Regulatory findings and public-sector assessments involving LinkedIn advertising, Microsoft 365 telemetry and cloud security.
Reporting on a complaint involving a school account says the authority found that tracking cookies were placed without valid consent and that access rights were not handled correctly.
View caseThe regulator examined LinkedIn’s legal bases for processing members’ data for behavioural analysis and targeted advertising. It found failures involving lawfulness, fairness and transparency.
View caseThe board reviewed the 2023 compromise of Microsoft Exchange Online and described operational and strategic security decisions that allowed the intrusion to succeed and remain undetected.
View caseConsumer Reports compared workplace communication policies and identified broad collection and use terms that employees may be unable to negotiate.
View caseA government-commissioned data protection impact assessment documented risks in diagnostic data sent by enterprise versions of Office and proposed measures for public-sector use.
View case