Well, first of all; you asked for a security researcher who investigated the Windows 10 Operating System regarding this issues. I haven't investigated the operating system, and, I'm not even a certified/professional security researcher.
It'd be hard for someone to actually do this, because Windows is closed source, and 'blackbox-investigation' is hard to do regarding this issue.
However, Google has banned Windows as well; for several reasons of one being security. Windows wasn't secure enough. And no security = no privacy. So if even the security researches at Google dissadvise Windows... That might say something.
What they collect?
To start, Microsoft collects a LOT.
They said themselves that these are some of the few things they collect:
- Search queries to Bing
- Data collected from third parties (non-Microsoft)
- Error reports (Loads of these of course ;) )
- Private communication including e-mail, videochat, and voicechat
- Your personal files
- Requests to the support center
- Which applications you use and when
- Security information
- Skype data (communication, chats,...)
And that's only to mention what Windows (10) collects, you're probably also using other software from Microsoft like e.g Skype or Edge. Also they collect things about you.
Obviously, this data is saved on their servers. The NSA has a program called PRISM which allows them to access all data on all the servers of big companies like Microsoft, Google, Dropbox, Facebook, Apple,...
So because of Microsoft having access to it, the government as well.
They don't use it
Their favorite defense is to say "We don't use the content of e.g your mails to target ads against you" That doesn't mean you don't use it at all, and doesn't take away the problem that you store it!
You can turn it off
Yes, you can try to turn everything off, but yet there are known problems that Microsoft resets these privacy settings with each update. Besides that, if you forget one thing, your whole privacy is still messed.
Compared to other's
Okay, so hopefully you know get how dangerous it is to use Windows for your privacy. But don't do other tech-companies the same? No, not really. Yes Facebook does collect information about you, but it's a social-network, that's the whole point of it. And yes, Google logs search requests; but they don't link them to YOU specifically and it's a search engine after all. Yes Apple does also collect info about you, but again, not in extreme ways like Microsoft, Apple collects a LOT less and won't be spying on you by reading e.g your email. And also, Apple won't randomly give every data to governments, they even fight for your privacy in court.
And than we have GNU... Well ... They actually don't collect anything... GNU is known for it's freedom, privacy,...
So yes, other companies do also collect data, but not such sensitive information as Microsoft, not so personal, not necessary linked to you,...
That doesn't mean, we shouldn't keep requesting more privacy from these companies.
Maximum privacy configuration
And maximum privacy configuration, they still collect a lot like you can read in the following sources. And besides that, even if you put on 'maximum privacy settings' you can't trust it. There are issues that the settings get reset, and than I'm not talking about the Sync-Settings-function. It's extremely hard (impossible) to have maximum-privacy-configuration on Windows (10). It's built in a way, that whatever you do, they DO collect data.
And besides that, it's closed source. The things I listed are those that they have told themselves. Who knows what other things they collect without telling us? Your 'privacy-configuration' doesn't protect against those things.
And after all, it doesn't mean that if theoretically you're able to disable Windows 10 spying on you, the other Microsoft services ain't. They still give e.g the NSA access to services like e.g Onedrive. So you also mayn't use any Microsoft service to keep your privacy. And what's the point of using Windows than after all? And not to mention that on Windows you sometimes even use Microsoft services without knowing.
A few sources. First of all, the one of GNU is IMHO the best.
To finish, I hope it's clear, that when you care about your personal privacy - like all human beings do, even those who say they don't - Microsoft products ain't the best to use.
The things I listed are those that they have told themselves. Who knows what other things they collect without telling us?
I hope it's clear, that even with those max-privacy-settings, you can't trust such a company which tries to break your privacy in any way.
And to mention, I'm not the only one warning you. Germany has warned it's civilians about Windows, because it was insecure. Snowden says Microsoft can't be trusted. Google has banned Windows for it's employees for several reasons.