6 ms·

Couple of video game services are also shutting down due to GDPR Super Monday Night Combat wich was developed in the US by Uber Entertainment [1] Ragnarok Onl

by bdz 8y ago

Couple of video game services are also shutting down due to GDPR Super Monday Night Combat wich was developed in the US by Uber Entertainment [1] Ragnarok Online terminates the access from Europe. They are in Korea. [2] 1 https://steamcommunity.com/games/104700/announcements/detail/1661142811548355195 https://steamcommunity.com/games/104700/announcements/detail... 2 http://blog.warpportal.com/?p=10892 http://blog.warpportal.com/?p=10892

codedokode 8y ago
I don't really understand why. They just should not collect real names or any other personal information and then they would be fine.
- lmkg 8y ago
  Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.
  - actuator 8y ago
    Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.
    - izacus 8y ago
      You've been talking to a bag lawyer then.
    - codedokode 8y ago
      > if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.
  - codedokode 8y ago
    Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number. Quote [1]: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- landryraccoon 8y ago
  IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.
  - ec109685 8y ago
    Ask for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.
    - landryraccoon 8y ago
      So at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?
      - lagadu 8y ago
        Yes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.
        codedokode 8y ago
        Please see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318 https://news.ycombinator.com/item?id=16964318
      - codedokode 8y ago
        The best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.
  - codedokode 8y ago
    You don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address. I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration. Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.
itg 8y ago
I have a feeling a number of more services are going to announce they are cutting of access to the EU as we get closer to the deadline.
- graeme 8y ago
  I run a site targeting north americans. I get a tiny number of european visitors. Should I be cutting them off? It’s not a market I target in any way.
  - actuator 8y ago
    You should anyway implement some basic stuff related to GDPR as that is good for other users as well. But it would make sense for you to cut off the access to EU citizens as full compliance is definitely a big pain and probably not worth it for just few users.
    - graeme 8y ago
      So just block all visits from IP addresses from EU countries? Or block account creation/purchases from those countries?
  - tscs37 8y ago
    If your contact with EU customers is only accidental/incidental then I don't believe you're under the GDPR cover. [ https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ ]
    - jimktrains2 8y ago
      That's not actually law though, only commentary. The law says anyone "in the Union" is covered, with no cut out for targeting.
      - tscs37 8y ago
        https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ The actual law is here and it applies when you offer services or goods to people in the EU or if you monitor their behavior in the EU. The recitals are a pretty good commentary to clear up the law, the same recitals will be used by regulatory bodies and judges later on, as a guideline.
orf 8y ago
Super Monday Night Combat has very, very few plays on steam[1]. Likely was not worth any development time to fix it up. 1. https://steamdb.info/app/104700/graphs/ https://steamdb.info/app/104700/graphs/
- ehsankia 8y ago
  Sure, but isn't that a huge chunk of the web. Full of small games, services and tools that are only used by a handful of people, but those people enjoyed that thing. Just because it's niche doesn't mean it's useless. Just because Facebook has 10 orders of magnitude more users doesn't mean it's 10 orders of magnitude more useful. There are plenty of devs out there who were running things probably at a loss, but for the sake of their community and users. Sure a few bug fixes here and there was a pain, but it was so small that it was worth it to make a couple people happy. Now they have one big reason to not keep it up.
  - Faark 8y ago
    A house seems like a good analogy... if the owner isn't willing to do maintenance, he'll probably fence it of to avoid fines and liability. A local group might loose their meeting spot, but we still usually consider it worth it. Our dependency on services that will go away is a problem, but I'd prefer we'd search for different ways to preserve software once unmaintained. Government requires authors to send a few copies of books&newspapers to libraries... maybe something like that with source code?

by bdz 8y ago

codedokode 8y ago

I don't really understand why. They just should not collect real names or any other personal information and then they would be fine.

lmkg 8y ago
Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.
- actuator 8y ago
  Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.
  - izacus 8y ago
    You've been talking to a bag lawyer then.
  - codedokode 8y ago
    > if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.
- codedokode 8y ago
  Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number. Quote [1]: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
landryraccoon 8y ago
IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.
- ec109685 8y ago
  Ask for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.
  - landryraccoon 8y ago
    So at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?
    - lagadu 8y ago
      Yes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.
      - codedokode 8y ago
        Please see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318 https://news.ycombinator.com/item?id=16964318
    - codedokode 8y ago
      The best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.
- codedokode 8y ago
  You don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address. I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration. Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.

itg 8y ago

I have a feeling a number of more services are going to announce they are cutting of access to the EU as we get closer to the deadline.

graeme 8y ago
I run a site targeting north americans. I get a tiny number of european visitors. Should I be cutting them off? It’s not a market I target in any way.
- actuator 8y ago
  You should anyway implement some basic stuff related to GDPR as that is good for other users as well. But it would make sense for you to cut off the access to EU citizens as full compliance is definitely a big pain and probably not worth it for just few users.
  - graeme 8y ago
    So just block all visits from IP addresses from EU countries? Or block account creation/purchases from those countries?
- tscs37 8y ago
  If your contact with EU customers is only accidental/incidental then I don't believe you're under the GDPR cover. [ https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ ]
  - jimktrains2 8y ago
    That's not actually law though, only commentary. The law says anyone "in the Union" is covered, with no cut out for targeting.
    - tscs37 8y ago
      https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ The actual law is here and it applies when you offer services or goods to people in the EU or if you monitor their behavior in the EU. The recitals are a pretty good commentary to clear up the law, the same recitals will be used by regulatory bodies and judges later on, as a guideline.

orf 8y ago

Super Monday Night Combat has very, very few plays on steam[1]. Likely was not worth any development time to fix it up. 1. https://steamdb.info/app/104700/graphs/ https://steamdb.info/app/104700/graphs/

ehsankia 8y ago
Sure, but isn't that a huge chunk of the web. Full of small games, services and tools that are only used by a handful of people, but those people enjoyed that thing. Just because it's niche doesn't mean it's useless. Just because Facebook has 10 orders of magnitude more users doesn't mean it's 10 orders of magnitude more useful. There are plenty of devs out there who were running things probably at a loss, but for the sake of their community and users. Sure a few bug fixes here and there was a pain, but it was so small that it was worth it to make a couple people happy. Now they have one big reason to not keep it up.
- Faark 8y ago
  A house seems like a good analogy... if the owner isn't willing to do maintenance, he'll probably fence it of to avoid fines and liability. A local group might loose their meeting spot, but we still usually consider it worth it. Our dependency on services that will go away is a problem, but I'd prefer we'd search for different ways to preserve software once unmaintained. Government requires authors to send a few copies of books&newspapers to libraries... maybe something like that with source code?