Key issues raised by the DSK working group include that Microsoft's data processing agreement does not make sufficiently clear how Microsoft uses personal data it allegedly processes on behalf of the client for its own business purposes.

This must be escalated to the EU level.

The document states that it's not clear how Microsoft uses personal data on its clients' users for its own 'business purposes' while Microsoft grants itself extensive rights to do so.

It also states that Microsoft generally processes telemetry data for its own purposes at scale.

Microsoft now markets itself as a trustworthy and responsible tech giant, but it's not.

While keeping a friendly face, it works hard to undermine regulation and normalize corporate data misuse, including at work, not to mention its surveillance marketing and defense businesses.

Well this blew up.

To be clear, the DSK's statement is an assessment, not an enforcement decision. But what's stopping German regulators from enforcement?

Problem is that MS365 is unavoidable in many areas. I think this requires a coordinated political effort at the EU level.