Microsoft pledges to extend EU data rights worldwide

NEW YORK — Microsoft has promised to give users worldwide the same data and privacy rights Europeans will get under new regulations there, in contrast to some of its tech rivals, which were hedging on how much privacy protections will change for Americans and other non-Europeans.

Microsoft’s move means no matter where you live, you will be able to see what information the company collects about you, and correct or delete it if necessary. You will also be able to object to the use of data for marketing and other purposes. You can exercise the rights by using online tools or contacting the company directly.

New European rules, known as the General Data Protection Regulation (GDPR), take effect on Friday but United States (US) tech companies have not generally embraced them outside of the European Union (EU).

Facebook, for instance, has said it is offering the same privacy settings and controls worldwide but has stopped short of promising European-style rights around the globe.

Julie Brill, Microsoft’s deputy general counsel, said in a blog post on Monday that the company believes the new regulation “establishes important principles that are relevant globally.”

But because the company does not depend as much on advertising revenue as Facebook and Google, Microsoft can afford to give users more options on data use.

Microsoft updated its privacy policy on Monday to make it easier to understand and include more details. For instance, it spells out additional sources of third-party data that Microsoft gets, including outside developers who create apps and other experiences for Microsoft’s Cortana voice assistant.

The new EU rules have prompted companies large and small to update their privacy policies and service terms to comply.

Facebook

In March, Facebook updated its privacy controls in hopes of making them easier to find and understand. CEO Mark Zuckerberg has said Facebook intends to offer those same controls and settings around the world even though the GDPR governs only EU users.

But Facebook has been vague about applying other GDPR provisions to non-Europeans. That includes one that lets Europeans object to the processing of personal data, such as for marketing.

Facebook has also ramped up efforts to get users permission to use facial recognition to automatically identify people in photos — for instance, to make it easier to tag friends or to let you know if someone uses your photo. Facebook has been using that technology in much of the world for six years but not in the EU and Canada, where privacy laws are stronger.

Now, EU and Canadian users are being invited to turn that feature on. Facebook said it will eventually ask everyone to reaffirm the use of facial recognition; the company previously assumed consent unless users took the initiative to turn that off.

Though Facebook was not making major changes to its data practices, its new privacy policy has one subtle change. Previously, all users outside the US and Canada were legally managed by Facebook’s Irish subsidiary. Under the new rules, everyone outside Europe will fall under the jurisdiction of its US headquarters.

That means users in Asia, for instance, would not get the EU privacy protections. Facebook did not explicitly announce the change; The Associated Press confirmed it through checks in six countries.

Facebook also plans to offer a less-personalized version of its service for EU teens to comply with requirements of obtaining parental permission before kids under 16 years old can, for instance, list their political or religious views online. In the US, the cutoff is lower, at 13 years old. Facebook would not ask for parental consent in such cases outside the EU but will ask teens themselves if they want these features.

Google

Google, for its part, also was not making major changes to its data practices although it did rewrite its privacy policy to make it easier to understand. It now includes video to explain concepts better. Section headers have larger fonts, and links to related settings were more clearly marked. Google also expanded many sections to further fully explain how it collects and uses data.

Google was also expanding the availability of Family Link, a feature that lets parents create Google accounts for their children. As part of this, parents will have to give consent to comply with new EU provisions governing teens.

The feature also gives parents tools to control Android devices, such as locking the child’s device and blocking apps. Family Link was already available in 11 countries, including US, United Kingdom, and Ireland. Google was working on making that available in the rest of the EU.          /kga