Windows 10: Microsoft commitment to EU General Data Protection Regulation (GDPR)

Brink · May 21, 2019

On Friday, May 25, the European Union’s General Data Protection Regulation — better known as GDPR — officially takes effect.

GDPR is an important step forward for privacy rights in Europe and around the world, and we’ve been enthusiastic supporters of GDPR since it was first proposed in 2012. It sets a strong standard for privacy and data protection by empowering people to control their personal information. We appreciate the strong leadership by the European Union on these important issues and the invitation to Microsoft to be one of a small number of companies participating in the official events in Brussels on Friday.

We believe privacy is a fundamental human right. As people live more of their lives online and depend more on technology to operate their businesses, engage with friends and family, pursue opportunities, and manage their health and finances, the protection of this right is becoming more important than ever.

Privacy is also the foundation for trust. We know that people will only use technology that they trust. Ultimately, trust is created when people are confident that their personal data is safe and they have a clear understanding of how and why it is used. This means companies like ours have a huge responsibility to safeguard the privacy of the personal data we collect and the data we manage for our commercial customers.

Our commitment to GDPR compliance

We are committed to making sure that our products and services comply with GDPR. That’s why we’ve had more than 1,600 engineers across the company working on GDPR projects. Since its enactment in 2016, we’ve made significant investments to redesign our tools, systems and processes to meet the requirements of GDPR. Today, GDPR compliance is deeply ingrained in the culture at Microsoft and embedded in the processes and practices that are at the heart of how we build and deliver products and services.

We feel good about what we achieved so far. But we know that May 25 isn’t the end of our work. Instead, it is the beginning of the next phase of our focus on GDPR. The fact is that this complex regulatory framework is as new to privacy regulators as it is to us. The ongoing interpretation of the detailed aspects of this regulation will determine the steps that we all will need to take to maintain compliance. As our customers use our tools and experience other features we’ll also listen to their feedback and suggestions for improvements. Because regulatory interpretations change with experience and changing circumstances over time, we will constantly evaluate our products, services and data uses as understanding of GDPR evolves.

Respecting the privacy rights of consumers everywhere

As an EU regulation, GDPR creates important new rights specifically for individuals in the European Union. But we believe GDPR establishes important principles that are relevant globally.

We’ve been advocating for national privacy legislation in the United States since 2005. We’re encouraged that some other tech companies are starting to endorse the need to address this issue as well. While debate about how to protect data privacy continues in the U.S., we’re committed to moving forward now to take concrete steps to help strengthen people’s privacy protection.

That’s why today we are announcing that we will extend the rights that are at the heart of GDPR to all of our consumer customers worldwide. Known as Data Subject Rights, they include the right to know what data we collect about you, to correct that data, to delete it and even to take it somewhere else. Our privacy dashboardgives users the tools they need to take control of their data.

Updating the privacy statement for our consumer services

This week, we have also published an updated privacy statement governing our consumer products and services. The new privacy statement reflects our decision to extend key rights under GDPR to consumers around the world. It also incorporates more specific information and changes related to GDPR. But perhaps most importantly, it is designed to be clearer and more transparent. You can read the new privacy statement here. And you can find out what’s new in the privacy statement here.

Helping businesses and organizations with their own GDPR compliance obligations

Much of the focus on GDPR during the past year has been on how large technology companies are ensuring that the products and services that they provide comply with the obligations that go into effect on May 25. Clearly, this is important.

But at Microsoft our business is built on helping other businesses and organizations succeed. We create the technology and tools that others use to transform their own businesses and drive success. We succeed only when our customers succeed. Therefore, an especially important part of our GDPR effort has been our work to develop tools, best practices and guidance to enable our enterprise customers to prepare for implementation of GDPR.

As GDPR goes into effect, one of our most important goals is to help businesses become trusted stewards of their customers’ data. This is why we offer a robust set of tools and services for GDPR compliance that are backed up by contractual commitments.

