In February, Mariëlle den Hengst will go on holiday to Sri Lanka with her family. Because she doesn’t always have internet there, she saves the tickets, passport numbers and visa information in OneDrive. The documents are therefore available offline in Microsoft’s storage service.
During her vacation, the message appears that her account ‘requires attention’. Mariëlle must register again to resolve the problem, but in the meantime she can still access her travel documents. I’ll take a look at that at home, she thinks.
Back in the Netherlands, she fills out a form to unlock her account. She provides the information that Microsoft asks of her, to the extent possible. Without success: on February 21 she heard that the automated system had insufficient information to unlock her account.
‘Now I’ve lost everything’
Mariëlle tries again. And again. Until two days later she receives a message: “Microsoft has denied access to the account due to a serious violation of the Microsoft Service Agreement.” It does not say what exactly she allegedly did wrong. Only a reference to the code of conduct. It contains ten rules that should not be broken.
“I was shocked,” Mariëlle told RTL News. “I want to prove that I am the rightful owner. And suddenly I would have violated the code of conduct. I keep everything on OneDrive: photos and videos, the financial administration, but also articles that I write. Now I have lost everything,” I thought. I.
Mariëlle is not the first person this has happened to. In recent years, Microsoft has removed hundreds of people from their accounts without explanation, RTL News reported in 2022. Victims lose everything and don’t know why. This often only becomes clear when they go to court.
In 2022, Microsoft promised improvement by adhering to new European rules. They state that Microsoft must provide ‘clear and specific justification’ for suspending OneDrive accounts.
Experts: ‘Microsoft breaks rules’
These rules from the Digital Services Regulation (better known by the English abbreviation DSA of Digital Services Act) have been in effect since February 17. That was four days before Mariëlle was told that she had violated the code of conduct, without Microsoft making it clear which rule was involved.
Simply referring to the code of conduct without getting specific is not ‘clear and specific’, and so Microsoft is in violation of the DSA, says Paddy Leerssen, researcher and DSA expert at the University of Amsterdam. He looked at Mariëlle’s case at the request of RTL News.
Other DSA experts agree with him. “This is indeed not very specific,” says Pieter Wolters of Radboud University. “The DSA also requires that Microsoft must enforce carefully. This is not the case if you are removed from your account without any explanation.”
“Such general references to the conditions clearly do not comply with the DSA,” says Inge Graef of Tilburg University. “The company must motivate why an account is blocked. As a user you must be able to understand why the decision was made and estimate whether this was for the right reasons.”
Microsoft would only respond via a short statement. The company does not deny that it is violating the DSA. “We are working with regulators and other key stakeholders on our approach to digital security and DSA compliance,” the company said.
Microsoft’s European headquarters are in Ireland. The DSA supervisor there confirms the contact. “We have entered into discussions with Microsoft about their responsibilities,” a spokesperson said.
That conversation is specifically about the article in the DSA that states that Microsoft must provide “clear and specific justification” for terminating OneDrive accounts.
Hope the regulator takes action
In the Netherlands, the Netherlands Authority for Consumers and Markets will become the supervisory authority for the DSA. Anyone who does not want to go to court immediately to get their account back can file a report there.
But the question is whether the regulator will act. This topic is not receiving specific attention, a spokesperson said.
Moreover, the authority is in a gray area with regard to the new European rules. The supervisory authority can register signals, but cannot open or maintain an investigation at this time. This is because the Dutch law was not ready in time.
One of the people who hopes that the regulator will take action is Danny (not his real name). He already filed a report in 2020 after being kicked out of his account for no specific reason.
As a result, he could no longer use Hotmail, Skype and Office 365. Hundreds of gigabytes of photos, videos and other files in OneDrive were also inaccessible. “Suddenly I could no longer access my family’s photo and video archive, including baby photos of the children.”
Call
Do you have tips or experience with how Microsoft, Google, Apple or other large internet companies operate? Send a confidential email to [email protected] with your story and contact details.
Serious accusation
Danny didn’t leave it at that. He hired a lawyer in early 2023. Only then was he told what the reason might have been: Microsoft allegedly detected images of child abuse. Because Danny wants to keep any link with child abuse at a distance, he does not want to tell his story under his real name.
He does not know where the accusation came from. “I am absolutely certain that there is no child pornographic material. Maybe it was a nude photo of my then partner? The problem is: I cannot prove that it is not the case, because I can no longer access my data.”
It is not the first time that Microsoft has made this accusation. Mark previously told his story at RTL News. He was also told that he had saved nude images of minors on his OneDrive. In court it turned out to be a photo of his 19-year-old girlfriend. The judge ruled that Microsoft had to return the account.
In Danny’s case, something striking happened. Although Microsoft apparently found child abuse images, the company was immediately prepared to return the account ‘out of leniency’.
“Apparently Microsoft is not sure,” Danny concludes. “With such a serious accusation, Microsoft has the right to keep my account blocked. Yet they give my account back. That is a sign of weakness. In fact, why don’t you go to the police? Why don’t you start a case against me?”
A few weeks later, Danny can log in again, but almost 300 GB of family photos and other files are gone. “It feels like twenty years of history has been taken from me.”
Outsourcing files
Mariëlle and Danny want the same thing by telling their story: to warn people. “We keep all kinds of files that we don’t want to lose,” says Mariëlle. “At first I did that on a hard drive. Later you need more storage space, so you get another one. Then you buy an extra one and keep it somewhere else.”
“Until at a certain point you think: we’re going to back up in the cloud. Because you can always access it. But I never thought about the fact that the company that provides cloud storage can close your account. You keep it there so that you you can no longer lose your data. But this is how you still lose them.”
“I won’t get my data back,” says Danny. “But I do want to warn other people. The company promises that it will keep your data safe, but apparently that is not the case.”
Microsoft said in its general response that the company may suspend accounts “to protect people online and ensure we comply with the law.” “We make these decisions carefully, notify users and provide a process for people to appeal.” The company did not want to respond additionally to questions from RTL News.
Two backups
The stories of Mariëlle, Danny and other victims that RTL Nieuws spoke to provide a wise lesson: do not store a backup in one place, but in multiple locations. Companies can lock you out of your digital storage, but your physical storage drive can also fail. If one thing happens, you always have another.
Mariëlle thought she had lost everything. “But because of the stress that came with it, I completely forgot that I regularly back up to a hard drive. The last one was in November, so I ended up only losing a few things.”
