Microsoft has already drawn criticism regarding claims that the data collection of Windows 10 is still overly aggressive. However, it is now facing a direct legal challenge over how it handles customers’ information. The Netherlands’ Data Protection Authority has discovered that Windows 10 violates the data protection law of the country even after modifications that came with the Creators Update. Purportedly, Microsoft does not “clearly inform” users of the type of data it is using and the reasons why the data is required. Moreover, officials think that the default settings of Windows prevent users from offering true consent to data gathering.
During the installation process, Windows defaults to the full data sharing and encourages users to simply accept those terms. The DPA said that just because users did not change those settings does not mean that users gave permission. The regulator also asserted that the Creators Update did not honour some existing privacy preferences of the users and that Microsoft does not make it clear that the Edge browser is continuously accumulating app and browsing data using the default settings.
Unsurprisingly, Microsoft has taken concern with the said findings. In the company’s response to the DPA, it showed point-by-point “concerns” with the statement of the Dutch authority. It stated that Windows 10 informs users regarding the data it collects and how that information is used, although it acknowledged that users might have to jump into the privacy agreement or “learn more” sections (that is, the sections that only a few people read) to acquire a full understanding. It also discussed that it requires at least some device data to understand compatibility problems (after all, there are millions of Windows users) and watch for app crashes that are repeated that might hint at security holes. And as users might expect, Microsoft does not agree that its approach to software defaults stops people from giving true consent.
Microsoft does intend to work with the authority to manage violations, even though the disputes imply that the two sides are not going to come to an agreement in the near future. Whatever happens, this Dutch claim could hold far-reaching consequences. Unless Microsoft is willing to produce a version of Windows 10 with privacy changes only for the Netherlands, users may see it change data collection policies worldwide.