For most companies, it will simply be more efficient and less expensive to host their data in the Microsoft Cloud where we can help them protect their customers’ data and maintain GDPR compliance.

You can learn more at: Microsoft.com/GDPR

This week is an important week on an important journey. We look forward to continuing our work with customers, partners and regulators. We’re committed to protecting the right to privacy and ensuring that the benefits of a new generation of technology innovation truly empower people and organizations around the world to achieve more.
Click to expand...

Source: https://blogs.microsoft.com/on-the-i...heir-own-data/

:)

Brink · May 21, 2019

Get GDPR compliant with the Microsoft Cloud

The new General Data Protection Regulation (GDPR) is the most significant change to European Union (EU) privacy law in two decades. The GDPR requires that organizations respect and protect personal data – no matter where it is sent, processed or stored. Complying with the GDPR will not be easy. To simplify your path to compliance, Microsoft is committing to be GDPR compliant across our cloud services when enforcement begins on May 25, 2018.

GDPR is part of our holistic cloud compliance investments

We are committed to our principles of cloud trust – across security, privacy, transparency and compliance. We have a broad portfolio of cloud services that address the rigorous security and privacy demands of our customers, who comprise over 90 percent of Fortune 500 companies. As the GDPR enforcement begins, here is what else you can expect from us:

Technology that meets your needs – You can leverage our broad portfolio of enterprise cloud services to meet your GDPR obligations for areas including deletion, rectification, transfer of, access to and objection to processing of personal data. Furthermore, you can count on our extensive global partner ecosystem for expert support as you use Microsoft technologies.

Contractual commitments – We are standing behind you through contractual commitments for our cloud services, including timely security support and notifications in accordance with the new GDPR requirements. In March 2017, our customer licensing agreements for Microsoft cloud services will include commitments to be GDPR compliant when enforcement begins.

Sharing our experience – We will share Microsoft’s GDPR compliance journey so you can adapt what we have learned to help you craft the best path forward for your organization.

While Microsoft is committed to helping you successfully comply with the GDPR, it is important to recognize that compliance is a shared responsibility. New requirements – like greater data access and deletion rules, risk assessment procedures, a Data Protection Officer role for many organizations and data breach notification processes – will mean changes for your organization. When it comes to GDPR compliance, it’s not just European organizations that are affected, but also those outside of the EU who process data in connection with the offering of goods and services to, or monitoring the behavior of, EU residents. As such, it’s important to understand your obligations related to GDPR regardless of where your organization resides.

It will take time, tools, processes and expertise for you to comply with the GDPR. To do this, you need to make changes to your privacy and data management practices. And failure to do so could prove costly – as companies that do not meet the requirements could face reputational harm and substantial fines of 20 million euros, or 4 percent of annual worldwide turnover, whichever is greater.

The Microsoft Cloud can help

With the most comprehensive set of compliance offerings of any cloud service provider, the Microsoft Cloud is here to support your compliance initiatives. Our commitment to privacy is proven by our actions. Microsoft was the first enterprise cloud services provider to implement the rigorous controls needed to earn approval for our contractual model clauses governing the transfer of data outside of European Union. We were the first cloud provider to achieve compliance with ISO’s important 27018 cloud privacy standard. Microsoft Azure has 53 major certifications and attestations – more than any other major public cloud provider.

When it comes to security, Microsoft’s unique visibility into the evolving threat landscape can also help protect the data that moves through your systems. Our cloud footprint includes over 100 datacenters and more than 200 cloud services. We’re investing over $1 billion annually in security and using our global insights to identify threats and protect your data.

This focus on privacy and security reflects the belief that our business ultimately relies on the trust of our customers, and we work hard to earn that trust. That’s why Microsoft is committing to be GDPR compliant across our cloud services.

Visit the GDPR webpage on our new Microsoft Trust Center website to learn more about how the features and functionality of Azure, Dynamics 365, Enterprise Mobility + Security, Office 365 and Windows 10 will enable you to meet the GDPR’s requirements.

