Microsoft is finding itself in an increasingly precarious situation in the European Union (EU), where a working group of German data protection regulators has come to the conclusion that the American company has not been able to resolve any of the compliance issues it raised relating to the cloud-based Microsoft 365 productivity suite.

In September, the local Data Protection Authority (DPA) for the Hesse state in central Germany banned the use of Microsoft 365 in its schools due to worries about privacy infringement. The DPA said it collects data from users’ software, in a clear violation of the EU’s General Data Protection Regulation (GDPR) rules.

Last week, the French Ministry of National Education also urged educational institutions in the country to stop using free versions of Microsoft Office 365 and Google Workspace for schools and students. The Ministry said such offers are not compatible with the GDPR, the Schrems II judgment of the European Court of Justice, and the Dinum circular on the ‘cloud at the centre’.

The GDPR is one of the world’s toughest data privacy and security regulations.

The legislation affects software companies globally, despite the fact that it was designed primarily for the EU and its citizens. In other words, if your organisation collects any data on EU citizens, you are required to comply with the GDPR.

Last week, the Datenschutzkonferenz (DSK) – a steering body for Germany’s decentralised application of data protection law – published a report [pdf] on Microsoft 365’s compliance with specific sections of the EU-wide GDPR.

The report raises concerns regarding Microsoft’s contracts and processing for 365, and the legal justification to process data of EU citizens, especially for what Microsoft calls its “legitimate business objectives.”

Despite a number of modifications Microsoft made to its 365 contracts in a data protection addendum from September 2022, the DSK claims that users of Microsoft’s cloud-based software are unable to demonstrate compliance. Or, to put it another way, the group’s conclusion is that using Microsoft 365 in compliance with the GDPR is currently not possible.

In terms of objectives of processing, the DSK said it was unable to discern any meaningful improvements in contract language, stressing that detailed descriptions and explanations are still absent. Another issue for the authorities is Microsoft’s extensive gathering of telemetry and diagnostic data. According to DSK, Microsoft processes the data “fundamentally for self-interested purposes”. Moreover, Microsoft’s data retention and deletion rules also don’t always adhere to the GDPR’s specifications, the report says.

Microsoft provided the following statement to TechCrunch with respect to the complaints made by the DSK.

“Microsoft 365 products meet the highest industry standards for the protection of privacy and data security,” it said. “We respectfully disagree with the concerns raised by the Datenschutzkonferenz and have already implemented many suggested changes to our data protection terms. We remain committed to working with the DSK to address any remaining concerns.”

The company argues that the working group has misunderstood how its services operate and that DSK’s objections “do not accurately reflect” changes Microsoft has previously made.

However, the Microsoft does seem to recognise the need to increase transparency.

“We take to heart the DSK’s push for greater transparency, and while our documentation and transparency practices exceed those of most others in our space, we commit to doing even better.”

Although the GDPR deadline has now passed, it’s important for organisations to show that in the event of a regulatory investigation, they have taken reasonable steps to demonstrate they take privacy seriously – and ultimately comply. The good news is that fines for organisations that suffer a breach of personal data won’t be applied if they can prove they’ve taken the correct steps to comply.

The reality is that GDPR will be a continuous journey for organisations involving constantly reviewing data, removing low value data, looking at new data, following procedures, and maintaining trust with customers – by prioritising their privacy. Although many organisations are becoming better prepared for GDPR, here are some key, practical actions that must be taken now.

This week, organizations far and wide are stressing quite a bit about the General Data Protection Regulation, which we’ve written about many times over here at Associations Now, including an overview of how associations have been preparing for the May 25 compliance deadline and a report last week on how the regulation may improve trust between organizations and their constituents.

GDPR, the European Union’s big play to protect the private information of EU residents, is a messy reminder of the dance that compliance and technology play with one another at the corporate level.

But it’s not the only reminder out there. In fact, IT departments can face numerous other kinds of compliance headaches related to their asset management structure, including from the companies that supply them or their vendors with software—whether directly or indirectly.

In recent years, large companies such as Oracle and SAP have increasingly turned their businesses toward licensing audits, with the goal of squeezing a little more revenue out of clients that can afford to pay.

These audits have been both costly and controversial. According to a 2016 InfoWorld article, the candy maker Mars, Inc., faced an in-depth software audit at the hands of Oracle. The saga led to 233,089 pages of documentation and a court battle between the two companies. Mars eventually agreed to an out-of-court settlement.

For other big tech companies, the audit approach has created public relations problems. Last year, Microsoft compliance guru Patama Chantaruck had to write a blog post defending the firm’s software asset management program as not being the same thing as an audit.

