Privacy campaigner Dr Kris Shrishak – who previously called Recall a “privacy nightmare” – said the opt-in mechanism is “an improvement”, but felt it could still be misused.
“Information about other people, who cannot consent, will be captured and processed through Recall,” he said.
The feature is able to save images of your emails and messaging apps such as WhatsApp – meaning pictures and messages from others will be saved.
This is no different to a user taking a screenshot themselves when they receive a message.
“Think of disappearing messages on Signal that is stored on Recall forever,” he said.
And he said he was concerned that malicious actors could exploit the images saved by Recall if they gained login access to a device.
Microsoft said Recall, external “does not share snapshots or associated data with Microsoft or third parties” and information is not shared between different users.
“Recall requires you to confirm your identity before it launches and before you can access your snapshots,” it said.
And it confirmed pictures taken by Recall are stored locally on your computer.
Users can choose which apps are used by the feature, and private mode on some browsers will not be snapshotted.
Microsoft also says the user can delete screenshots which have been captured.
The UK’s data watchdog said it has “continued to engage with Microsoft on this matter”.
The Information Commissioner’s Office (ICO) said it had “expectations that user transparency was improved and personal data was not used for purposes other than those for which it was originally collected”.
“The ICO does not grant prior approval for any products or services.
“Organisations are accountable for demonstrating their ongoing compliance with data protection law and we will act should they fail to safeguard people’s data protection rights”.