Partnering with you now and in the future

As the fast-approaching GDPR deadline draws closer, we look forward to working in close partnership with you on GDPR compliance. We will continue to share the resources, tools and solutions you need to help develop your own compliance plan. In March, we will announce the details of our contractual commitments in accordance with GDPR rules. In the coming months, we will hold workshops, and host webinars for all customers and partners. We will also expand our GDPR web pages in the Trust Center to address your needs and feedback. Because when it comes to preparing for the GDPR, Microsoft has your back.

Brendon Lynch
Chief Privacy Officer, Microsoft
Click to expand...

Source: https://blogs.microsoft.com/on-the-i...crosoft-cloud/

Brink · May 21, 2019

New Microsoft children accounts EU GDPR parental consent verifications

Microsoft continues on its steady path toward compliance with the European Union (EU) General Data Protection Regulation (GDPR). Today we are announcing new parental consent requirements for accounts held by children in the EU. We are instituting these requirements across our product platforms to meet GDPR requirements, well in advance of the May 25 deadline, to afford our customers the time needed to verify their accounts and authorize any necessary consent.

Where a controller is relying on consent to process personal data, the GDPR requires parents to provide their consent to process personal data of children younger than 16 years old. EU member states may choose to set a lower age – which some have done – provided it isn’t lower than age 13. To implement parental consent requirement in the GDPR, Microsoft is relying on the high standards afforded under the U.S. Children’s Online Privacy Protection Act (COPPA) to verify parental consent for children’s accounts across our product platforms. We have already started to roll out the necessary notifications to our users in many EU member states. We will complete the rollout by the end of April.

Using COPPA processes, we will prompt existing users to provide their country and date of birth. Users who are younger than the age of consent for their country will then be prompted for parental consent when they sign into their account during a short grace period. To verify their child’s account, parents will need to use a credit or debit card, or other payment instrument, for a 50-cent charge which will be credited toward an existing Microsoft account. This nominal charge also offers parents an extra step of protection to be aware of any misuse when reviewing their card statement. Parents who cannot, or choose not, to go through this process can also contact Microsoft Customer Service and Support to verify age and identity based on appropriate government documents.

After the grace period, the child’s account will be blocked until the parent completes the consent and verification process. Microsoft will continue to support data subject rights for children whose accounts are blocked pending parental consent. For new users, Microsoft will block final creation of the account until the parent provides consent within two weeks, after which the account will be deleted.

While we appreciate these new GDPR requirements may cause some temporary inconveniences, verifying that an adult is giving their child permission to use an account is an important component of Microsoft’s effort to help children explore technology safely. We also encourage parents to use this as an opportunity to review their child’s account content, screen time and monitoring settings by visiting account.microsoft.com/family.
Click to expand...

Source: Microsoft begins new EU GDPR parental consent verifications for children's accounts - Microsoft on the Issues

Tip How to Add or Remove a Child Account for Your Microsoft Family in Windows 10

Brink · May 21, 2019

Facebook New Privacy Laws and Protections to Comply with GDPR

In recent weeks we’ve announced several steps to give people more control over their privacy and explain how we use data. Today we’re introducing new privacy experiences for everyone on Facebook as part of the EU’s General Data Protection Regulation (GDPR), including updates to our terms and data policy. Everyone – no matter where they live – will be asked to review important information about how Facebook uses data and make choices about their privacy on Facebook. We’ll begin by rolling these choices out in Europe this week.

Asking People to Review How We Use Data

As soon as GDPR was finalized, we realized it was an opportunity to invest even more heavily in privacy. We not only want to comply with the law, but also go beyond our obligations to build new and improved privacy experiences for everyone on Facebook. We’ve brought together hundreds of employees across product, engineering, legal, policy, design and research teams. We’ve also sought input from people outside Facebook with different perspectives on privacy, including people who use our services, regulators and government officials, privacy experts, and designers.

