@noybeu Sure, Microsoft should be held accountable, because in practice that's the de facto data controller. But it doesn't mean schools shouldn't be held accountable as well. After all, who signed contracts with Microsoft without ensuring sufficient data protection?

If the data controllers (schools) were held accountable, they would have to break the contracts with Microsoft, and Microsoft would need to adapt their strategy. There is really no excuse for the data controllers for letting Microsoft abuse children's privacy in the first place.