ICO looking into Microsoft’s new AI-feature Recall

The Information Commissioner’s Office (ICO) says it contacted Microsoft over a new feature called Recall, that takes a screenshot of your computer every few seconds.

Earlier this week Microsoft announced a series of PCs with Copilot+, a chatbot that utilizes generative artificial intelligence (GenAI) to help users to improve their productivity.

One of its functions is called Recall, which takes screenshots of a user’s activities on his computer. The screenshots are encrypted and stored locally. Using a timeline, users can review these screenshots and search them for specific files, emails, photos and browsing history. Once a user finds the snapshot he was looking for in Recall, it will be analyzed and offer him options to interact.

Experts concerned about ‘privacy nightmare’

The British data and privacy watchdog is worried that this state-of-the-art AI-feature is a potential privacy nightmare. “We are making enquiries with Microsoft to understand the safeguards in place to protect user privacy”, an ICO spokesperson told the BBC.

Dr. Kris Shrishak, an advisor on AI and privacy, agrees. “The mere fact that screenshots will be taken during use of the device could have a chilling effect on people. People might avoid visiting certain websites and accessing documents, especially confidential documents, when Microsoft is taking screenshots every few seconds”, he says.

Daniel Tozer, data and privacy expert at Keystone Law, emphasizes that Microsoft will need a lawful basis to record and re-display the user’s personal information. “There may well be information on the screen which is proprietary or confidential to the user’s employer: will the business be happy for Microsoft to be recording this?. Are they going to be given the choice as to whether to consent to that? User and access controls will be a key issue on which Microsoft will doubtless be focussing”, he tells the BBC.

Microsoft: ‘We are committed to privacy’

Microsoft claims privacy is built into Recall’s design from the ground up. Users who activate their Copilot+ device for the first time, will see an icon that opens Recall’s settings. There they can choose what screenshots Recall collects and stores on their computer.

“You can limit which snapshots Recall collects; for example, you can select specific apps or websites visited in a supported browser to filter out of your snapshots. In addition, you can pause snapshots on demand from the Recall icon in the system tray, clear some or all snapshots that have been stored, or delete all the snapshots from your device”, Microsoft says on its website.

In a statement to the BBC, Microsoft points out that Recall is an “optional experience” and it is committed to privacy. “Recall data is only stored locally and not accessed by Microsoft or anyone who does not have device access”, a spokesperson says.

Finally, the Redmond-based technology company reassures users by saying that hackers would have to gain physical access to a user’s device, unlock it and sign in before they could access to saved screenshots.