We’ll ask everyone on Facebook to make choices about:

Ads based on data from partners. Ads on Facebook are more relevant when we use data from partners, like websites and apps that use business tools such as our Like button. We’ll ask people to review information about this type of advertising, and to choose whether or not they want us to use data from partners to show them ads.

Information in their profile. If you’ve chosen to share political, religious, and relationship information on your profile, we’ll ask you to choose whether to continue sharing and letting us use this information. As always, including this information on your profile is completely optional. We’re making it easier for people to delete it if they no longer want to share it.

Allowing face recognition technology. Our face recognition features help protect your privacy and improve your experiences, like detecting when others might be attempting to use your image as their profile picture and allowing us to suggest friends you may want to tag in photos or videos. We’ve offered products using face recognition in most of the world for more than six years. As part of this update, we’re now giving people in the EU and Canada the choice to turn on face recognition. Using face recognition is entirely optional for anyone on Facebook.

We will also ask people to agree to our updated terms of service and data policy, which include more detail in response to questions about how our services work. We’re not asking for new rights to collect, use or share your data on Facebook, and we continue to commit that we do not sell information about you to advertisers or other partners. While the substance of our data policy is the same globally, people in the EU will see specific details relevant only to people who live there, like how to contact our Data Protection Officer under GDPR. We want to be clear that there is nothing different about the controls and protections we offer around the world.

People in the EU will start seeing these requests this week to ensure they have made their choices ahead of GDPR coming into effect on May 25. As part of our phased approach, people in the rest of the world will be asked to make their choices on a slightly later schedule, and we’ll present the information in the ways that make the most sense for other regions.

Introducing Better Tools to Access, Delete and Download Information

The new Settings and Privacy Shortcuts features we announced last month were built with GDPR in mind, and people will start seeing them this week. Our recently-expanded tools for accessing your information will allow people to see their data, delete it, and easily download and export it. These tools are available globally, although we designed them to comply with GDPR too. We’ve also updated our Activity Log on mobile to make it easier for people to see the information they’ve shared with Facebook from their mobile device.

Providing Special Features for Young People

GDPR recognizes the importance of providing special protections and experiences for teens. We’ve built many special protections into Facebook for all teens, regardless of location. For example, advertising categories for teens are more limited, and their default audience options for posts do not include “public.” We also keep face recognition off for anyone under age 18 and limit who can see or search specific information teens have shared, like hometown or birthday. Later this year we’ll introduce a new global online resource center specifically for teens, and more education about their most common privacy questions.

Under GDPR, people between the ages of 13 and 15 in some EU countries need permission from a parent or guardian to allow some features on Facebook — seeing ads based on data from partners and including religious and political views or “interested in” on your profile. These teens will see a less personalized version of Facebook with restricted sharing and less relevant ads until they get permission from a parent or guardian to use all aspects of Facebook. Even where the law doesn’t require this, we’ll ask every teen if they want to see ads based on data from partners and whether they want to include personal information in their profiles.

Beyond today’s announcements, we’ll keep improving. We’re committed to making sure people understand how we use their information and how they can control it.
Click to expand...

Source: Complying With New Privacy Laws and Offering New Privacy Protections to Everyone, No Matter Where You Live | Facebook Newsroom

Microsoft commitment to EU General Data Protection Regulation (GDPR)

Microsoft commitment to EU General Data Protection Regulation (GDPR)

Microsoft commitment to EU General Data Protection Regulation (GDPR)

Microsoft commitment to EU General Data Protection Regulation (GDPR) - Similar Threads - Microsoft commitment General

Microsoft Office in trouble in Germany due to GDPR

Sound not regulating

General protection fault

Tamper protection now generally available for Microsoft Defender ATP

Facebook New Privacy Laws and Protections to Comply with GDPR

New Microsoft children accounts EU GDPR parental consent verifications

Get GDPR compliant with the Microsoft Cloud

Announcing GDPR Compliance Manager in Microsoft 365

Microsoft is committed to the Surface lineup.