> More generously, they were applying GDPR rules in the correct manner, but to a different scenario: Microsoft customers being supported by Microsoft subcontrac

> More generously, they were applying GDPR rules in the correct manner, but to a different scenario: Microsoft customers being supported by Microsoft subcontractors that don't need to know the customer PII to do their job. They were not. If it was applied in correct manner, there would be a role of PII data administrator that could be given people in the system that is allowed to access that, just like the org is supposed to handle the data, designate people with access and range of the access they have to this data.