5 ms·

If nine experts in privacy can't understand what Microsoft does with your data, then in my opinion a court should step in and declare it void so that Microsoft

If nine experts in privacy can't understand what Microsoft does with your data, then in my opinion a court should step in and declare it void so that Microsoft isn't allowed to use any private data until they get their act together. If it's so vague that it becomes meaningless that should default to granting no rights. Otherwise, why not publish your all-rights-granting privacy policy in Klingonian in a locked drawer in a toilet basement? ;)

pbhjpbhj 3y ago
It sounds like I might be OOTL, has there been recent legal action relevant to this?
Cthulhu_ 3y ago
> then in my opinion a court should step in and declare it void so that Microsoft isn't allowed to use any private data until they get their act together. I hear what you're driving at, but "a court" cannot be both prosecutor and judge at the same time. This page is about that, possibly starting a civil suit to have a judge look at this and act accordingly.
- j245 3y ago
  The true failure is government. Mozilla shouldn’t have to lead this. The prosecutor should be the regulator.
  - tmpX7dMeXU 3y ago
    America reaps what America sows.
    - FridgeSeal 3y ago
      Wouldn’t have too much of an issue with this if it was confined to America, but unfortunately it’s not. So basically “the rest of us suffer what America sows”
  - boredumb 3y ago
    What is a state prosecutor going to prosecute microsoft on? Vague T&C? As great as it may sound having the state going around proactively enforcing T&C of every product is not going to be effective or fair.
Xelbair 3y ago
yeah, that's basically one of core tenants of GDPR. >Consent must be a specific, freely given, plainly worded, and unambiguous affirmation given by the data subject;
- grabeh 3y ago
  GDPR and indeed any data protection laws may well be completely irrelevant in the context of Microsoft's services. Even if relevant, consent is unlikely to be a relevant as a processing basis under GDPR in the context of usage of MS services. Performance of contract or legitimate interests much more likely to be relevant...
  - cientifico 3y ago
    I'm my experience GDPR is relevant. I need to inform my customers what I do with their personal data. That includes to which companies I share that data with. Having an excel with customer data is providing that data to Microsoft. So I need, as responsible of the data, to know how they will use it. Any use case that isn't obvious have to be cleared stated in the data privacy agreement. Including moving data outside EU into other countries like America (where US government can request that data without even informing us) or using their data to train AI. Come'on. If we need to inform that we used chatgpt (just in case they provide PI), why we will not need to inform about Microsoft.
    - grabeh 3y ago
      Key word is "may" be completely irrelevant! Of course, if you're providing an Excel of customer data, it will be relevant if the user is in the EU. But still, consent won't be relevant in that context. User content may include personal data but may also not...so in some senses, better to include totality of use cases in a non-data protection related document.
grabeh 3y ago
To an extent, think about vested interests here. Mozilla has little to gain by showcasing how clear a rival's new service agreement is! The AI services section seems pretty clear in terms of limiting the use cases of user content: "iv. Use of Your Content. As part of providing the AI services, Microsoft will process and store your inputs to the service as well as output from the service, for purposes of monitoring for and preventing abusive or harmful uses or outputs of the service." Admittedly, I haven't read other parts to understand the full picture though.
- flakeoil 3y ago
  If I understand the below correctly then it seems they can use your data for whatever purpose they want. Also training AI even though it does not explicitly say so. "2b. To the extent necessary to provide the Services to you and others, to protect you and the Services, and to improve Microsoft products and services, you grant to Microsoft a worldwide and royalty-free intellectual property license to use Your Content, for example, to make copies of, retain, transmit, reformat, display, and distribute via communication tools Your Content on the Services." [1] https://www.microsoft.com/en-us/servicesagreement/upcoming.aspx https://www.microsoft.com/en-us/servicesagreement/upcoming.a...
- nvm0n2 3y ago
  That's the only mention of AI using content. So it can be read in a few ways: 1. They will sometimes use the data for training their RLHF stuff, to "prevent harmful use" of the services. 2. The clause is exhaustive and therefore they won't use it for training, as otherwise that'd be mentioned, and are just going to log stuff for the usual monitoring purposes. This is a storm in a teacup. I don't even know why I should care. If MS crawl some web pages I've written and AI gets slightly smarter by reading them, or if I have a chat with the AI and some engineers use it to make the AI work better, great. It's very hard to imagine concrete, real harm from them being able to do this, though I can understand why companies might worry about it spitting out their source code verbatim in some cases.
  - dspillett 3y ago
    > I don't even know why I should care. If MS crawl some web pages I've written and AI gets slightly smarter by reading them Crawling public web pages is a separate issue⁰ – by putting something online you aren't explicitly agreeing to any of MS's policies, at least in the eyes of the law. This is the same for anyone crawling public content not just MS. This privacy policy covers all the content you might use MS apps and services for, i.e. where you are¹ automatically agreeing to MS's policies: OneDrive, potentially any local-only documents in Office, code in VS and other tools, perhaps anything stored on your PC running Windows. > I don't even know why I should care. If you don't use any MS products or services, and no products/services you do use are backed by MS's services, then you don't need to care personally. Or indeed if you do but consider everything you output or otherwise work on to be public domain. Otherwise, maybe it is something you should form an opinion on? ---- [0] time to switch my robots.txt files to “User-agent: * Disallow: /” – though it is very likely already too late for any existing content [1] except where limited by law that you can afford to argue with MS's legal team over
hkt 3y ago
With a sign on the door saying "beware of the leopard"
j45 3y ago
Thanks. Synthetic data might be one perspective.
deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]

pbhjpbhj 3y ago

It sounds like I might be OOTL, has there been recent legal action relevant to this?

