European Commission – Violation Found (European Union, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The EDPS found that the European Commission's data processing practices with Microsoft were not compliant with data protection rules. They identified issues with how personal data was used and shared. This finding stresses the need for transparency and strict adherence to data protection standards.
What happened
The EDPS found that the European Commission's data processing with Microsoft violated data protection rules.
Who was affected
Users whose personal data was processed by the European Commission and Microsoft.
What the authority found
The EDPS concluded that the Commission's data processing practices did not meet the requirements of data protection laws.
Why this matters
This case serves as a reminder for public institutions to ensure their data processing activities are transparent and compliant with regulations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Following an investigation in 2019-2020, the EDPS issued recommendations and the Commission modified the ILA. The EDPS investigated whether these modifications were sufficient to bring processing in compliance with data protection requirements and found infringements. Data accessed by Microsoft include identity and contact data of users (when signing on to the service and when checking the licenses), data generated by the users while using the software and data generated by Microsoft based on the usage of the software. The EDPS found that the processing presents significant risks as it monitors the behaviour of users, combines datasets and uses artificial intelligence. Reference date is the 12th May 2021, the date when the investigation was launched. Some measures were taken meanwhile by the Commission, which were taken into account in the recommendations issued. The EDPS found infringements with regards to purpose limitation, transfers to a third country and further, unathorised disclosure of personal data. Purpose limitation: The EDPS found that it was not sufficiently defined in the International License Agreement (ILA) which types of personal data are to be processed for which purposes. Instead, there was only a list of purposes stating that Microsoft uses these data for: * troubleshooting * billing * remunerating Microsoft staff, internal reporting and business modelling, * financial reporting following the use of the system for own reasons (analytics) * to improve the service * security risk management * protection of intellectual property These stated purposes were considered to be too vague and general pursuant to the Art 29 WP. The Commission and Microsoft could not demonstrate that all these data were necessary and that a less intrusive collection of data would be insufficient to achieve the purposes cited. In addition, some of these purposes were actually not in the interest of the Commission but for purposes of individual to Microsoft (like remuner
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (4)
Other enforcement actions involving European Commission in EU
Violation Found
Details
About this data
Cite as: Cookie Fines. European Commission - European Union (2024). Retrieved from cookiefines.eu
Last updated: