6 ms·

Here's a question I haven't seen asked or answered: Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation

Here's a question I haven't seen asked or answered: Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? I've only seen people talking about GDPR as it applies to websites, but as far as I'm aware, it applies to all software.

danieldk 8y ago
Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? Did you go to the dasboard linked in the article? https://account.microsoft.com/privacy https://account.microsoft.com/privacy It does show non-website data, such as voice queries, location data, media played, product & service performance, app & service activity, Cortana notebook (commute preferences, etc.). It seems that you can also clear this data in the dashboard.
- simfoo 8y ago
  But I don't have a Microsoft account (only ever used local accounts in Windows 10). How can I ask for all my data which is associated with my installation/license?
  - setquk 8y ago
    This is a very good question. I suspect that at some point someone will fire up their lawyers and find an answer. Not only that but you can’t opt out from data collection at the moment.
    - juki 8y ago
      Only the basic telemetry (which I assume doesn't include any personal data) can't be opted out of in Windows 10 home. Other privacy settings have to be opted in now. The recent "April update" forces you to say yes/no to all data collection settings.
      - setquk 8y ago
        Basic telemetry is HUGE. You can't opt out of basic on Pro either. https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields https://docs.microsoft.com/en-us/windows/privacy/basic-level... There's enough information in there to identify a machine and user via correlation. Here's a full analytical report: https://www.lda.bayern.de/media/windows_10_report.pdf https://www.lda.bayern.de/media/windows_10_report.pdf
  - skjerns 8y ago
    This! I don't use the MS account for my installation. Nevertheless, a lot of stuff must be sent to them about me.
  - kungito 8y ago
    My best guess would be that your data is going through pseudonymization and so you are no longer uniquely identifiable. [1] By contrast to anonymization, Article 4(5) of the GDPR defines pseudonymization as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information.” By holding the de-identified data separately from the “additional information,” the GDPR permits data handlers to use personal data more liberally without fear of infringing the rights of data subjects. This is because the data only becomes identifiable when both elements are held together. [1] https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-primer-on-anonymization-and-pseudonymization/ https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-...
    - theyinwhy 8y ago
      No, look at the actual law and you see that is plain wrong: (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.
  - Angostura 8y ago
    I think the actual answer is that you send a snail-mail letter to MS, supplying proof of identity, details of your license and ask for all the PII that they have on you.
  - tallanvor 8y ago
    Go here: https://aka.ms/privacyresponse https://aka.ms/privacyresponse I have no clue what information they'd need from you to answer that question, but at least you can get a response without having to send a physical letter.
willyyr 8y ago
There is an option to delete all diagnostic data collected (Windows 10 1803). You can find it under Settings->Privacy-> Diagnostics & feedback-> Delete diagnostic data. As others have mentioned you can access and manage it using the portal that is linked.* * I work at Microsoft.
- Krasnol 8y ago
  Would that delete the data that has already been transferred to Microsoft? And as others mentioned: the portal is useless for people without MS account. What about those?
  - willyyr 8y ago
    That's exactly what this option does. It deletes everything that has been collected up until that point.
    - Krasnol 8y ago
      Thank you.
- ionised 8y ago
  Why not allow to me to stop that collection in the first place?
  - mulletbum 8y ago
    You can, what do you see on your report that you want to stop?
    - ionised 8y ago
      > You can. How? Unless you have Windows 10 Enterprise Microsoft will not allow you to opt-out of basic telemetry. > What do you see on your report that you want to stop? Why does that matter?
- 8y ago
gerdesj 8y ago
Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? I'd also suggest asking for proof. For that you will require non encrypted traffic streams and/or source code ...
- vntok 8y ago
  Nonsense. Where in the GDPR is it specified that you are entitled to the providers' IP? Auditing compliance is done by parties trusted by both sides, certainly not by amateurs and certainly not by individual vigilantes.
ggg9990 8y ago
If Microsoft is anything like my company, they’ve stopped collection on any PII that they can’t deliver back to the user in response to a privacy request. So they probably have stricken those columns from their DB and are only aggregating data.
icebraining 8y ago
The GDPR applies to any processing of personal data, regardless of whether it's a website, software or even paper records.

