This is true for all US basee Companies who fall under FISA not just Microsoft. As you stated Microsoft can and will update its Practices to be more Compliant

This is true for all US basee Companies who fall under FISA not just Microsoft. As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied. I have more citations and also newer but they are in German. Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stellungnahme-zum-einsatz-von-microsoft-office-365-hessischen-schulen https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/orientierungshilfen/2020-BlnBDI-Hinweise_Berliner_Verantwortliche_zu_Anbietern_Videokonferenz-Dienste.pdf https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/... And on the technical side: https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/SiSyPHuS_node.html;jsessionid=1EEB5B5ECE76A93E791579FF0EED2CE0.1_cid501 https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat... The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller. Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service. Thats the consequence from the CJEU ruling.