Microsoft refuses to disclose data flows to Police Scotland

Internal documents released following a freedom of information request reveal that Microsoft is refusing to advise Scottish policing bodies where and how sensitive law enforcement data will be processed within its cloud services, citing commercial confidentiality. The refusal is impeding Police Scotland and the Scottish Police Authority (SPA) from complying with strict data protection rules that govern the transfer of policing data outside the UK.

According to a detailed data protection impact assessment (DPIA), Microsoft has told the SPA that it cannot guarantee the data sovereignty of information stored in its Office 365 (O365) infrastructure. The DPIA states that Microsoft itself has acknowledged that O365 is not designed for processing the sensitive data that the SPA plans to ingest.

The DPIA also confirms that Microsoft declined to provide transfer risk assessments for countries where there is no data adequacy agreement, meaning data about witnesses and victims of crime could potentially be processed in "hostile" nations, including China, Serbia, India, and others. The document notes that if any other company had declined to provide this information, the SPA would likely not proceed with a tender.