8 ms·
Microsoft’s commitment to GDPR, privacy and customers’ control of their own data
- toomanybeersies 8y agoHere's a question I haven't seen asked or answered: Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? I've only seen people talking about GDPR as it applies to websites, but as far as I'm aware, it applies to all software.
- danieldk 8y agoCan I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? Did you go to the dasboard linked in the article? https://account.microsoft.com/privacy https://account.microsoft.com/privacy It does show non-website data, such as voice queries, location data, media played, product & service performance, app & service activity, Cortana notebook (commute preferences, etc.). It seems that you can also clear this data in the dashboard.
- simfoo 8y agoBut I don't have a Microsoft account (only ever used local accounts in Windows 10). How can I ask for all my data which is associated with my installation/license?
- setquk 8y agoThis is a very good question. I suspect that at some point someone will fire up their lawyers and find an answer. Not only that but you can’t opt out from data collection at the moment.
- juki 8y agoOnly the basic telemetry (which I assume doesn't include any personal data) can't be opted out of in Windows 10 home. Other privacy settings have to be opted in now. The recent "April update" forces you to say yes/no to all data collection settings.
- setquk 8y agoBasic telemetry is HUGE. You can't opt out of basic on Pro either. https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields https://docs.microsoft.com/en-us/windows/privacy/basic-level... There's enough information in there to identify a machine and user via correlation. Here's a full analytical report: https://www.lda.bayern.de/media/windows_10_report.pdf https://www.lda.bayern.de/media/windows_10_report.pdf
- skjerns 8y agoThis! I don't use the MS account for my installation. Nevertheless, a lot of stuff must be sent to them about me.
- kungito 8y agoMy best guess would be that your data is going through pseudonymization and so you are no longer uniquely identifiable. [1] By contrast to anonymization, Article 4(5) of the GDPR defines pseudonymization as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information.” By holding the de-identified data separately from the “additional information,” the GDPR permits data handlers to use personal data more liberally without fear of infringing the rights of data subjects. This is because the data only becomes identifiable when both elements are held together. [1] https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-primer-on-anonymization-and-pseudonymization/ https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-...
- theyinwhy 8y agoNo, look at the actual law and you see that is plain wrong: (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.
- Angostura 8y agoI think the actual answer is that you send a snail-mail letter to MS, supplying proof of identity, details of your license and ask for all the PII that they have on you.
- tallanvor 8y agoGo here: https://aka.ms/privacyresponse https://aka.ms/privacyresponse I have no clue what information they'd need from you to answer that question, but at least you can get a response without having to send a physical letter.
- willyyr 8y agoThere is an option to delete all diagnostic data collected (Windows 10 1803). You can find it under Settings->Privacy-> Diagnostics & feedback-> Delete diagnostic data. As others have mentioned you can access and manage it using the portal that is linked.* * I work at Microsoft.
- gerdesj 8y agoCan I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? I'd also suggest asking for proof. For that you will require non encrypted traffic streams and/or source code ...
- vntok 8y agoNonsense. Where in the GDPR is it specified that you are entitled to the providers' IP? Auditing compliance is done by parties trusted by both sides, certainly not by amateurs and certainly not by individual vigilantes.
- ggg9990 8y agoIf Microsoft is anything like my company, they’ve stopped collection on any PII that they can’t deliver back to the user in response to a privacy request. So they probably have stricken those columns from their DB and are only aggregating data.
- icebraining 8y agoThe GDPR applies to any processing of personal data, regardless of whether it's a website, software or even paper records.
- docdeek 8y agoSmart business from Microsoft, and a gauntlet of sorts for other global tech firms.
- phs318u 8y agoAgreed. There's no reason why Microsoft - a software and hardware maker - couldn't be more like (or even supercede) Apple in this regard - i.e. treat the user as the customer not the product. Further to that (without wanting to be cynical), it's probably also easier for MS to avoid the potentially complex jurisdictional issues that GDPR raises. One privacy code-base to rule them all.
- vkou 8y ago> Agreed. There's no reason why Microsoft - a software and hardware maker - couldn't be more like (or even supercede) Apple in this regard - i.e. treat the user as the customer not the product. Besides Apple's sky-high margins and complete control over the iPhone ecosystem, with a vice-like grip on app developers, no reason whatsoever. If Microsoft made $400 per Windows PC that was sold, and 30 cents on every dollar of windows software ever sold (And had a competitor called Froogle with a steady 70% market share, whose business was based on user monetization), they'd probably be less interested in monetizing their users. I'm not entirely sure that's a world you'd want to live in, though.
- Angostura 8y agoFor context, Microsoft's fiscal 4th quarter, as reported last July, saw profits of $6.5 billion, doubling year on year, largely due to strong growth in its cloud offering. Strong privacy offerings might cut that to - what? $6bn?
- Kim_Bruning 8y agoLeveling the playing field means that people who provide good privacy options are no longer out-false-competed in a race to the bottom. It's entirely plausible that companies will actually see their income increase.
- potench 8y agoOk so there’s a privacy policy on this website and a standard “we use cookies” header but where is the consent management platform that’s supposed to let me review all the purposes and vendors used on the site so I can choose which ones I want to give consent to and which ones I don’t. The https://github.com/appnexus/cmp https://github.com/appnexus/cmp appnexus cmp is the only cmp I’ve found that’s open source and provides a clear reference to what GDPR means as far as integrating the actual GDPR spec for an euconsent signal, a UI for managing consent, and deferring cookies/data-collection until after consent. Gdpr goes into effect in 4 days and I still haven’t seen any CMPs integrated in the wild. Has anybody?
