France's government claims that Microsoft is collecting what it says is "excessive data" from Windows 10 PCs. The country's National Data Protection Commission (CNIL) says it has given Microsoft three months to make changes that will comply with France's data protection rules.
In a press release, the commission stated:
The CNIL found that the company was collecting diagnostic and usage data via its telemetry service, which uses such data, among other things, to identify problems and to improve products. To this purpose, Microsoft Corporation processes, for instance, Windows app and Windows Store usage data, providing information, among other things, on all the apps downloaded and installed on the system by a user and the time spent on each one. Therefore, the company is collecting excessive data, as these data are not necessary for the operation of the service.
The CNIL also claims that "advertising ID is activated by default when Windows 10 is installed" which it says allows Windows 10 apps from Microsoft and others "to monitor user browsing and to offer targeted advertising without obtaining users' consent." In addition, the commission claims that there is a lack of security for Microsoft's online services:
The company allows users to choose a four characters PIN to authenticate themselves for all its on-line services, notably to access to their Microsoft account, which lists purchases made in the store and the payment instruments used, but the number of attempts to enter the PIN is not limited, which means that user data is not secure or confidential.
The CNIL warns it may take action against Microsoft if it does not make changes to Windows 10:
Should Microsoft Corporation fail to comply with the formal notice within the specified timescale, the Chair may appoint an internal investigator, who may draw up a report proposing that the CNIL's restricted committee responsible for examining breaches of the Data Protection Act issue a sanction against the company.
Update: Microsoft's vice president and deputy general counsel, David Heiner, has now issued a statement in response to the French government's charges, noting that the company will "work closely with the CNIL over the next few months to understand the agency's concerns fully and to work toward solutions that it will find acceptable." You can read the full response below.
"Earlier today Microsoft received a notice from the French data protection authority, the Commission Nationale de l'Informatique et des Libertés or CNIL, raising concerns about certain aspects of Windows 10. The notice gives Microsoft three months to address the issues.We built strong privacy protections into Windows 10, and we welcome feedback as we continually work to enhance those protections. We will work closely with the CNIL over the next few months to understand the agency's concerns fully and to work toward solutions that it will find acceptable.The CNIL noted that the Safe Harbor framework is no longer valid for transferring data from European Union to the United States. We fully understand the importance of establishing a sound legal framework for trans-Atlantic data transfers, and that is why Microsoft has been very supportive of the efforts on both side of the Atlantic that led to last week's adoption of the Privacy Shield.As the European Commission observed, Microsoft's January 2016 Privacy Statement states that the company adheres to the principles of the Safe Harbor Framework. Microsoft has in fact continued to live up to all of its commitments under the Safe Harbor Framework, even as the European and U.S. representatives worked toward the new Privacy Shield. As we state in our privacy statement, in addition to the Safe Harbor Framework we rely on a variety of legal mechanisms as the basis for transferring data from Europe, including standard contractual clauses, a data transfer mechanism established by the European Commission and approved by European data protection authorities, to cover data flows from the European Union to the United States.Microsoft will release an updated privacy statement next month, and that will say Microsoft intends to adopt the Privacy Shield. We are working now toward meeting the requirements of the Privacy Shield."
