EU files complaint against Microsoft for sharing Israeli surveillance data

Microsoft is currently facing a formal complaint within the European Union, filed by a non-profit group, alleging the company improperly stored data on Palestinians used for surveillance by the Israeli military. The Irish Data Protection Commission (DPC) confirmed on Thursday that it had received the complaint and is in the process of reviewing it.

Since Microsoft's European operations are based in Ireland, the DPC, as the lead data regulator for the company in the EU, is responsible for investigating the issue.

The complaint was lodged by Eko, an organization focused on promoting the welfare of people and the planet over profits. Eko accuses Microsoft of violating European data protection laws, stating that the company unlawfully processed personal data of Palestinians and EU citizens. This, according to the group, facilitated surveillance, targeting, and military occupation by Israel.

The complaint follows a report by The Guardian, which revealed that the Israeli Defense Forces utilized Microsoft's cloud platform, Azure, to store phone call data acquired through mass surveillance of civilians in Gaza and the West Bank. In response to the findings, Microsoft revoked certain access privileges to the Israeli military's use of its cloud services in September.

According to Eko, "new evidence from Microsoft whistleblowers" suggests that the company quickly transferred large volumes of the illegally obtained surveillance data following the Guardians report.

In response, a Microsoft spokesperson stated, "Our customers retain ownership of their data. The decision to transfer the data in August was made solely by the customer, and it did not interfere with our investigation." The spokesperson further emphasized that the company's actions did not hinder any ongoing inquiries into the matter.

The data in question was stored on Microsofts servers in Ireland and the Netherlands, which means it falls under the jurisdiction of the EUs General Data Protection Regulation (GDPR), a law enacted in 2018 to safeguard the personal data of European citizens.

Author: Connor Blake