6 ms·

I found one of the toughest things about GDPR is determining what is or isn't personal data, when dealing with less common types of data. R6DB for example, a v

I found one of the toughest things about GDPR is determining what is or isn't personal data, when dealing with less common types of data. R6DB for example, a video game stats website, decided to shut down [1] due to unknown territory over whether or not player account IDs and statistics they were scraping from official APIs, are "personal data". (They have now reversed their decision to shut down I believe) As soon as you leave the classic Website tracking/Product usage categories, the definitions get murkier. If I shoot a GDPR data request to eg. Blizzard, do they have to give me any game/stats history they have on me? [1] https://medium.com/@r6db/r6db-is-shutting-down-db1b59b031ac https://medium.com/@r6db/r6db-is-shutting-down-db1b59b031ac

TheAceOfHearts 8y ago
What's the general consensus on the last question you raised? Would Blizzard be expected to provide that info? What about "hidden" values like your MMR?
- scrollaway 8y ago
  I don't know actually. And lawyers I asked give inconsistent answers. I was planning to make one to Blizzard come 25th just to figure out what their process is. The toughest part is, the regulation talks about the definition of personal data here: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32016R0679 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A... ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; The keyword people like to use is "in context", where data is personally-identifiable if it can be used to identify you in a certain context. This... covers almost everything with a unique=TRUE in a database, and any ranking-type systems such as the excellent example of MMR you gave earlier.
stingraycharles 8y ago
> As soon as you leave the classic Website tracking/Product usage categories, the definitions get murkier. If I shoot a GDPR data request to eg. Blizzard, do they have to give me any game/stats history they have on me? If they are able to corelate that data back to your account, and you account contains information that allows them to link it back to individual you, then absolutely. If they keep that information completely anonimized and have properly siloed that data, then they would not. A good rule of thumb is that if they would be technically able to comply with the request, then they have to comply. Disclaimer: IANAL but CTO of analytics startup in EU.
- scrollaway 8y ago
  What if you don't have the original account's information? Let's say there's an api on https://example.com/api/v1/users https://example.com/api/v1/users which is world-readable and contains two values: user id and user rank. You scrape all this and put it in your database. I come to you and say "I'm user id 1234 and I want you to delete me from your db". Is this a legitimate request? This is the situation R6DB is in. Furthermore, in such situations there's a case to be made that this information cannot be deleted if the whole point of the site is to provide global rankings.
  - stingraycharles 8y ago
    The question is, who is the owner of this data? Is it Blizzard or is it R6DB? I would say, the burden is upon Blizzard, so they would be the designated Controller of the data. R6DB would then need to sign a Processor agreement with Blizzard, of which one requirement is to delete certain data upon Blizzard’s request. R6DB could also position themselves as the controller of this data, but that would put quite a bit of the burden on them. But this is my interpretation of the situation. Would probably need a more in-depth discussion with both parties to figure out what the intentions are.
    - wasyl 8y ago
      Could Blizzard deny signing the Processor agreement, thus effectively limiting the access to their, otherwise public, API?
throwaway13456 8y ago
I'm surprised no one has brought this up (yet). GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability. As one other HNer previously mentioned, the cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance. Don't worry about false equivalence that many will raise "So, you don't care about our data HUH?". The intentions behind GDPR may be good. But, the roadmap seems completely stupid. Many think blocking EU customers is an arrogant move. No, it's not. Not everyone has the finance and time to comply with GDPR. A typical re-implementation of our web application will cost us weeks if not months, for example. That could be time spent building features customers want, not fighting some vague elitist law (comply with us or else you're doomed!). If enough business owners block access to EU customers, then, EU will lose a lot of business and that will trigger them to hopefully do something about the vagueness of GDPR. I don't even live in EU, for instance, yet this re-implementation will cost me tens of thousands of dollars (translating my time) that the EU isn't going to pay me for their vagueness. I've had enough of GDPR. I know many EU HNers will not agree, but please consider putting yourself in a solo founder's shoes.
- fcarraldo 8y ago
  If you are a solo founder without any business presence in the EU, or clients in the EU, you have nothing to worry about. Blocking EU site visitors is unnecessary, and GDPR covers this in clear language. What about reimplementing will cost you tens of thousands? That implies you either have a heavy use of personal data without a legitimate interest or have significantly misunderstood the requirements laid out in GDPR.
  - tripletao 8y ago
    Let's say I operate a website where you can sign up with an email address, and I'll send you recipes. The recipes call out specific brands of ingredients. The vendors who sell those brands pay me for this service. I and my server are in the USA. Additionally: 1. My food vendors operate (a) all only in the EU; or (b) mostly worldwide, but one operates only in the EU; or (c) all worldwide; or (d) all only in the USA, but an independent third party imports many of their products into the EU. 2. My recipes are for (a) only French food; or (b) all kinds of food. 3. My email includes descriptions of the restaurants that originated the recipes. These restaurants are (a) all in France; or (b) about half in France, half in New Orleans; or (c) all in New Orleans. (New Orleans is an American city with strong French influence on its culture, and a francophone minority.) 4. The recipes are distributed in (a) French only; or (b) English and French; or (c) English only. 5. I advertise my site (a) with a run-of-network ad that shows mostly in the USA, but also on a French newspaper; (b) on a small blog whose American operator doesn't track its audience, but that I've heard is popular in France; (c) not at all, relying on word of mouth. So I've set out 4×2×3×3×3 = 216 cases. In which of them am I subject to the GDPR? What factors or combinations of factors are determining? If I asked this question of two lawyers, how closely would you expect their answers to agree? What confidence would they express that their answers would agree with the regulator? I think the people who think GDPR compliance is easy are saying to themselves, "If I behave in accordance with these general principles as I understand them, then the regulator will see me for the good person that I am and I'll be okay". That may be true, but it's not law.
archgoon 8y ago
In keeping with game metrics being harder to come by, back in April, Steam changed it's terms for it's API https://esportsobserver.com/valve-increases-steam-privacy/ https://esportsobserver.com/valve-increases-steam-privacy/ https://steamcommunity.com/dev/apiterms https://steamcommunity.com/dev/apiterms Note the "You will only retrieve Steam Data about a Steam end user as requested by the end user" clause. Basically kills any site that had been collecting data for statistics.* Now this might have been simply due to the Cambridge Analytica backlash, I'd doubt they'd say one way or another. It does seem that datasets like BYU https://steam.internet.byu.edu/ https://steam.internet.byu.edu/ will be harder to collect in future. Although the GDPR does carve out exceptions for research, if I were a company, I'd be extremely hesitant to work with anyone coming by and saying "Hey, can I have that dataset which you locked down due to GDPR concerns for my 'research'?". It's sad really, one of the benefits of the Internet was supposed to be it's openness and transparency. Ah well, it was a nice dream for a while. * I've been trying to confirm that that is the new clause that has been causing problems, but unfortunately, I can't find a historical revision of the Steam API Terms of Use. :( I can only point to articles that say that services are shutting down due to API changes. If anyone can expand on this (or contradict it), I'd be happy :).