- KozmoNau7 8y agoI haven't seen a single one of those in the wild yet, only "we've updated our ToS with a section about your private data, agree or stop using our service", which simply does not fly.
- tallanvor 8y agoI'm pretty sure that GDPR doesn't mean you get to decide which vendors Microsoft gets to use. The commitment is that Microsoft and all vendors they use will be following GDPR.
- Angostura 8y agoDon't forget that 'consent' is only one of the bases to collect data. Where the data is vital to the ability to run the service, it will be being collected on the basis of contractual agreement, not consent.
- KozmoNau7 8y agoI've seen a lot of privacy policies include lines like "we collect your activity data on the website, so we can improve your experience" or "we use cookies to gauge how to improve our services" or "we collect usage data to improve our marketing across other sites and platforms", which are both horribly vague and certainly not vital to run the service. I took those lines basically verbatim (translated from Danish) from Just-Eat's Danish website. I am pretty sure they're violating GDPR, based on what they say in their privacy policy. Collecting usage data and sending data to third-party marketing companies is not vital to running a food ordering website. A ToS is not a legally binding contract, and I have not been asked for direct consent to their use of my data.
- setquk 8y agoPrivacy: ability to opt out of all data collection. Microsoft privacy: inability to opt out of all data collection unless you pay for enterprise edition. This makes a mockery of any policy.
- glogla 8y agoAlso ads for Candy Crush in you operating system. Microsoft is scum. They have not changed from the 90s, they are just better at hiding it.
- setquk 8y agoYep. My only that some of the UWP apps you can’t uninstall easily like Xbox etc. Really the deal breakers for me recently are: 1. Privacy defaults to none and can only be optimised for none in Windows 10. Only did they back down for enterprise customers because they know they wouldn’t get away with it. 2. Bundling of crapware. 3. Shipping on by default telemetry in dev toolchain (.net core) 4. Blinding marketing detracting from the masses of data collection. 5. Any attempts to confront this result in silence, “it’s good for you” or “tough shit”. They’re not a good citizen. They just tell you they are. Unfortunately my livelihood depends on them at least in the short term.
- Fnoord 8y agoMicrosoft is reinventing itself. You can disable those ads. You can remove apps like Skype. Manually or with an app such as O&O Shut Up. I also use Classic Shell instead of the new start menu.
- tonyedgecombe 8y agoMicrosoft is reinventing itself. Really? I though that was just standard corporate marketing.
- cpach 8y agoThey are changing, that still doesn’t mean that all things they do are good things.
- a_imho 8y agoI was just wondering whether there is an automatic update to Windows disabling (all?) telemetry, then let the user make the choice to opt in without grey UI patterns and fud.
- jicka 8y agoThe "April update" that is getting rolled out does this on the first start after the update. You get asked what each privacy setting should be. I felt it was fairly easy to understand and not trying to trick you.
- kartan 8y agoYes. I got my configuration reset and needed to set up some features again. This is an example of what you get on startup, and cannot be skipped: https://twitter.com/baekdal/status/996391978957987845 https://twitter.com/baekdal/status/996391978957987845
- Kim_Bruning 8y agoI keep looking for the "None" option; but I guess that's Enterprise only?
- vntok 8y agoExplicit user consent is not the only way to get GDPR compliant
- yAnonymous 8y ago>Respecting the privacy rights of consumers everywhere Anyone who tried to disable the Windows 10 tracking knows what a load of shit that statement is.
- deleted 8y ago[deleted]
- trendia 8y agoI'm not convinced. I run a Pi-Hole [0] to redirect all advertising-related queries to a black hole. When tracking the most-blocked domains, Microsoft is at the very top [1]. For instance, when I enter "Office" into the start menu, Microsoft immediately sends a ping to bing.com and Microsoft's telemetry servers. That is, Microsoft is sending all of the data entered into the start menu to Microsoft's servers, even when using the 'Pro' version and with 'full' telemtry off. When it was first detected that Microsoft was adding telemetry calls to all compiled programs in Windows [2], Microsoft said it was mostly for event debugging for programmers. Now I'm not so sure -- look at your Microsoft account privacy settings to see that Microsoft tracks when you open applications. (They say on the page that not all data is shown there). Unforutnately, there is no way to opt out of this. You can "disable" full telemetry, but you still have to opt into "Basic" telemetry, which still sends your advertiser ID, the programs you run, and the queries you put into the start menu. I'm concerned that Microsoft is not going to stop here. They have a real incentive to capture as much data about you as they can -- they currently earn about $1 billion in advertising through Bing.com search queries. Unlike Google or especially Facebook, however, it's much more difficult to opt out of Microsoft's tracking -- so many people depend on Microsoft Office or other Windows programs that I can't fully switch to Linux. I don't know how this is acceptable through GDPR. There are so many problems with what Microsoft is doing: 1. There is no way to opt out of telemetry 2. There is no way to see all of the data that Microsoft has collected 3. Microsoft has severe lock-in because so much software is written for Windows-only 4. Microsoft has an incentive to increase their telemetry, not decrease it. [0] https://pi-hole.net/ https://pi-hole.net/ [1] https://imgur.com/a/MbjtYJe https://imgur.com/a/MbjtYJe [2] https://old.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/ https://old.reddit.com/r/cpp/comments/4ibauu/visual_studio_a...
- nojvek 8y agoHow much I would pay for EU to make a good example of Microsoft and fine then billions for not complying to GDPR policies.
- deleted 8y ago[deleted]