EU controllers’ accountability includes the creation design of compliant processing systems, e.g. by observing data protection by design and by default. In practice, public authorities in the EU are using the systems and applications provided by large companies, often with built-in tracking and data collection features, based on the companies’ standards, and frequently unilateral terms and conditions. Some argue that the available technology limits their capability to achieve data protection compliance and that terms and conditions cannot be adapted to specific processing operations.

In line with its 2020-2024 strategy, the EDPS concluded an investigation on widely used office automation tools by the EU institutions. Findings and recommendations on the use of Microsoft products and services by EU institutions are likely to be of interest to all public authorities in EU/EEA Member States. This concrete case helps to assess the EDPS’ strategic objective, like that of other DPAs, to ensure that public administrations in their contractual relationships with ICT service providers use terms that reinforce the public administrations’ control over how and for which what purpose personal data is processed.

• How can DPAs use their enforcement powers through supervision of public authorities to influence the data protection compliance of ICT service providers, including cloud service and communications providers?
• What is the role of ICT providers with regard to public administrations and how do their practices affect consumers and clients of public authorities?
• How should public authorities shape their contractual and business relationships with service providers and systems developers in order to improve data protection compliance?
• What should be a controller-processor contract in terms of form and content and how it could guarantee that controllers keep control and ensure fair and lawful processing of personal data of citizens?