TheAceOfHearts 8y ago

What's the general consensus on the last question you raised? Would Blizzard be expected to provide that info? What about "hidden" values like your MMR?

scrollaway 8y ago
I don't know actually. And lawyers I asked give inconsistent answers. I was planning to make one to Blizzard come 25th just to figure out what their process is. The toughest part is, the regulation talks about the definition of personal data here: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32016R0679 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A... ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; The keyword people like to use is "in context", where data is personally-identifiable if it can be used to identify you in a certain context. This... covers almost everything with a unique=TRUE in a database, and any ranking-type systems such as the excellent example of MMR you gave earlier.

stingraycharles 8y ago

> As soon as you leave the classic Website tracking/Product usage categories, the definitions get murkier. If I shoot a GDPR data request to eg. Blizzard, do they have to give me any game/stats history they have on me? If they are able to corelate that data back to your account, and you account contains information that allows them to link it back to individual you, then absolutely. If they keep that information completely anonimized and have properly siloed that data, then they would not. A good rule of thumb is that if they would be technically able to comply with the request, then they have to comply. Disclaimer: IANAL but CTO of analytics startup in EU.

scrollaway 8y ago
What if you don't have the original account's information? Let's say there's an api on https://example.com/api/v1/users https://example.com/api/v1/users which is world-readable and contains two values: user id and user rank. You scrape all this and put it in your database. I come to you and say "I'm user id 1234 and I want you to delete me from your db". Is this a legitimate request? This is the situation R6DB is in. Furthermore, in such situations there's a case to be made that this information cannot be deleted if the whole point of the site is to provide global rankings.
- stingraycharles 8y ago
  The question is, who is the owner of this data? Is it Blizzard or is it R6DB? I would say, the burden is upon Blizzard, so they would be the designated Controller of the data. R6DB would then need to sign a Processor agreement with Blizzard, of which one requirement is to delete certain data upon Blizzard’s request. R6DB could also position themselves as the controller of this data, but that would put quite a bit of the burden on them. But this is my interpretation of the situation. Would probably need a more in-depth discussion with both parties to figure out what the intentions are.
  - wasyl 8y ago
    Could Blizzard deny signing the Processor agreement, thus effectively limiting the access to their, otherwise public, API?

