The Dutch law for the protection of personal information (wet bescherming persoonsgegevens) on which these conclusions are based, is basically just an implementation of an EU-wide directive. So if the WBP authority can agree that this breaks the law, this could climb up the ladder and result in another huge EU fine for Microsoft. I wonder if and how MS will respond or react to this release.