Microsoft has taken a lot of flack for privacy issues in Windows 10, and now ZDNet reports that the French National Data Protection Commission (CNIL) issued a formal notice against Microsoft, listing a number of complaints which unlike some paranoid ranting we have heard from others seem reasonable and well researched.
The CNIL based their complaints on seven investigations it conducted between April and June 2016 and interviews with Microsoft representatives and list the following complaints:
- Irrelevant or excessive data collected
The CNIL found that “collecting diagnostic and usage data via its telemetry service” was acceptable, but found that the default Windows 10 settings, which collect additional information, go too far. The complaint says collecting “information … on all the apps downloaded and installed on the system by a user and the time spent on each one” is “excessive.” - A lack of security
This complaint says the option to secure a PC with a four-digit PIN is insecure as it does not limit the number of attempts to enter the PIN (this seems to be wrong.) - Lack of individual consent
According to this allegation, Microsoft’s advertising ID enables Windows apps and other parties’ apps to monitor browsing and offer targeted ads without proper consent. - Cookies
The agency complains that Microsoft puts cookies on users’ websites without sufficient consent. - Data transfer outside the EU
CNIL says data from French Windows users is being transferred to the United States on a “safe harbor” basis, a practice that should have stopped after a decision issued by the Court of Justice of the European Union on 6th October 2015.
From that list, the fact that the default data collection includes specific app usage information (something some people are quite sensitive about) does seem excessive and it seems some of Microsoft’s privacy practices do not meet mode standards for example being able to opt in and out individually to using Microsoft’s advertising ID on an app by app basis.
The CNIL has demanded Microsoft “stop collecting excessive data and tracking browsing by users without their consent,” and has given Microsoft 3 months to comply. At present it is not known what penalties Microsoft will face if they do not address the issues.
Do our readers agree with the CNIL that Microsoft has in some cases gone a bit too far, or is Europe once again being somewhat oversensitive regarding privacy? Let us know below.