Microsoft’s Windows 10 operating system is a work in progress. The company has reiterated this point many times ever since the launch of the OS and has capitalized upon its words by rolling out updates that promised to improve the experience from time to time. However, Windows 10’s privacy settings have caused concerns among various European privacy watchdogs, and it appears that the tweaks Microsoft announced to the OS last month, were not enough to assuage those concerns.
European authorities aren’t exactly happy with how data collection works on the Windows 10 OS. Microsoft is known for collecting massive volumes of data by default on the operating system — and by default means that the user, is often unaware of the fact that data is being collected at all.
After different authorities raised concerns on the topic, Microsoft decided to modify the settings last month and said that it was now reducing the data that was collected at the basic level. The move was expected to appease the concerned authorities and assure them that Microsoft wasn’t a data-sucking vampire, that was attempting to make use of its vast reach to illicitly collect data. In case you are wondering why the company would want to collect user data in the first place — in today’s age and time, data is gold. It can offer companies, including Microsoft, deep insights into user behavior that can then be used to target them for specific products.
Meanwhile, the changes are expected to roll out to users via the Windows 10 Creators Update that us yet to be rolled out. However, as per WP 29, the changes do not let the Redmond giant off the hook and there are still concerns associated with its privacy policy.
The Working Party has significant concerns with some of the personal data collected and further processed by Microsoft within the Windows 10 operating system and specifically the default settings or apparent lack of control for a user to prevent collection or further processing of such data.
As a result the Working Party specifically requests further explanatory information from Microsoft, as data controller for this personal data, as to how the opt-outs, default settings and other available control mechanisms presented during the installation of Windows 10 operating system provide a valid legal basis for the processing of personal data under the Data Protection Directive 95/46/EC.
This is especially of concern where Microsoft would rely on consent as a legal basis for the processing of personal data. The Working Party has previously published Opinion 15/2011 on the definition of consent which highlights that for consent to be considered valid it must be fully informed, freely given and specific.
WP 29 or the Working Party, as you have probably already surmised, is an EU data protection watchdog group. It is one of the more credible ones around and if its not happy with Microsoft’s efforts towards maintaining the sanctity of its customer’s privacy, chances are that other European authorities aren’t either.
And WP 29 does have a point. Microsoft has a long way to go before it can call its data reaping processes in Windows 10 transparent. Data collection settings are turned on by default and the options to turn them off, are suspiciously nestled away, so that it take a huge amount of painstaking work to track them all down and shut them off. Instead of a simple on/off toggle, the settings are spread across a lot of different screens and require users to go to an external website. Microsoft uses the data collected for personalized ads in browser, in the Solitaire game, and to train Cortana.
Meanwhile, the company has reiterated its commitment to working with European data protection agencies to ensure that the data collection process is transparent and does not violate standards. Considering that European regulatory authorities have begun taking the privacy of citizens very seriously, and are ensuring that companies stick to the rulebook by force — that is probably the wisest course of action to take.
