Microsoft Faces EU Complaint Over Alleged Israeli Surveillance of Palestinian Data
Microsoft is under scrutiny in the European Union following a complaint alleging the company illegally stored data on Palestinians used for Israeli military surveillance.
The Irish Data Protection Commission (DPC) confirmed on Thursday that it had received the complaint and is currently assessing it. As Microsoft’s European headquarters are in Ireland, the DPC serves as the EU’s lead data regulator for the company.
The complaint was filed by Eko, a non-profit organization advocating for “people and planet over profits.” Eko claims that Microsoft violated European data protection laws by enabling the processing of personal data belonging to Palestinians and EU citizens, which allegedly facilitated surveillance, targeting, and military operations by the Israeli Defense Forces (IDF).
The allegations follow a report in The Guardian, which revealed that the IDF used Microsoft’s cloud service Azure to store files containing phone call data obtained through broad or mass surveillance of civilians in Gaza and the West Bank.
In response to the report, Microsoft restricted the Israeli military’s access to certain cloud services in September. However, Eko asserts that whistleblower accounts indicate Microsoft subsequently transferred large volumes of surveillance data, raising questions about compliance with EU law.
A Microsoft spokesperson stated: “Our customers own their data, and the actions taken by this customer to transfer their data in August were their choice. These actions in no way impeded our investigation.”
According to The Guardian, the data in question was stored on Microsoft servers in Ireland and the Netherlands, bringing it under the European Union’s General Data Protection Regulation (GDPR). Introduced in 2018, GDPR is designed to protect EU residents from unauthorized data processing and breaches.
The case underscores ongoing concerns over the use of cloud services in sensitive geopolitical contexts and the responsibilities of tech companies under international data protection laws.
