The FDPIC investigations revealed that data processing in connection with Windows 10 did not conform in every respect with the data protection legislation. The page layout and content on the ‘Quick access' und ‘Customize settings' pages failed to meet the transparency requirements in full. There was a lack of information on how long the transmitted data would be stored, on the content of browser data and on the content of feedback and diagnostic data. In addition, the users found it difficult during individual data processing operations to look up further information, e.g. from the relevant passages of the data privacy statement.

In response, Microsoft made proposals to the FDPIC for rectifying these and other shortcomings, which the FDPIC assessed and amended. The modifications that have now been agreed will ensure that more precise information is provided on data processing. In addition, the new settings page will make it clear to users during the installation process that they must decide on and give their consent to the processing and transmission of data.

The technical implementation of the modifications requested by the FDPIC will be carried out worldwide as part of the two Windows 10 software releases planned for 2017. In the first release, all users making a new installation or update will be given comprehensive information on the settings options for data transfers. In the second release, users will also be given direct access during the installation process to the relevant passage in the latest version of the data privacy statement. This will increase transparency and make it easier for users to find the relevant information in the long and complex declaration.

Irrespective of these changes to the installation process, Windows 10 users still have the option of changing the data processing und transfer settings in the system settings at any time.

The FDPIC regards the solution agreed with Microsoft, in particular the direct links to the relevant passages of the data privacy statement and the choice of options, as a minimum standard for the applications and services offered by other companies. In future investigations, the FDPIC will use the Microsoft solution as a benchmark in assessing data processing procedures.

You can find a preview of the new settings page in Microsoft's latest blog post.

Swiss Data protection commissioner concludes Windows 10 investigation