Microsoft responds to France’s CNIL notice about Windows 10 data protection concerns

We reported earlier today about a formal notice issued to Microsoft by the French National Data Protection Commission (NCIL). In the notice, the French data protection authority expressed concerns over the amount of data being sent to Redmond via Windows 10, and Microsoft was given three months to address the issues or face formal sanctions.

Just now, we received an email with a response from Microsoft Vice President and General Counsel David Heiner:

“Earlier today Microsoft received a notice from the French data protection authority, the Commission Nationale de l’Informatique et des Libertés or CNIL, raising concerns about certain aspects of Windows 10. The notice gives Microsoft three months to address the issues.

We built strong privacy protections into Windows 10, and we welcome feedback as we continually work to enhance those protections. We will work closely with the CNIL over the next few months to understand the agency’s concerns fully and to work toward solutions that it will find acceptable.

“The CNIL noted that the Safe Harbor framework is no longer valid for transferring data from European Union to the United States. We fully understand the importance of establishing a sound legal framework for trans-Atlantic data transfers, and that is why Microsoft has been very supportive of the efforts on both side of the Atlantic that led to last week’s adoption of the Privacy Shield.

“As the European Commission observed, Microsoft’s January 2016 Privacy Statement states that the company adheres to the principles of the Safe Harbor Framework. Microsoft has in fact continued to live up to all of its commitments under the Safe Harbor Framework, even as the European and U.S. representatives worked toward the new Privacy Shield. As we state in our privacy statement, in addition to the Safe Harbor Framework we rely on a variety of legal mechanisms as the basis for transferring data from Europe, including standard contractual clauses, a data transfer mechanism established by the European Commission and approved by European data protection authorities, to cover data flows from the European Union to the United States.

“Microsoft will release an updated privacy statement next month, and that will say Microsoft intends to adopt the Privacy Shield. We are working now toward meeting the requirements of the Privacy Shield.”

In short, Microsoft is committed to preserving the privacy and security of its customer’s data and has built Windows 10 around protecting that data, and will be working with the CNIL to address their concerns. An updated privacy statement will be coming from Microsoft in August, confirming Microsoft’s intention to adopt the European Commission’s Privacy Shield for which the company has already expressed support.

We’re happy to see Microsoft address this issue head-on, and will be following it over the next few months. Clearly, the company is concerned about how Windows 10 is perceived, and privacy and security remain important. Let us know in the comments what you think of Microsoft’s response to the CNIL, and how you think things will shake out as Windows 10 continues to grow.