Comment by throwaway294566

It would really depend on the situation to be decided, whether MS would have to pay up, or rather the company using MS products to handle customer data. One can imagine a way to use MS products that might not be illegal, e.g. never use it to process personal data, use anonymized accounts that are not bound to a real person, swap around accounts and computers to prevent association with a person, etc. Then, all it would take for MS to get its 'get out of jail free'-card is to publish that in a whitepaper and make all the problems just be an unfortunate misconfiguration by the company using MS products.