Microsoft agrees to .Net changes to meet EU privacy rules

The agreement settles an investigation into .Net Passport and other on-line authentication systems such as rival Liberty Alliance Project, which is backed by Sun Microsystems, American Express and France Telecom.

According to the European Commission, the software giant has committed itself to implement a "comprehensive package of data protection measures", which will include "a radical change to the information flow" in the existing .Net Passport system.

The main changes are outlined in a report on on-line authentication systems, issued by the Commission's data protection Working Party.

They will give users more control and choice as to which personal data they want to provide, and under what conditions they want the data to be processed by Microsoft or shared with participating sites, such as eBay and on-line music service Pressplay.

Also, Microsoft has agreed to insert a prompt box in the .Net Passport sign-up form, providing guidelines to help users to create secure passwords, and including a link to the European Commission's web site on data protection.

Users will also be offered information about the data protection standards of countries outside the EU, so that they will be able to decide whether they want their data to be transferred to sites operating in such countries.

The Commission said that the changes make it unlikely that the Passport System will breach EU data protection rules, and added that there seems to be no reason to take "any form of sanctions" against Microsoft.

The changes will also apply to the Liberty Alliance Project.

The Commission will continue to monitor Passport, the Liberty Alliance Project and other similar services.

Also, the Commission intends to investigate further the electronic advertisement communication within Microsoft's Hotmail, and the use of identifiers, strings of code unique to each PC, in both Passport and the Liberty Alliance Project.

In August 2002, Microsoft settled a similar investigation into Passport's compliance with US privacy laws, with the Federal Trade Commission (FTC).

The Working Party's statement on .Net Passport is available here

The Working Document on on-line authentication systems can be found here