On February 15, 2017, WP29 sent another letter to Microsoft expressing its concerns about the default installation settings and continuous apparent lack of control for users to prevent collection and further processing of their data.
Following the launch of Windows 10, WP29 and Data Protection Authorities (DPAs) around the world expressed significant concerns about the default installation settings and an apparent lack of control for users to prevent collection or further processing of data. See here. In light of these concerns a number of EU DPAs initiated detailed inquiries into the matter, namely the DPAs of Bavaria (Germany), France, Netherlands, Hungary, Slovenia, Spain and UK. Collaboration is coordinated by the DPA of Bavaria (Germany).
Microsoft cooperated with the DPAs and the recently announced future improvement to offer users more control over data collection and processing. See here.
However, WP29 “remains concerned about the level of protection of users’ personal data”.
WP29 reminds Microsoft that “user consent can only be valid if fully informed, freely given and specific”.
“Additionally, the purposes for which Microsoft collects personal data have to be specified, explicit and legitimate, and the data may not be further processed in a way incompatible with those purposes. Microsoft processes data collected through Windows 10 for different purposes, including personalised advertising. Microsoft should clearly explain what kinds of personal data are processed for what purposes. Without such information, consent cannot be informed, and therefore, not valid”.
According to WP29, the scope of “the personal data necessary for the functionalities of the operating system has not been adequately clarified”. Open questions remain about the proportionality of the personal data processed by Windows 10.
Open PDF of WP29 letter to Microsoft