Union is convicted of omission in case of Microsoft data collection

The court ordered the Union to pay collective moral damages for failure to act in a case involving irregular data collection by Microsoft.

The sentence of the 9th Civil Court of São Paulo came out on Monday (6) and determined the payment of R$ 100 thousand referring to a public civil action filed by the MPF (Federal Public Ministry) against the company and the Union.

The lawsuit alleged that Windows 10, Microsoft’s operating system, collected customer data extensively without the express and informed consent of users. It was information such as geolocation, browsing habits and history of searches performed on the internet.

Last year, Microsoft signed a conduct adjustment agreement of R$ 2.5 million with the MPF to adapt its system to the privacy requirements demanded by the General Data Protection Law and by the Marco Civil da Internet.

The company changed its access to data policy, creating a direct and fast channel for the user, changed icons and pre-selected options that, by default, collected data comprehensively, and created privacy configuration screens, making the process of more transparent data handling.

The Union, according to the MPF, continued to respond to the process for “not fulfilling its duty to supervise the company and for having been negligent in protecting Windows 10 consumers”.

In 2016, Senacom (National Department of Consumer Protection) was asked about possible measures to limit the invasion of privacy through the use of Windows 10. The agency is responsible for opening administrative proceedings against companies that, in any way, harm consumers.

At the time, the secretariat replied that “the issue was complex” and that it proposed to Microsoft that it reinforce actions in this regard. The MPF considered the action fragile, as no administrative proceeding was instituted to investigate the case.

In the process, Senacom mentioned that “it didn’t shy away from acting in consumer protection”, but “it just didn’t do it through an administrative sanctioning process”.

The sentence handed down by federal judge Cristiane dos Santos says that, if not for the action of the MPF, none of the improvements that Microsoft implemented after closing the agreement would have occurred.

“The performance of the National Consumer Protection Department, in this case, remained below expectations, in order to characterize an effective omission regarding the investigation and collection of Microsoft’s performance,” he said.

She cites several global cases of irregular use of data to support the decision, such as espionage uncovered by Wikileaks or the Cambrige Analytica scandal involving Facebook in 2018.

Microsoft and the Ministry of Justice did not comment until the publication of this text.