After many complaints about data collection in Windows 10, which has led to a series of investigations into Microsoft's latest operating system, France's National Data Protection Commission (CNIL) has ordered Microsoft to come into compliance with the French Data Protection Act and they have been given only three months to do this. Microsoft has been directed to "stop collecting excessive data and tracking browsing by users without their consent".
In addition, Microsoft needs to take "satisfactory measures to ensure the security and confidentiality of user data" and stop gathering irrelevant data through its telemetry service. For example, information about apps installed and their use is cited as data collection beyond any reasonable need by Microsoft. CNIL also compiled a list of other complaints about the operating system, including the use of an advertising ID for tailored advertising without user consent, data transmission out of Europe to the US without following French law and a lack of cookie blocking options.
In their public statement, the CNIL said:
...the Chair of the CNIL has decided to issue a formal notice to Microsoft Corporation to comply with the Act within three months. This proceedings only commits French Data protection authority. The other data protection authorities belonging to the WP29 Contact group are continuing their investigations within their respective national procedures.
The purpose of the notice is not to prohibit any advertising on the company’s services but, rather, to enable users to make their choice freely, having been properly informed of their rights.
It has been decided to make the formal notice public due to, among other reasons, the seriousness of the breaches and the number of individuals concerned (more than ten million Windows users on French territory).
You can read more at BetaNews.