danieldk 8y ago

Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? Did you go to the dasboard linked in the article? https://account.microsoft.com/privacy https://account.microsoft.com/privacy It does show non-website data, such as voice queries, location data, media played, product & service performance, app & service activity, Cortana notebook (commute preferences, etc.). It seems that you can also clear this data in the dashboard.

simfoo 8y ago
But I don't have a Microsoft account (only ever used local accounts in Windows 10). How can I ask for all my data which is associated with my installation/license?
- setquk 8y ago
  This is a very good question. I suspect that at some point someone will fire up their lawyers and find an answer. Not only that but you can’t opt out from data collection at the moment.
  - juki 8y ago
    Only the basic telemetry (which I assume doesn't include any personal data) can't be opted out of in Windows 10 home. Other privacy settings have to be opted in now. The recent "April update" forces you to say yes/no to all data collection settings.
    - setquk 8y ago
      Basic telemetry is HUGE. You can't opt out of basic on Pro either. https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields https://docs.microsoft.com/en-us/windows/privacy/basic-level... There's enough information in there to identify a machine and user via correlation. Here's a full analytical report: https://www.lda.bayern.de/media/windows_10_report.pdf https://www.lda.bayern.de/media/windows_10_report.pdf
- skjerns 8y ago
  This! I don't use the MS account for my installation. Nevertheless, a lot of stuff must be sent to them about me.
- kungito 8y ago
  My best guess would be that your data is going through pseudonymization and so you are no longer uniquely identifiable. [1] By contrast to anonymization, Article 4(5) of the GDPR defines pseudonymization as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information.” By holding the de-identified data separately from the “additional information,” the GDPR permits data handlers to use personal data more liberally without fear of infringing the rights of data subjects. This is because the data only becomes identifiable when both elements are held together. [1] https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-primer-on-anonymization-and-pseudonymization/ https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-...
  - theyinwhy 8y ago
    No, look at the actual law and you see that is plain wrong: (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.
- Angostura 8y ago
  I think the actual answer is that you send a snail-mail letter to MS, supplying proof of identity, details of your license and ask for all the PII that they have on you.
- tallanvor 8y ago
  Go here: https://aka.ms/privacyresponse https://aka.ms/privacyresponse I have no clue what information they'd need from you to answer that question, but at least you can get a response without having to send a physical letter.

willyyr 8y ago

There is an option to delete all diagnostic data collected (Windows 10 1803). You can find it under Settings->Privacy-> Diagnostics & feedback-> Delete diagnostic data. As others have mentioned you can access and manage it using the portal that is linked.* * I work at Microsoft.

Krasnol 8y ago
Would that delete the data that has already been transferred to Microsoft? And as others mentioned: the portal is useless for people without MS account. What about those?
- willyyr 8y ago
  That's exactly what this option does. It deletes everything that has been collected up until that point.
  - Krasnol 8y ago
    Thank you.
ionised 8y ago
Why not allow to me to stop that collection in the first place?
- mulletbum 8y ago
  You can, what do you see on your report that you want to stop?
  - ionised 8y ago
    > You can. How? Unless you have Windows 10 Enterprise Microsoft will not allow you to opt-out of basic telemetry. > What do you see on your report that you want to stop? Why does that matter?
8y ago

gerdesj 8y ago

Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation? I'd also suggest asking for proof. For that you will require non encrypted traffic streams and/or source code ...

vntok 8y ago
Nonsense. Where in the GDPR is it specified that you are entitled to the providers' IP? Auditing compliance is done by parties trusted by both sides, certainly not by amateurs and certainly not by individual vigilantes.

ggg9990 8y ago

If Microsoft is anything like my company, they’ve stopped collection on any PII that they can’t deliver back to the user in response to a privacy request. So they probably have stricken those columns from their DB and are only aggregating data.

icebraining 8y ago

The GDPR applies to any processing of personal data, regardless of whether it's a website, software or even paper records.