Overall well done PrivacyCompany and the Dutch Ministry of Justice and Security. Still seems to be fights left to have, but this is definitely a step in a positive direction.
> Still seems to be fights left to have, but this is definitely a step in a positive direction.
Indeed. From the article:
"The Dutch government’s new privacy terms and conditions do not (yet) apply to data processing via Windows 10 Enterprise or the mobile Office apps. It is not possible to minimize data traffic in Office Online. From at least three of the mobile apps on iOS, data about the use of the apps goes to a US-American marketing company that specializes in predictive profiling. This is done without providing any information about the purposes of this processing, and without giving the users or administrators any possibility to prevent this processing."
So: use Office on iOS, and it'll send usage data off to some predictive profiling marketing firm.
Why, as a (presumably) paying user, is it OK for Microsoft to do that?
@Microsoft folks here: This, if true (edit: in the way presented here) is outright disgusting.
I have lately found myself defending you when people have been complaining about telemetry (I'm a developer myself so I can see the value), but selling (or giving away) data from Office apps to profiling companies is not ok.
I honestly believed that your upside of such deals was the ability to easily upsell me to a paid version of this software.
This, again if it is correct, is disgusting and might easily be a huge GDPR issue despite how many cookie warnings anyone adds.
Indeed, remember that warnings here a not enough to comply with the GDPR. IANAL, but GDPR requires opt-in rather than opt out, there should be a clear choice, permission should be asked for specific purposes. Also, it should be possible to withdraw permissions, one should be able to retrieve all the stored data, and the data has to be removed on request.
My understanding as well. And the way it has been presented to me is that clear choice means easy to understand (and notice).
Consent should be given by a clear affirmative act (...) such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
> The suite of apps is free of charge for consumers with devices smaller than 10.1 in (26 cm), but business customers need to purchase an Office 365 subscription to take full advantage of the suite on larger screens.
You need to sign up for a Microsoft Account either way.
I've been sitting for months on this article explaining my belief that advertising is a cancer on modern society, and I can't get myself to publish it, because literally every other day brings another thing I want to include on the list of damage being done. I'm not even actively looking for examples anymore; I just open HN and - lo and behold - top story tells me that MS Office mobile apps send data to US predictive profiling company, because of course they do.
Edit: Sorry I don't have any exact citations, he said it in an interview wit Ryan Grant, so I'm sure he has a source he read somewhere.
That by itself isn't necessarily damaging though, is it? Without knowing what company is getting the data, what data they are getting, and what they are profiling for, how can we come to any conclusions?
What if they are just trying to segment users into casual and power users and are using the data to guide future product development and design?
That said, the data sharing should definitely be opt-in.
Is that something you'd hire an external marketing company for predictive profiling, though?
Sure, the quote doesn't give much information about the company and their use of data, but when evaluated in context of typical data sharing with third parties, it's highly damning until proven otherwise.
I don't know. Are there predictive profiling companies that don't work in the marketing sector?
At least, unless it is cancer cell growth.
Oops.
Italy https://www.linuxjournal.com/content/italian-army-switches-l...
France https://joinup.ec.europa.eu/collection/open-source-observato...
Seeing is believing. This has often been used as a strategy to get license discounts from Microsoft.
The interesting take-away from the article and the linked article is that in part they used the GDPR and Dutch privacy laws to force Microsoft into compliance:
The processing of diagnostic data for so many broad and undefined purposes is contrary to the principle of purpose limitation. Additionally, in most cases, there is no legal basis for processing the diagnostic data for these purposes. As (sole or joint) controller, Microsoft cannot rely on the consent of employees as referred to in the GDPR because of the dependent position of employees. At the same time, consent is required under Section 11.7a of the Dutch Telecommunications Act for retrieving data via the Internet, through built-in software, if such processing is not strictly necessary.
Which means that the GDPR does have teeth, which is good for everyone in the EU, not just governments or larger organizations. Similarly, the EU court of justice has recently decided based on the GDPR that web sites must ask consent for sending personal data by loading Facebook like buttons:
https://www.reuters.com/article/us-eu-facebook-dataprotectio...