throwaway13456 8y ago

I'm surprised no one has brought this up (yet). GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability. As one other HNer previously mentioned, the cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance. Don't worry about false equivalence that many will raise "So, you don't care about our data HUH?". The intentions behind GDPR may be good. But, the roadmap seems completely stupid. Many think blocking EU customers is an arrogant move. No, it's not. Not everyone has the finance and time to comply with GDPR. A typical re-implementation of our web application will cost us weeks if not months, for example. That could be time spent building features customers want, not fighting some vague elitist law (comply with us or else you're doomed!). If enough business owners block access to EU customers, then, EU will lose a lot of business and that will trigger them to hopefully do something about the vagueness of GDPR. I don't even live in EU, for instance, yet this re-implementation will cost me tens of thousands of dollars (translating my time) that the EU isn't going to pay me for their vagueness. I've had enough of GDPR. I know many EU HNers will not agree, but please consider putting yourself in a solo founder's shoes.

fcarraldo 8y ago
If you are a solo founder without any business presence in the EU, or clients in the EU, you have nothing to worry about. Blocking EU site visitors is unnecessary, and GDPR covers this in clear language. What about reimplementing will cost you tens of thousands? That implies you either have a heavy use of personal data without a legitimate interest or have significantly misunderstood the requirements laid out in GDPR.
- tripletao 8y ago
  Let's say I operate a website where you can sign up with an email address, and I'll send you recipes. The recipes call out specific brands of ingredients. The vendors who sell those brands pay me for this service. I and my server are in the USA. Additionally: 1. My food vendors operate (a) all only in the EU; or (b) mostly worldwide, but one operates only in the EU; or (c) all worldwide; or (d) all only in the USA, but an independent third party imports many of their products into the EU. 2. My recipes are for (a) only French food; or (b) all kinds of food. 3. My email includes descriptions of the restaurants that originated the recipes. These restaurants are (a) all in France; or (b) about half in France, half in New Orleans; or (c) all in New Orleans. (New Orleans is an American city with strong French influence on its culture, and a francophone minority.) 4. The recipes are distributed in (a) French only; or (b) English and French; or (c) English only. 5. I advertise my site (a) with a run-of-network ad that shows mostly in the USA, but also on a French newspaper; (b) on a small blog whose American operator doesn't track its audience, but that I've heard is popular in France; (c) not at all, relying on word of mouth. So I've set out 4×2×3×3×3 = 216 cases. In which of them am I subject to the GDPR? What factors or combinations of factors are determining? If I asked this question of two lawyers, how closely would you expect their answers to agree? What confidence would they express that their answers would agree with the regulator? I think the people who think GDPR compliance is easy are saying to themselves, "If I behave in accordance with these general principles as I understand them, then the regulator will see me for the good person that I am and I'll be okay". That may be true, but it's not law.

archgoon 8y ago

In keeping with game metrics being harder to come by, back in April, Steam changed it's terms for it's API https://esportsobserver.com/valve-increases-steam-privacy/ https://esportsobserver.com/valve-increases-steam-privacy/ https://steamcommunity.com/dev/apiterms https://steamcommunity.com/dev/apiterms Note the "You will only retrieve Steam Data about a Steam end user as requested by the end user" clause. Basically kills any site that had been collecting data for statistics.* Now this might have been simply due to the Cambridge Analytica backlash, I'd doubt they'd say one way or another. It does seem that datasets like BYU https://steam.internet.byu.edu/ https://steam.internet.byu.edu/ will be harder to collect in future. Although the GDPR does carve out exceptions for research, if I were a company, I'd be extremely hesitant to work with anyone coming by and saying "Hey, can I have that dataset which you locked down due to GDPR concerns for my 'research'?". It's sad really, one of the benefits of the Internet was supposed to be it's openness and transparency. Ah well, it was a nice dream for a while. * I've been trying to confirm that that is the new clause that has been causing problems, but unfortunately, I can't find a historical revision of the Steam API Terms of Use. :( I can only point to articles that say that services are shutting down due to API changes. If anyone can expand on this (or contradict it), I'd be happy :).