SAP, meanwhile, launched a Licensing Transparency Center last fall, in the wake of negative headlines around its software audit battle with the alcohol giant Diageo. A British court found that SAP’s indirect licensing rules were legal—meaning that, at least in the UK, it can legally charge money for indirect uses of its software.

(Diageo is only one of SAP’s recent targets. Anheuser-Busch InBev recently settled a $600 million lawsuit filed by SAP.)

We could argue all week about whether software auditing rules are fair or represent bad PR. But they’re out there, and for organizations that use complex business software, it can be a real shock to the system to get notified of an upcoming audit.

But for the software industry, there’s a case to be made that companies leave significant amounts of money on the table if they fail to act against improper use of their products. A 2016 study from BSA: The Software Alliance found that nearly 40 percent of software installed on machines globally wasn’t properly licensed. Part of the problem was a lack of control over so-called “shadow IT.”

Most associations don’t have operations on the scale of the companies that make M&Ms and Bud Light, but many nonetheless rely on enterprise software that often gets quite complex down the line. A few considerations for IT departments looking to get a better grasp on licensing questions:

The cloud’s complications. Recently, Amazon Web Services CEO Andy Jassy showed up on CNBC and effectively admitted that AWS is building database solutions designed to let companies get past complex licensing structures. “I think over the last few decades it’s been a rough place for enterprises because they’ve had to contend with the old-guard database providers like Oracle that are expensive, very high lock-in, and also they constantly audit their customers and fine them if they find something,” Jassy said. His point highlights an Achilles heel of cloud computing in the enterprise space: Infrastructure changes, such as those from servers to cloud, can introduce new licensing headaches due to the way contracts are written. When building out your infrastructure, be aware of how existing contracts can complicate these moves.

The open-source factor. A couple of pieces of software commonly used by associations that are unlikely to ever be subject to a software audit are WordPress and Drupal. The reason is that the content-management platforms are open-source, and as a result, they both are free to use and made of software that’s free of any licensing surprises. Not every piece of software out there can promise that. However, be mindful of those open-source licenses as well: If you create a commercial product that integrates open-source software, the rules can change. You may have to pay for that right or release any changes you’ve made to the code under the same license. Do your research.

The vendor equation. With big companies like SAP going after indirect licensing as well as more traditional kinds of access, you can run into a hornet’s nest around the many hands that touch your technology, including through your vendors. It’s good idea to have a general awareness of what’s in your vendors’ software stack, particularly whether they rely on proprietary rather than open-source software. It could help prevent some headaches down the road.

Some commentators are optimistic that we’ll see changes in this model, which feels consumer-hostile. Computerworld contributor Daryl Ullman, for example, recently wondered whether downloading SaaS applications directly from the vendor could help make licenses easier to track.

But consider this a reminder that the software licensing issue is out there and you have to think about it. Better now than when you’re getting audited.

Perhaps your company hasn’t really done anything to get ready for the General Data Protection Regulation (GDPR), which goes into effect about two months from now.

In that case, it may be time for GDPR triage.

Tim Jesser, director of product marketing for Stockholm-based software asset management firm Snow Software, has a few suggestions. His background includes data security and software management.

First, he told me, “ignore the alarmists.”

“The enforcement won’t be that bad [at first],” he said, “because [the maximum fine] equal to 4 percent of annual global revenue or 20 million euros is for repeat offenders.” Of course, there won’t be many repeat offenders at the beginning.

Next, get a realistic sense of your exposure.

At one end of the spectrum, the most liable companies are those with presences in the European Union (EU) that process personal data from EU citizens.

At the other end are companies elsewhere, with no EU presence, who may inadvertently process personal data of EU citizens without knowing it.

The countdown toward GDPR is on. Friday 25th May marks the enforcement of the EU’s General Data Protection Regulation, and it’s not just IT and Technology sectors that are looking at a complete shift in culture – this will impact every industry, cloud-based or otherwise, that collects, retains, or processes personal data on EU individuals, regardless of physical business location.

In what is being dubbed as the biggest shake-up to the privacy and security landscape, data management will never be the same, with stringent rules on handling personal data, and the subsequent streamlining of its flow inside the European Union

With the threat of fines of up to 4% of a company’s annual revenue, or €20m (whichever is greater) for non-compliance, the mere mention of GDPR has had some companies quaking in their boots. Indeed, the demand for “accountability” and “transparency” has meant that the often neglected responsibilities that many would assume come as standard in data management are under internal scrutiny. That is, companies are scrambling to reach compliance in time.