Security News > 2021 > May > Privacy activist Max Schrems on Microsoft's EU data move: It won't keep the NSA away

Microsoft has announced plans to ensure data processing of EU cloud services within the borders of the political bloc in a move that expert observers claim reveals problems with the firm's existing setup.

In a blog, Brad Smith, Microsoft's president and chief legal officer, said the software and cloud services giant would, by the end 2022, enable EU customers of Azure, Microsoft 365, and Dynamics 365 to have all their data processed physically within the EU. To my understanding, there would still be direct access to data and keys from the US in this new Microsoft setup.

"Although critics have questioned what the announcement means about Redmond's current processing setup, Smith said Microsoft cloud services already comply with or exceed EU guidelines."We provide commercial and public sector customers with the choice to have data stored in the EU, and many Azure cloud services can already be configured to process data in the EU as well.

Max Schrems, the Austrian lawyer and activist behind the Schrems II ruling that saw the EU Court of Justice strike down Privacy Shield arrangements, said Microsoft's move would fail to allay concerns that US security services would retain access to data held in the EU by a US company, via Section 702 of the Foreign Intelligence Surveillance Amendments Act of 2008 [PDF].

"Our customers can continue to transfer data between the EU and US consistent with the decision, and we've gone beyond EDPB guidelines by publicly committing to challenge every government request for public sector or enterprise customers data from any government where we have a legal basis for doing so. Our customers are separately telling us that data residency is important to them, and we hope this additional step will help."

Microsoft has multiple data centres in Britain that it says "Give customers in the UK, in many instances, options for keeping their data in the UK". The Register asked Microsoft if it can ensure all support is provided from within the EU, as accessing such information outside of the region, even for tech support, is still a transfer.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/05/07/schrems_slams_microsoft_eu_data/