{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"8cfb1abd-46f1-4f71-9629-7f477c961714","screeningDate":"2026-11-10T21:41:30.174Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"f7958007-438b-4240-ba2d-2a48dbb9f661","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.microsoft.com/en-gb/privacy/privacystatement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-10T21:41:30.142Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"d07ae52134ab19eff68fa322c7d3f8e07e051f8000455c5e793590653cb3576c","capturedAt":"2026-09-23T17:16:57.194Z"},"current":{"version":4,"sha256":"474eb0f51b19a8f53a7982a908170afa7738047c70e325ea59425635a7496efb","capturedAt":"2026-11-10T21:41:30.142Z"}},"analysisLineage":{"status":"verified","requestSha256":"5b9ad6e34178997b5d77c0bdc3b10622de77f86d516ae297f02b005d27f59c78","responseSha256":"3742af5d241d0855682f9cc098538a58aaba3f6e93c370994e0739fd7d6fa258","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"d07ae52134ab19eff68fa322c7d3f8e07e051f8000455c5e793590653cb3576c","charLength":217462,"byteLength":218059,"rangeUnit":"utf16-code-unit","includedRanges":[[0,217462]],"excludedRanges":[]},"new":{"sha256":"474eb0f51b19a8f53a7982a908170afa7738047c70e325ea59425635a7496efb","charLength":215566,"byteLength":216133,"rangeUnit":"utf16-code-unit","includedRanges":[[0,215566]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-09-23T17:16:57.194Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.microsoft.com/en-gb/privacy/privacystatement","requestedUrl":"https://www.microsoft.com/en-gb/privacy/privacystatement","finalUrl":"https://www.microsoft.com/en-gb/privacy/privacystatement","capturedAt":"2026-11-10T21:41:30.142Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The new Windows Recall feature captures all on-screen activity via snapshots, stored locally and opt-in, but requires careful user management.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"be2f44f8-2b14-4c73-bfa4-15d44d157c04","overallRisk":"High","overallScore":7,"screeningDate":"2026-09-23T17:16:57.208Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"alert","textEn":"Windows Recall captures extensive screen activity via snapshots.","textIt":"Windows Recall cattura ampia attività dello schermo tramite snapshot.","deltaScore":2,"evidenceQuote":"Recall is a Windows feature available exclusively on Copilot+ PCs that helps users find previously viewed content using remembered text or visual clues. To use Recall, users must opt-in to save snapshots — screen images with metadata like a","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Expanded third-party data acquisition for product research and development.","textIt":"Acquisizione estesa di dati di terze parti per ricerca e sviluppo prodotti.","deltaScore":1,"evidenceQuote":"Companies that provide workplace and productivity data for research, development, and improvement of our products and services.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Sensitive content filter in Windows Recall can be disabled by users.","textIt":"Il filtro contenuti sensibili in Windows Recall può essere disabilitato.","deltaScore":1,"evidenceQuote":"Recall also has a Sensitive Content filter that is on by default to help prevent the retention of information that might be more delicate in nature (e.g., credit card numbers, state issued ID numbers, etc.). Users can turn this filter off i","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Windows Recall captures screen snapshots of all PC activity, stored locally and opt-in, raising privacy concerns.","textIt":"Windows Recall cattura snapshot dello schermo di tutta l'attività del PC, archiviati localmente e opt-in, sollevando preoccupazioni sulla privacy.","sentiment":"negative"},{"textEn":"Microsoft now collects workplace and productivity data from new third-party sources for R&D.","textIt":"Microsoft ora raccoglie dati di produttività e sul posto di lavoro da nuove fonti terze per R&S.","sentiment":"negative"},{"textEn":"Clarified controls for personalized offers and linked mobile experiences enhance user choice.","textIt":"Controlli più chiari per offerte personalizzate ed esperienze mobili collegate migliorano la scelta dell'utente.","sentiment":"positive"},{"textEn":"Recall includes a sensitive content filter, on by default, but users can disable it.","textIt":"Recall include un filtro per contenuti sensibili, attivo per impostazione predefinita, ma gli utenti possono disabilitarlo.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Enterprises deploying Copilot+ PCs must assess Windows Recall's compliance with GDPR and the upcoming AI Act, especially for employee data. Data processing agreements are crucial.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Windows Recall's extensive data capture, even local, raises GDPR concerns regarding data minimization and purpose limitation. Cross-border data transfers are controlled by DPF and SCCs.","complianceNoteEn":"GDPR Art. 5, 6, 32"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Global enterprises must establish clear policies for Windows Recall and other AI features to ensure consistent data handling and compliance across diverse regulatory landscapes.","complianceNoteEn":"Global Data Governance"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The new AI features, particularly Recall, introduce a global concern for pervasive data capture, requiring users worldwide to be vigilant about their privacy settings.","complianceNoteEn":"Data Minimization Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must evaluate Windows Recall's impact on data governance and compliance with US state laws, especially for employee monitoring and data security.","complianceNoteEn":"CCPA/CPRA, Data Security Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Windows Recall's snapshotting could capture sensitive personal information, impacting privacy rights under CCPA/CPRA and new state privacy laws. Users must manage opt-out settings.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/8cfb1abd-46f1-4f71-9629-7f477c961714","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"de714583ebdf85818a2ae1e0986441cf98ad85d8bad851d9dcf5e816098edcb8"}