I completely agree that they should explicitly inform. Like you outline, you could run into other issues.

Looks like I have to reread GDPR.

I do the argumentation here only for the argument that Microsoft will not lose in front of a judge.