Cthulhu_ 3y ago

> then in my opinion a court should step in and declare it void so that Microsoft isn't allowed to use any private data until they get their act together. I hear what you're driving at, but "a court" cannot be both prosecutor and judge at the same time. This page is about that, possibly starting a civil suit to have a judge look at this and act accordingly.

j245 3y ago
The true failure is government. Mozilla shouldn’t have to lead this. The prosecutor should be the regulator.
- tmpX7dMeXU 3y ago
  America reaps what America sows.
  - FridgeSeal 3y ago
    Wouldn’t have too much of an issue with this if it was confined to America, but unfortunately it’s not. So basically “the rest of us suffer what America sows”
- boredumb 3y ago
  What is a state prosecutor going to prosecute microsoft on? Vague T&C? As great as it may sound having the state going around proactively enforcing T&C of every product is not going to be effective or fair.

Xelbair 3y ago

yeah, that's basically one of core tenants of GDPR. >Consent must be a specific, freely given, plainly worded, and unambiguous affirmation given by the data subject;

grabeh 3y ago
GDPR and indeed any data protection laws may well be completely irrelevant in the context of Microsoft's services. Even if relevant, consent is unlikely to be a relevant as a processing basis under GDPR in the context of usage of MS services. Performance of contract or legitimate interests much more likely to be relevant...
- cientifico 3y ago
  I'm my experience GDPR is relevant. I need to inform my customers what I do with their personal data. That includes to which companies I share that data with. Having an excel with customer data is providing that data to Microsoft. So I need, as responsible of the data, to know how they will use it. Any use case that isn't obvious have to be cleared stated in the data privacy agreement. Including moving data outside EU into other countries like America (where US government can request that data without even informing us) or using their data to train AI. Come'on. If we need to inform that we used chatgpt (just in case they provide PI), why we will not need to inform about Microsoft.
  - grabeh 3y ago
    Key word is "may" be completely irrelevant! Of course, if you're providing an Excel of customer data, it will be relevant if the user is in the EU. But still, consent won't be relevant in that context. User content may include personal data but may also not...so in some senses, better to include totality of use cases in a non-data protection related document.

grabeh 3y ago

To an extent, think about vested interests here. Mozilla has little to gain by showcasing how clear a rival's new service agreement is! The AI services section seems pretty clear in terms of limiting the use cases of user content: "iv. Use of Your Content. As part of providing the AI services, Microsoft will process and store your inputs to the service as well as output from the service, for purposes of monitoring for and preventing abusive or harmful uses or outputs of the service." Admittedly, I haven't read other parts to understand the full picture though.

flakeoil 3y ago
If I understand the below correctly then it seems they can use your data for whatever purpose they want. Also training AI even though it does not explicitly say so. "2b. To the extent necessary to provide the Services to you and others, to protect you and the Services, and to improve Microsoft products and services, you grant to Microsoft a worldwide and royalty-free intellectual property license to use Your Content, for example, to make copies of, retain, transmit, reformat, display, and distribute via communication tools Your Content on the Services." [1] https://www.microsoft.com/en-us/servicesagreement/upcoming.aspx https://www.microsoft.com/en-us/servicesagreement/upcoming.a...
nvm0n2 3y ago
That's the only mention of AI using content. So it can be read in a few ways: 1. They will sometimes use the data for training their RLHF stuff, to "prevent harmful use" of the services. 2. The clause is exhaustive and therefore they won't use it for training, as otherwise that'd be mentioned, and are just going to log stuff for the usual monitoring purposes. This is a storm in a teacup. I don't even know why I should care. If MS crawl some web pages I've written and AI gets slightly smarter by reading them, or if I have a chat with the AI and some engineers use it to make the AI work better, great. It's very hard to imagine concrete, real harm from them being able to do this, though I can understand why companies might worry about it spitting out their source code verbatim in some cases.
- dspillett 3y ago
  > I don't even know why I should care. If MS crawl some web pages I've written and AI gets slightly smarter by reading them Crawling public web pages is a separate issue⁰ – by putting something online you aren't explicitly agreeing to any of MS's policies, at least in the eyes of the law. This is the same for anyone crawling public content not just MS. This privacy policy covers all the content you might use MS apps and services for, i.e. where you are¹ automatically agreeing to MS's policies: OneDrive, potentially any local-only documents in Office, code in VS and other tools, perhaps anything stored on your PC running Windows. > I don't even know why I should care. If you don't use any MS products or services, and no products/services you do use are backed by MS's services, then you don't need to care personally. Or indeed if you do but consider everything you output or otherwise work on to be public domain. Otherwise, maybe it is something you should form an opinion on? ---- [0] time to switch my robots.txt files to “User-agent: * Disallow: /” – though it is very likely already too late for any existing content [1] except where limited by law that you can afford to argue with MS's legal team over

hkt 3y ago

With a sign on the door saying "beware of the leopard"

j45 3y ago

Thanks. Synthetic data might be one perspective.

deleted 3y ago

[deleted]

deleted 3y ago
[deleted]