The thing to me is that under EU legislation, you need consent from a user to process their personal data.
If the user did not even know about it, then by definition, you did not get consent.
I (and judges) know that this is easier said than done. Even if you’re purely working in the interest of the user, you might not always succeed.
But it still means that the onus is on Microsoft here. They need to credibly ensure that they actually tried to get consent, for example this should be opt-in in the wizard, not opt-out.
The thing to me is that under EU legislation, you need consent from a user to process their personal data.
If the user did not even know about it, then by definition, you did not get consent.
I (and judges) know that this is easier said than done. Even if you’re purely working in the interest of the user, you might not always succeed.
But it still means that the onus is on Microsoft here. They need to credibly ensure that they actually tried to get consent, for example this should be opt-in in the wizard, not opt-out.