What has been reported
The public detail is thin. MLex's summary gives these facts:
- Belgium's data protection authority issued the reprimands to two controllers whose names have not been made public.
- The recently published decision follows a complaint from 2021.
- The authority dismissed a separate allegation that the organization providing the computer breached the GDPR, citing insufficient evidence.
- The decision is available in French, and its case reference is DOS-2021-00682.
I haven't reviewed the French decision. That means I can't tell you the following:
- who the controllers are
- which countries received the data
- which transfer mechanism they relied on, if any
- which data were involved
- how the authority reasoned its way to the reprimands
The 2021 complaint date also doesn't tell us when the exam took place or when the decision was made.
What it does not say
Teams is named as the conferencing tool used in the exam. The reported finding is about the controllers' failure to assess transfer risks. It is not a reported finding against Microsoft. Nothing in the summary says Microsoft was a respondent, that Teams was found unlawful, or that Teams sends data to any particular country.
The outcome is a reprimand, not a fine, and the summary mentions no monetary penalty.
The dismissed allegation also matters. The authority found the evidence insufficient to hold the computer provider responsible. That is not a finding that the provider did nothing wrong.
Why Microsoft 365 administrators should care
An exam or interview run over Teams involves more than a video call. It can involve candidate identities, recordings, devices supplied by a third party and identity or storage services. Any of these could involve recipients outside the EEA. I'm drawing that from general industry knowledge. The summary doesn't say which of these applied here.
Under GDPR Chapter V, transfers of personal data outside the EEA need a valid mechanism. The European Commission's 2021 standard contractual clauses, in Implementing Decision 2021/914, are one such mechanism. Having them in place doesn't prove a given transfer is adequately protected.
The Court of Justice's Schrems II judgment adds a duty to assess. Exporters and recipients must check whether the destination country's law lets the required protection be respected. If it doesn't, extra safeguards may be needed, or the transfer may have to be suspended. The reprimands are consistent with that logic: the reported failing is an assessment that wasn't done, not necessarily a transfer that was unlawful. I haven't seen the decision's reasoning, so that is my reading.
Transfer assessments are fact-specific. A Linklaters write-up of an earlier Belgian Council of State ruling, which concerned a different procurement dispute and not this case, shows that the outcome can turn on the safeguards actually in place. Don't treat it as precedent for this decision.
A practical review checklist
These are general good-practice questions. The Belgian authority did not order them in this case.
- Roles: Who decides the purposes and means of the recruitment processing? Who merely supplies equipment or services?
- Data inventory: What personal data does the exam workflow handle, and who receives it?
- Locations: Do any recipients, support functions or sub-processors sit outside the EEA?
- Mechanism: If data leaves the EEA, which GDPR transfer mechanism applies, and is it documented?
- Assessment: Is there a written assessment showing the mechanism works in practice, with extra safeguards where needed?
- Ownership: Who reviews that assessment when the service configuration or data flows change?
Several controllers can be involved in one workflow, and here two were reprimanded. Shared hiring arrangements, such as a university, an employer and a testing provider, should settle who owns the transfer assessment.
The takeaway
Two controllers were reprimanded for not assessing transfer risks around a Teams-based recruitment exam, and the complaint against the computer provider was dismissed for lack of evidence. The French decision should settle the details of the data flows and the legal reasoning. Until it is reviewed, treat this as a prompt to check your own documentation. It is not evidence about how Teams handles data.