A three-year probe has revealed that the European Commission’s use of Microsoft software breached strict EU privacy rules, and limits on how personal data is transferred out of the EU. Reuters reports that the European Data Protection Supervisor (EDPS) found that “in its contract with Microsoft, the Commission did not sufficiently specify what types of personal data are to be collected and for which explicit and specified purposes when using Microsoft 365.”