EDPS investigates contractual agreements concerning software used by EU institutions

 

[text_block id=”de1b7d8ec3850d7fa908c74ee45318d2″ content=”‹¨›p‹˜›Press Release by the EDPS;‹¨›/p‹˜›‹¨›p‹˜›‹¯›nbsp;‹¨›/p‹˜›‹¨›p‹˜›As the supervisory authority for all EU institutions, the European Data Protection Supervisor (EDPS) is responsible for enforcing and monitoring their ‹¨›strong‹˜›compliance with data protection rules‹¨›/strong‹˜›. In this capacity, the EDPS is undertaking an ‹¨›strong‹˜›investigation‹¨›/strong‹˜› into the compliance of ‹¨›strong‹˜›contractual arrangements‹¨›/strong‹˜› concluded between the ‹¨›strong‹˜›EU institutions and Microsoft‹¨›/strong‹˜›, the European Data Protection Supervisor said today.‹¨›/p‹˜›‹¨›p‹˜›‹¨›strong‹˜›Wojciech Wiewiórowski, Assistant EDPS, said: ‹¨›/strong‹˜›“‹¨›em‹˜›New data protection rules for the EU institutions and bodies came into force on 11 December 2018. ‹¨›strong‹˜›‹¨›a href‹´›‹²›https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri‹´›CELEX:32018R1725‹¯›amp;from‹´›EN‹²›‹˜›Regulation 2018/1725‹¨›/a‹˜›‹¨›/strong‹˜›introduced significant changes to the rules governing outsourcing. Contractors now have direct responsibilities when it comes to ensuring compliance. However, when relying on third parties to provide services, the EU institutions remain ‹¨›strong‹˜›accountable‹¨›/strong‹˜› for any data processing carried out on their behalf. They also have a duty to ensure that any contractual arrangements respect the new rules and to ‹¨›strong‹˜›identify and mitigate any risks‹¨›/strong‹˜›. It is with this in mind that the contractual relationship between the EU institutions and Microsoft is now under EDPS scrutiny.‹¨›/em‹˜›”‹¨›/p‹˜›‹¨›p‹˜›EU institutions rely on Microsoft services and products to carry out their daily activities. This includes the ‹¨›strong‹˜›processing of large amounts of personal data‹¨›/strong‹˜›. Considering the nature, scope, context and purposes of this data processing, it is vitally important that appropriate contractual safeguards and risk-mitigating measures are in place to ensure compliance with the new Regulation. The ‹¨›strong‹˜›EDPS investigation‹¨›/strong‹˜› will, therefore, assess which Microsoft products and services are currently being used by the EU institutions and whether the contractual arrangements concluded between Microsoft and the EU institutions are fully compliant with data protection rules.‹¨›/p‹˜›‹¨›p‹˜›‹¯›nbsp;‹¨›/p‹˜›‹¨›p‹˜›‹¨›a href‹´›‹²›https://edps.europa.eu/press-publications/press-news/press-releases/2019/edps-investigates-contractual-agreements_en‹²› target‹´›‹²›_blank‹²› rel‹´›‹²›noopener‹²›‹˜›Read the whole piece on the EDPS webstite‹¯›gt; ‹¨›/a‹˜›‹¨›/p‹˜›‹¨›p‹˜›#EDPS, #EU, #Microsoft, #investigation, #Contractors, #GDPR, #Security,‹¨›/p‹˜›” paragraph_whitespace=”true” text_size=”” line_height=”” text_color=”” margin=”0px 0px 15px 0px” class=”” _fw_coder=”aggressive” __fw_editor_shortcodes_id=”f4e4d7b64cfe04028bbf5f9c9579a6ec”][/text_block]