Is there any law that Windows 10 "spying" might violate?

Question

Windows 10 terms of service document includes Microsoft privacy statement which contains the following excerpt (as cited on http://bgr.com/2015/07/31/windows-10-upgrade-spying-how-to-opt-out/)

Finally, we will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to: 1.comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies; 2.protect our customers, for example to prevent spam or attempts to defraud users of the services, or to help prevent the loss of life or serious injury of anyone; 3.operate and maintain the security of our services, including to prevent or stop an attack on our computer systems or networks; or 4.protect the rights or property of Microsoft, including enforcing the terms governing the use of the services – however, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property of Microsoft, we will not inspect a customer’s private content ourselves, but we may refer the matter to law enforcement.

Is there nothing in US (or perhaps European) laws that makes asking for customer acceptance of such conditions simply illegal (especially if one considers the probable implications, not spelled out of course in the Orwellian piece above)?

Of course MS lawyers worked hard to whitewash the text, but are there any precedents/legal line of action which may be taken?

Answer 1

It's hard to prove a negative, and I'm not sure which specific part of the quoted Terms you object, to, but it specifically states that content access may be done to:

1. Comply with the law
2. Protect its customers; and
3. Protect the security of its business; and
4. Protect its business interests.

It's unlikely that access of information to comply with the law is illegal.

At least one EU directive, Directive 95/46/EC, sets limits on the collection and use of personal information. We're concerned with the first condition for lawful data processing, and the second principle of data quality.

Data processing is only lawful if

• the data subject has unambiguously given his consent; or
• processing is necessary for the performance of a contract to which the data subject is party; or
• processing is necessary for compliance with a legal obligation to which the controller is subject; or
• processing is necessary to protect the vital interests of the data subject; or
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party; or
• processing is necessary for the purposes of the legitimate interest pursued by the controller or by the third party, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection.

The principles of data quality, which must be implemented for all lawful data processing activities, are the following:

• personal data must be processed fairly and lawfully, and collected for specified, explicit and legitimate purposes. They must also be adequate, relevant and not excessive, accurate and, where necessary, kept up to date, must not be stored for longer than necessary and solely for the purposes for which they were collected;
• special categories of processing: it is forbidden to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. This provision comes with certain qualifications concerning, for example, cases where processing is necessary to protect the vital interests of the data subject or for the purposes of preventive medicine and medical diagnosis.

So, let's say that someone has given their consent. It'd be at least a little questionable whether the inspection of private information could mean that they access personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

I'm a bit less clear on US laws, but you'd probably look for laws around Personal Identifying Information, as that's where a lot of focus has been.

Answer 2

On the (disturbing) contrary: There are legal arguments that Microsoft could be an accessory to crime if it does not preserve and make available to lawful government requests all data it can possibly access. See, for example, the use of Sarbanes-Oxley to convict people for clearing their browser history.

This could be avoided if Microsoft had a policy of not accessing or storing such data at all. But since it does access and store user data (in the alleged interest of protecting its own infrastructure against attacks and abuse) it is essentially observing/warning that the government has declared a potential right to access those data as well.

As you said: These terms and policies are scrutinized and written by, presumably, the best lawyers money can buy, since this is a core piece of Microsoft's business. It seems unlikely that they would have missed some law along the way. If there is a law against these terms, then they concluded that the risk-adjusted cost of the terms being found illegal is lower than whatever money they expect can be made with the terms as written.

Answer 3

No, Microsoft is breaking the law. There are many privacy and property laws already on the books, and taking someones property regardless of what you write in such a ridiculous all-binding will hold no more weight legally than if you signed over your house in small print on a TV cable contract. Its really a matter of interpretation at this point, because M$ is doing all this using encrypted datatransfer, but when abuses come to front (which they will), we'll see just how bad all that EULA nonsense stands up in court. A simple example of where M$ is already committing a felony is with hospital computers, many of which now use Win10 products. Some confidential patient information by default is getting sucked up by Redmond. This is plainly illegal by HIPAA regulations. It is actually much worse than illegal negligence as well, as M$ has deliberately designed a system to access and transfer information on local machines. They are cooked.