Microsoft Office Sign

Software developers were given a “warning” after the Dutch Data Protection Authority (Dutch DPA) concluded Microsoft's Windows 10 operating system violates provisions of the local Personal Data Protection Act (PDPA). For other software developers, this case should be a warning to check privacy regulatory issues and review the findings of the Dutch regulator, according to legal privacy specialists.

Silvia van Schaik, an attorney in Amsterdam, The Netherlands, at bureau Brandeis, told Legaltech News that “this case should be seen as a warning for software developers. They often appear not to take privacy laws into account when including big data technologies in their applications.”

“Requirements such as 'privacy by default' and 'privacy by design' are specifically included in the GDPR [the European Union's forthcoming General Data Protection Regulation] and will therefore only increase in importance,” she added. “Software developers should really start to think about limiting data collection and use. Also, they should—by default—include privacy-friendly settings, but also privacy-enhancing technologies.”

Similarly, Joe McNamee, executive director of European Digital Rights (EDRi), said that regardless of regulatory issues, “transparency and simple respect for users' privacy and security” is needed. “Developers that behave ethically shouldn't need a regulatory push to respect the users of their products.”

However, given the privacy-by-design and privacy-by-default principles in the new GDPR and “current discussions around the new ePrivacy Regulation, [regulators] should give the free riders a valuable nudge,” he added.

Overall, the recent conclusion from the Dutch DPA says that too much “telemetry” data is being collected, and it is impossible for users to be able to give meaningful consent, McNamee explained. Looking ahead, he said Microsoft should be “more transparent, grant users more control over their data and be more discerning about the types of data it is collecting.”

Under the PDPA, organizations must provide detailed information to data subjects on the processing of personal data. In Microsoft's case, van Schaik explained, the information provided “did not sufficiently describe that Microsoft continuously collects personal data from and about every device on which Windows 10 is installed, including data about use of apps and websites. Such data reveals a lot of information about a person's behavior and has a sensitive nature.”

Also, Microsoft has insufficient legal grounds for its processing, she advised. “An organization may only process personal data if it has a legal ground for it,” she explained. “Microsoft uses the data for fixing errors and security but also for improving its own products and showing users personalized ads in Windows, Edge and apps. While it allows users to opt out from the most extensive forms of collection and use, the default settings allow full collection and use. This more extensive collection and use cannot be considered necessary for the performance of a contract nor for the legitimate purpose of Microsoft. Therefore, the processing operation as a whole cannot be based on these legal grounds.”

There are steps that Microsoft should take in response. In the short term, van Schaik recommended the company change its default settings so that the collection and use is kept to a minimum until a user actively decides to provide consent. Information provided to users should be complete, and valid consent is obtained where required. And in the long term, the company should ensure that new operating systems and updates include privacy-friendly settings by default and sufficient information for users.

There could be an impact, too, on multinational companies using Windows 10 in The Netherlands. Even though the Dutch DPA designates Microsoft as the sole data controller, and the sole entity responsible for compliance, “this may not yet relieve companies using Windows 10 from their responsibilities,” van Schaik said.

“Companies using Windows 10 may therefore want to investigate how to adjust the settings to limit the collection and use of their data and either change it on behalf of the users or recommend that the users within their organization do so,” she explained. “Also, they may want to contact Microsoft and push them to offer improvements sooner rather than later, while holding Microsoft liable for any damages caused by its noncompliance.”

In the future, the PDPA and the European Privacy Directive will be replaced by the GDPR in May 2018. “The important topics in this decision, such as purpose specification, providing information to data subjects and legal grounds for processing, do not materially change under the GDPR,” van Schaik said. “If anything, the requirements will be more stringent under the GDPR. Moreover, the GDPR specifically includes privacy by default as a separate requirement.”

Similarly, Jeremy Malcolm, senior global policy analyst at the Electronic Frontier Foundation, told Legaltech News, the Dutch case “foreshadows the ramped-up enforcement of privacy law that American companies can expect as the GDPR takes effect.”

“Companies cannot afford to ignore European privacy law if they serve European consumers, even if their main headquarters are in the USA,” he warns. “The penalties for noncompliance are extremely high; up to the greater of 10 million euros [$11.6 million] or 2 percent of global annual turnover. To reiterate, that's not just turnover related to activities in Europe, but globally. These are enormous penalties for a company like Microsoft. The penalties are double for breach of certain provisions.”