The discussion about diagnostic data for Windows 10 already started with the first version and is continuing as Microsoft connects the product with more and more cloud services such as OneDrive, speech recognition or even Cortana and Microsoft Search. In the most different appraisals of national data protectionists and appraisals of the Dutch Ministry of Justice the sending of telemetry/diagnostic data is chided. In January 2020 Microsoft reacted with new GPOs and possibilities in the Enterprise and EDU area to reduce the sending and to have more control over it.
Diagnostic and telemetry data and data protection
A look at the Microsoft Online Service Terms (1 July 2020) and the DPA Annex (https://aka.ms/DPA) (1 July 2020) clearly shows the processing of this data under Privacy Shield. This can be seen for example in connection with the Connected and optionally Connected Experience (https://docs.microsoft.com/de-de/deployoffice/privacy/connected-experiances) but also for Windows 10.
This is no longer possible now that the ECJ decision of 16 July 2020 has prohibited this type of processing of personal data.
New configuration options for corporate customers
Requirements: Windows 10 Pro, Windows 10 Enterprise, Windows 10 EDU
“Windows diagnostic data is used to help Microsoft keep the operating system secure and up-to-date, troubleshoot problems and make product improvements. For more information about Windows diagnostic data, click here.”
Until now, there were two ways to manage Windows 10 diagnostic data:
1) Allow Microsoft to be the controller of this data and determine the purposes and means of processing Windows diagnostic data to improve the Windows 10 operating system and provide analytical services
-> Microsoft is responsible for data processing
2) switch off the diagnostic data flow completely.
The new third option
3) “The customer is the controller for their Windows 10 diagnostic data and can at the same time benefit from the purposes for which this data serves, such as the quality of updates and device drivers. In this approach, Microsoft will act as the data processor and process Windows diagnostic data on behalf of the controller”.
Contract data processing
-> Customer/user is responsible and client for the Windows 10 diagnostic data
-> Microsoft is Data Processor, i.e. order data processor for Windows 10 diagnostic data
“This new option will allow customers to use familiar tools to manage, export or delete data to help them meet their compliance obligations. For example, the Microsoft Azure Portal will allow customers to respond to requests from their own users, such as deleting and exporting diagnostic data. Admins can easily add – or remove – Windows devices to the service via Group Policy or Mobile Device Management (MDM)”.
“User control and transparency are among our most important privacy principles and are at the heart of Microsoft’s mission to empower every person and organization on the planet to do more. For those customers interested, this option makes it even easier for them to enable the core Microsoft 365 experience and get the most out of it, while keeping their compliance efforts in mind.”
You want to test all three options, then enter the tenant ID. I recommend using a testtenant, as Desktop Analytics and Update Compliance will not work anymore.
What I miss with the new option is the joint control between Microsoft and the customer, which is usually present with these shared services (Facebook fan pages, Google Maps). Microsoft is deliberately putting itself in the position of a contract data processor. Furthermore, I would like to have an option to turn off the diagnostic data completely for all versions. On the other hand, I also understand that certain data must be transferred for the security and protection of the users, then this should be set under EU Modelclauses and it should be set up in a more transparent way, what happens with the data.
Windows 10 Baseline Security for Windows 10 2004 (July 2020)
BSI study on hardening of Windows 10