7 Conclusion

Recommendation Set 7: be transparent towards data subjects about how their personal data is processed

• Gain a sufficient level of assurance as to the subject matter and duration of processing, the nature, scope and purposes of the processing, the categories of personal data and data subjects concerned and the risks to data subjects to enable EU institutions to meet their transparency obligations. • Prepare a data protection notice as part of the information to be made available to data subjects in accordance with Articles 15 and 16 of Regulation (EU) 2018/1725.

140 The EDPS advises organisations not to consider engaging any processor (or sub-processor) that is not willing to provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of EU data protection rules and ensure the protection of the rights of data subjects. To comply with the principle of data protection by design and by default, organisations should verify both when processing is planned and during the processing, if no other alternative software solutions allow for higher privacy safeguards. 141 The EDPS recognises that the course of action recommended to EU institutions may appear a tall order for many, if not most, of Microsoft’s volume licensing customers. 142 There were certainly concerns among controllers in the EU institutions that a hyperscale service provider would find acceptance of contractual changes such as those the EDPS was advocating either contrary to commercial sense, or impractical, or both. The EDPS has seen that Microsoft has shown itself, to a certain extent, ready to entertain some solutions to meet the compliance needs of EU institutions.

143 Where a contractor is committed to data protection, it does appear possible to bolster the protection of data subjects in a way that is commercially acceptable and can accommodate numerous customers at once.

144 The EDPS would therefore encourage controllers not to be disheartened at the prospect of negotiating instructions with a processor that they consider necessary to protect the rights and freedoms of data subjects; even when faced with a business partner of considerable heft.

29