive, SharePoint, Teams and Sway. These services provided communication, collaboration, productivity and cloud storage functionalities for the education sector. Under the agreement, Microsoft Ireland Operations Limited had access to personal data under the responsibility of the controller in order to provide the relevant cloud-based educational services. In March 2023, the DPA received a complaint alleging several infringements of the GDPR and the Spanish data protection framework. The complaint concerned, in particular: - Article 25 GDPR, on data protection by design and by default, due to the alleged failure to adopt appropriate technical and organisational measures to reduce the risk that users would upload special categories of personal data, inappropriate images or audiovisual material to the system. - Article 13 GDPR, concerning the information to be provided to data subjects when their personal data is collected. - Articles 44–49 GDPR, concerning international transfers of personal data to third countries or international organisations without the required safeguards, conditions or derogations. - Article 30 GDPR, due to the alleged lack of adequate information in the controller’s record of processing activities regarding international data transfers. - Article 35 GDPR, concerning the alleged absence of a data protection impact assessment in relation to the use of the cloud-based educational services. The DPA upheld the complaint and found that the controller infringed the GDPR because it had not implemented appropriate data protection by design and by default measures to mitigate the risk that users could upload special categories of personal data, images or audiovisual material to the cloud services. It also failed to provide adequate Article 13 GDPR information to pupils, families and teachers about the processing, carried out international data transfers without demonstrating that the safeguards, conditions or derogations under Articles 44–49 GDPR were met, failed to record those transfers properly in its Article 30 GDPR record of processing activities, and had not carried out a DPIA before starting the processing, despite the risks involved. The DPA ordered the controller to adopt corrective measures, including the following: - Submit an action plan identifying the measures to be implemented to remedy the non-compliance, together with an implementation timeline and justification for that timeline. - Provide evidence that appropriate technical and organisational measures had been adopted to mitigate the high risk that users may enter special categories of personal data into the cloud-based educational services. - Provide documentation demonstrating the means or measures used to inform data subjects about the processing of their personal data, in compliance with Articles 13 and 14 GDPR. - Suspend data flows to the processors and sub-processors’ facilities located in third countries that are not subject to an adequacy decision, except where the relevant safeguards, conditions or derogations under Articles 44–49 GDPR are met. - Submit copies of the instructions and protocols provided to members of the educational community regarding which photographs and audiovisual content may appropriately be uploaded to the cloud-based educational services, and which content should not be included. - Indicate the control and monitoring mechanisms implemented in relation to the uploading of photographs and audiovisual content. - Provide documentary evidence that the record of processing activities had been amended to include appropriate information on international data transfers, in accordance with Article 30 GDPR. - Provide documentary evidence of a data protection impact assessment carried out in accordance with Article 35 GDPR.