On 8 March 2024, the EDPS adopted a decision following its investigation into the European Commission's use of Microsoft 365. In the decision, the EDPS focused on compliance with provisions of Regulation (EU) 2018/1725 related to purpose limitation and international transfers and unauthorised disclosures of personal data (see also press release).
The EU institutions, bodies and agencies (“the EU institutions”) have been considering the use of cloud computing services because of advantages such as costs savings and flexibility gains. They are nevertheless faced with the specific risks that the cloud computing paradigm involves and remain fully responsible regarding their data protection obligations. For cloud services, the EU institutions should ensure an equivalent level of protection of personal data as for any other type of IT infrastructure model.
Opening speech by Giovanni Buttarelli at the Workshop: Data Protection within International Ogranizations organised by the International Organization for Migration and the European Data Protection Supervisor, Geneva, Switzerland
The December 2016 edition of the EDPS Newsletter covers recently adopted Guidelines on Administrative Inquiries and Disciplinary Proceedings, the EDPS Opinion on Personal Information Management Systems (PIMS) and many other EDPS activities.
Speech by Giovanni Buttarelli at ISC Intelligence on Science Seminar, Brussels, Belgium (via a video)