grabeh

Painful. Stopped reading after first few paragraphs.

Interesting! A rather cynical approach. Although preferable to naivety on my part - I'd expect a court to hold the list exhaustive if challenged.

No, that is true. There are multiple interpretations here. I gave the most optimistic one!

Why would they single out those specific uses then, if you consider express prohibitions are necessary?

Key word is "may" be completely irrelevant! Of course, if you're providing an Excel of customer data, it will be relevant if the user is in the EU. But still, consent won't be relevant in that context.

User content may include personal data but may also not...so in some senses, better to include totality of use cases in a non-data protection related document.

GDPR and indeed any data protection laws may well be completely irrelevant in the context of Microsoft's services. Even if relevant, consent is unlikely to be a relevant as a processing basis under GDPR in the context of usage of MS services. Performance of contract or legitimate interests much more likely to be relevant...

To an extent, think about vested interests here. Mozilla has little to gain by showcasing how clear a rival's new service agreement is!

The AI services section seems pretty clear in terms of limiting the use cases of user content:

"iv. Use of Your Content. As part of providing the AI services, Microsoft will process and store your inputs to the service as well as output from the service, for purposes of monitoring for and preventing abusive or harmful uses or outputs of the service."

Admittedly, I haven't read other parts to understand the full picture though.

Reminds me of the quote: "The death of one man is a tragedy, the death of millions is a statistic"

But a unique identifier doesn't necessarily identify a living person, particularly in isolation. It's just that it's frequently associated with a load of additional information that could eventually be used to identify someone (think advertising cookies when associated with a load of browsing data). So you can't escape from scope by saying you're using a unique ID rather than a name.

IP addresses are slightly different because that address can be used to identify the subscriber in certain cases (who in turn may or may not be an individual).

We do see a few references to cookies in the ePrivacy Directive but absolutely right to drive home the point that it's technology agnostic!

Love the contrast between the title and the text. This isn't even about GDPR, it's about a completely different piece of legislation, the E-Privacy Directive. This is completely agnostic on personal data and so the post is largely flawed.

Even if you're not dealing with any personal data, if you're placing a cookie (or doing anything analogous device fingerprinting etc) you are in scope of the Directive and need consent, irrespective of GDPR.

The new E-Privacy Regulation is looking to implement an exception to consent for analytics but that would have providers like Google Analytics out of scope. Anyway, it's stuck in the mud at present...

I wouldn't trust any article that purports to be about GDPR that uses the term 'PII' a term which itself isn't anywhere to be seen in the regulation!

In reality an IP address is generally not PII, but it may be personal data - the case is Breyer which was decided on pre-GDPR law but still relevant. If you could use reasonable means to identify someone from the IP address then it will be personal data. I don't really agree with the outcome of the case because it implied it was easy to contact an ISP to get them to disclose details of the subscriber information associated with the IP address. In the UK at least it would require cause, and a court order.

Yes, of course. I was just explaining why I thought you'd misinterpreted the original poster's comment.