Hacker News Reader

Comment by toomanybeersies | Hacker News Reader

Here's a question I haven't seen asked or answered:

Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation?

I've only seen people talking about GDPR as it applies to websites, but as far as I'm aware, it applies to all software.

View on HN

Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation?

Did you go to the dasboard linked in the article?

https://account.microsoft.com/privacy

It does show non-website data, such as voice queries, location data, media played, product & service performance, app & service activity, Cortana notebook (commute preferences, etc.). It seems that you can also clear this data in the dashboard.

But I don't have a Microsoft account (only ever used local accounts in Windows 10). How can I ask for all my data which is associated with my installation/license?

This is a very good question. I suspect that at some point someone will fire up their lawyers and find an answer.

Not only that but you can’t opt out from data collection at the moment.

Only the basic telemetry (which I assume doesn't include any personal data) can't be opted out of in Windows 10 home. Other privacy settings have to be opted in now. The recent "April update" forces you to say yes/no to all data collection settings.

Basic telemetry is HUGE. You can't opt out of basic on Pro either.

https://docs.microsoft.com/en-us/windows/privacy/basic-level...

There's enough information in there to identify a machine and user via correlation.

Here's a full analytical report: https://www.lda.bayern.de/media/windows_10_report.pdf

This! I don't use the MS account for my installation. Nevertheless, a lot of stuff must be sent to them about me.

My best guess would be that your data is going through pseudonymization and so you are no longer uniquely identifiable.

[1] By contrast to anonymization, Article 4(5) of the GDPR defines pseudonymization as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information.” By holding the de-identified data separately from the “additional information,” the GDPR permits data handlers to use personal data more liberally without fear of infringing the rights of data subjects. This is because the data only becomes identifiable when both elements are held together.

[1] https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-...

No, look at the actual law and you see that is plain wrong:

(26)

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.

I think the actual answer is that you send a snail-mail letter to MS, supplying proof of identity, details of your license and ask for all the PII that they have on you.

Go here: https://aka.ms/privacyresponse

I have no clue what information they'd need from you to answer that question, but at least you can get a response without having to send a physical letter.

There is an option to delete all diagnostic data collected (Windows 10 1803). You can find it under Settings->Privacy-> Diagnostics & feedback-> Delete diagnostic data. As others have mentioned you can access and manage it using the portal that is linked.*

* I work at Microsoft.

Would that delete the data that has already been transferred to Microsoft?

And as others mentioned: the portal is useless for people without MS account. What about those?

That's exactly what this option does. It deletes everything that has been collected up until that point.

Thank you.

How can i delete all my skype history that's clearly on your servers?

Why not allow to me to stop that collection in the first place?

You can, what do you see on your report that you want to stop?

> You can.

How? Unless you have Windows 10 Enterprise Microsoft will not allow you to opt-out of basic telemetry.

> What do you see on your report that you want to stop?

Why does that matter?

If Microsoft is anything like my company, they’ve stopped collection on any PII that they can’t deliver back to the user in response to a privacy request. So they probably have stricken those columns from their DB and are only aggregating data.

The GDPR applies to any processing of personal data, regardless of whether it's a website, software or even paper records.

Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation?

I'd also suggest asking for proof. For that you will require non encrypted traffic streams and/or source code ...

Nonsense. Where in the GDPR is it specified that you are entitled to the providers' IP? Auditing compliance is done by parties trusted by both sides, certainly not by amateurs and certainly not by individual vigilantes.

Reply on news.ycombinator.com