Microsoft Class Action Lawsuit Says Business Customers’ Data Shared

A new class action lawsuit alleges Microsoft illegally shared and used its Microsoft Office 365 and Microsoft Exchange business customers’ data in violation of state and federal law.

Plaintiff Frank Russo of Napa, Calif., and others claim the company, which marketed its Microsoft Office 365 and Microsoft Exchange products as secure and private, shares business customers’ contacts and data with Facebook and other third parties without consent.

Russo’s complaint also says Microsoft business customers’ emails, documents, calendars and other data are shared with “unauthorized third parties for unauthorized purposes,” and that the company uses the customer data to develop products.

The plaintiffs allege that these actions violate the Wiretap Act, Stored Communications Act and Washington consumer protection and privacy laws.

In the complaint, Russo says he has paid about $12.50 each month for his subscription to Microsoft 365 Business Standard, formerly known as Office 365 Business Premium, since August 2015, and regularly uses the product to conduct business.

Russo says he decided to subscribe to Office 365 because he believed Microsoft would keep his data private and secure.

However, according to Russo, Microsoft misrepresented and hid material facts regarding the use of his data. Had the company not made these misrepresentations, Russo says, he either would not have subscribed or would have paid less.

Microsoft Office 365 was developed as a cloud-based version of the company’s other successful products, including Word, Outlook and Excel, the class action lawsuit says.

Microsoft knew its customers were concerned about the security, and therefore focused its marketing on customers’ ability to trust the company with their information, the complaint alleges.

The class action lawsuit says Microsoft’s agreements and marketing materials consistently demonstrated that the company would use customer data only to provide the specific services purchased. 

The company also tells its business customers it “shall not subcontract any of its processing operations performed on behalf of” the customer without prior written consent, according to the complaint.

The plaintiffs claim Microsoft “routinely and automatically” shares business customers’ contacts with Facebook without consent.

The complaint says even if a customer disables Facebook- sharing after activating their Microsoft Office 365 or Microsoft Exchange Online services, the customer’s contacts have already been shared with Facebook.

The class action lawsuit says Microsoft explains “in an obscure technical instruction” that once the contacts are transferred to Facebook, they can only be deleted by Facebook.

As a result, because the contact data is shared with Facebook, the information is accessible by anyone Facebook shares it with “and whomever those entities decide to share the data with, ad infinitum,” the complaint states.

Russo and others say Microsoft also shares business customer data with third-party developers, without consent, to aid in the development of new products, thereby making additional profit.

“In advertising its developer platform to third-party developers, Microsoft touts the enormous value of its customers’ data, highlighting how developers will get data not just about the authorized user, but also about other users who communicate with the authorized user,” the complaint states. But the company allegedly does not require the third-party developers it works with to take the same security measures Microsoft has promised its business customers.

The class action lawsuit maintains Microsoft knows business customers wouldn’t share data with a service provider whose security doesn’t meet System and Organization Controls standards, which have been adopted by the American Institute of Certified Public Accountants in order to safeguard private information stored and processed in the cloud.

The plaintiffs demand a jury trial and seek to certify a Class including everyone in the U.S. who subscribed to or purchased any of the following, but not Microsoft Cognitive Services, from July 17, 2016, to present:

• Microsoft Office 365 Business
• Microsoft Office 365 Business Essentials 
• Microsoft Office 365 Business Premium 
• Exchange Online Plan 1 or Plan 2
• Microsoft Office 365 Enterprise
• Office 365 Enterprise
• Microsoft 365 Enterprise
• Microsoft 365 Business 
• Office 365 Business
• Office 365 Pro Plus
• Office 365 Business Essentials
• Office 365 Business Premium
• Microsoft 365 Business Basic
• Microsoft 365 Business Standard
• Microsoft 365 Business Premium

The class action lawsuit says Class Members are entitled to restitution of unjustly earned profits, recovery of payments for Microsoft services, punitive damages, interest and other damages related to Microsoft’s alleged invasion of privacy.

Are you a Microsoft Office 365 or Microsoft Exchange business customer? Have you experienced any breach of privacy with your data? Let us know in the comments.

The plaintiffs are represented by Arthur H. Bryant, Todd A. Walburg and John W. Barrett of Bailey & Glasser LLP and Yvette Golan of The Golan Firm PLLC.

The Microsoft Office Privacy Class Action Lawsuit is Frank D. Russo, et al. v. Microsoft Corp., Case No. 3:20-cv-04818, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

Zoom Class Action Alleges Privacy Violations

Google Class Action Says Tracking Violates Consumer Privacy

Roundup® Weed & Grass Killer Product Label Class Action Settlement

New Jersey Catholic Church | Clergy Abuse Lawyer Help