The Federal Court condemned the Union for default on the violation of consumer rights practiced by Microsoft. According to the Federal Public Ministry of São Paulo (MPF-SP), which initiated the process, the company improperly collected personal data from customers, that is, without the users’ consent, through Windows 10. The judgment acknowledges that the The federal government did not analyze or reprimand the US company for the infraction, and requires the Union to pay compensation of R$ 100,000 for collective pain and suffering.
The MPF-SP sued Microsoft and the federal government in 2018, after verifying the illegal capture of data by Windows 10. The omission of the Union had already been noticed by the judicial body in a civil inquiry, in a letter written by Senacon (Secretariat National Consumer) in 2016. At the time, the federal agency that works in consumer protection had been questioned by prosecutors if it had taken any action against the US company.
However, Senacon reported that “the issue was complex”. The secretariat has not instituted any process to investigate the improper theft of data by Microsoft, or applied administrative sanctions against the company. She just limited herself to “proposing” that the creator of Windows 10 “reinforce actions in this direction”.
When defending itself in the lawsuit filed by the MPF-SP, Senacon said that “it did not shy away from acting in consumer protection” and that “it just didn’t do it through an administrative sanctioning process”.
However, federal judge Cristiane Farias Rodrigues dos Santos states in a ruling:
In fact, the performance of the National Consumer Protection Department, in this case, was below expectations, in order to characterize an effective omission regarding the investigation and collection of Microsoft’s performance.
For the Federal Court, Senacon “practically exempted itself from acting” when passing on a simple recommendation to Microsoft; the Union body did not adopt any measure to investigate and penalize the conduct of the American company, in a disproportionate attitude in relation to the duties of the secretariat that defends the consumer.
Unlike the Union, in 2020 Microsoft signed a Term of Commitment to Adjustment of Conduct (TAC), after having been filed by the Federal Court. The agreement signed with the Federal Public Ministry provides for the company to give greater transparency to the collection of Windows 10 data, treating this information in accordance with Brazilian legislation — such as the LGPD.
Another obligation provided for in the TAC is that the company makes the sharing of data optional, and the collection is done only when the user expressly consents to the activity, except in cases where the information is mandatory for the operation of the operating system.
The Federal Court’s ruling emphasizes that, had it not been for the actions of the MPF-SP and the agreement signed with Microsoft, the improper collection of data would have continued as part of Windows 10. For the attorney general Yuri Corrêa da Luz, responsible for the In this case, the sentence sets an important precedent because it confirms that the Union has the role of supervising, preventing and repressing illegal practices regarding the protection of consumer data.
With the conviction of indemnity for collective moral damages, the Federal Court also reaffirms the importance of the engagement of the Federal Public Authority in guaranteeing the right to protection of the holders of personal data.
Microsoft promised the Federal Public Ministry to modify the Windows 10 interface as part of the TAC. The change would be to allow users to choose configuration forms with more restricted access to their data. In addition, the company confirmed that it would specify what information would be captured by the operating system, as well as inform customers what the purpose of this extraction would be.
By complying with this section of the TAC, Microsoft would have to make it clear that data such as geolocation, as well as Internet browsing and search history, could only be collected with the user’s consent. The MPF says it continues to monitor compliance with the agreement with the creator of Windows 10.