The agreement settles an investigation into .Net Passport and
other on-line authentication systems such as rival Liberty Alliance
Project, which is backed by Sun Microsystems, American Express and
France Telecom.
According to the European Commission, the software giant has
committed itself to implement a "comprehensive package of data
protection measures", which will include "a radical change to the
information flow" in the existing .Net Passport system.
The main changes are outlined in a report on on-line
authentication systems, issued by the Commission's data protection
Working Party.
They will give users more control and choice as to which
personal data they want to provide, and under what conditions they
want the data to be processed by Microsoft or shared with
participating sites, such as eBay and on-line music service
Pressplay.
Also, Microsoft has agreed to insert a prompt box in the .Net
Passport sign-up form, providing guidelines to help users to create
secure passwords, and including a link to the European Commission's
web site on data protection.
Users will also be offered information about the data protection
standards of countries outside the EU, so that they will be able to
decide whether they want their data to be transferred to sites
operating in such countries.
The Commission said that the changes make it unlikely that the
Passport System will breach EU data protection rules, and added
that there seems to be no reason to take "any form of sanctions"
against Microsoft.
The changes will also apply to the Liberty Alliance Project.
The Commission will continue to monitor Passport, the Liberty
Alliance Project and other similar services.
Also, the Commission intends to investigate further the
electronic advertisement communication within Microsoft's Hotmail,
and the use of identifiers, strings of code unique to each PC, in
both Passport and the Liberty Alliance Project.
In August 2002, Microsoft settled a similar investigation into
Passport's compliance with US privacy laws, with the Federal Trade
Commission (FTC).
The Working Party's statement on .Net Passport is available
here
The Working Document on on-line authentication systems can be
found
here
