13 ms·

An Eve Online corporation has been hit with a GDPR request from an ex-member

122 points by dlgeek 8y ago

taspeotis 8y ago
The subtitle is "[d]isgruntled ex-guildie effectively invents new way to grief in EVE" but it sounds like the request in question was sent to a website outside of EVE. This could happen with other games or, you know, websites unrelated to games at all...
- tapland 8y ago
  Corp (guild) forums are an important part of EVE and preferred over posting news and operations on Discord for example since you can set it up to serve unique texts to each user, making it easier to find them if they leak to other corps, and hidden changes in the website that will give it away in case the corp news leak by screenshot.
  - LeftTurnSignal 8y ago
    /sidenote I've tried playing Eve quite a few times, and it just isn't my thing. Reading about Eve, however, has always been an absolute joy. Even comments like this (which makes complete sense in hindsight) shows me how much (for better or worse) people put into a "sandbox" or game like Eve. I swear some of the stories are much better than the stuff they toss in theatres.
- ng12 8y ago
  Too bad geocities is gone, I could've GDPR'd every guestbook I'd ever signed.
ThePhysicist 8y ago
I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. If there is data left just collect it, send it to the person and delete it afterwards (surely there’s a way to search posts by author in their forum software). I can understand that such requests are difficult to answer for companies that run many different IT services, but this case seems pretty trivial to me.
- trothamel 8y ago
  It seems like the AggregateIQ case shows the problem with this - by obeying the request, they admit that the EU has jurisdiction over them. That's probably the wrong thing to do when they have no connection to the EU, other than people from the EU choosing to connect to a server hosted elsewhere. It's probably the same reason why Hacker News does nothing to comply with the GDPR.
  - nindalf 8y ago
    Has someone associated with HN explicitly said anything about complying with GDPR? If yes, do you have a link?
  - doppel 8y ago
    Jurisdiction is a tricky concept in cases like these where we are dealing with digital content. AggregateIQ could have ignored the GDPR-request, ignored any rulings and keep chugging along as long as they stuck to Canada (assuming Canada was not going to side with the EU). In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. Same as if some banana republic dictator declares you persona non grata - if you never intend to visit and otherwise have no business in that country, who cares? The difference is that the EU is not a banana republic (opinions may vary), and so many choose to respect and accept this their judgement in cases like this to stay on good terms.
    - treis 8y ago
      >In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. That's not entirely true. You can go to a Canadian court to enforce an EU judgement against assets in Canada. So for example, if you cause a car accident in Germany, the plaintiff can sue you in Germany to get a judgement and then sue you in Canada to enforce that judgement. How Canadian (or US or otherwise) courts will treat a GDPR judgement remains to be seen, but it's not a guarantee that it won't be enforced.
  - adventured 8y ago
anonymfus 8y ago
Why they don't want to answer request? It's still would be a nice thing to do ever if not required by law.
- ocdtrekkie 8y ago
  Indeed. This is a protection we should all really have, and there's no real reason you should be unwilling to tell a person what information you are storing on them.
- wvenable 8y ago
  They could probably spend all day every day answering these requests. How do they even know it's valid? Could I just request all your information?
  - peteretep 8y ago
    > How do they even know it's valid? They can require you to prove this before processing your application, under GDPR.
dmitriid 8y ago
> the corp in question was blindsided by the request just as many real-life businesses were when the law came into effect last year “blindsided” bullcrap again
- jplayer01 8y ago
  Probably because it's a single guy running a small forum for a 70 man guild in a spaceship MMO. Why would anybody in that situation expect to get a GDPR request? Especially when it's clear the person in question is just bullying the forum owner.
  - Symbiote 8y ago
    The greatest GDPR risk to my employer is from former employees wanting to cause hassle. We have very little user data, just an email address and a name, and no tracking. Of course we have much more information about staff. That's going to be a common situation, especially for non-tech or offline businesses.
- cavanasm 8y ago
  Keep in mind "corp" is just a guild in this particular video game. Likely they just have a free/low cost forum page with some minimal aethetic modifications.
fhrow4484 8y ago
What's interesting, and pointed out by a Reddit comment: https://www.reddit.com/r/legaladvice/comments/acsdf3/comment/eddcc3u https://www.reddit.com/r/legaladvice/comments/acsdf3/comment... There's no way to identify that the person making the request is who he/she says he/she is. The irony is that for services like Facebook, Facebook could ask for a scan of your id/passport to confirm it's you, (and would it also have to keep that scan saved somewhere in case it later needs to prove that it "authenticated" the gdpr request correctly?) But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?!
- a_imho 8y ago
  The authentication scheme should be the same that is used for signup e.g. email.
- icebraining 8y ago
  Doesn't Even have some sort of user profile? Bob could update it saying "yes, I made a GDPR request to X on date Y".
  - fhrow4484 8y ago
    That's true, here it could be sufficient.
- entity345 8y ago
  This right of access to your personal data has existed in the EU for 20 years. This is not new. And yes, there is a need to verify IDs. Most companies don't have online forms for this so the way has always been to send an email and enquire, or to write on paper with a copy of a valid ID. This is not new. The question is whether data submitted under a pseudonym (e.g. forum activity) are actually personal information by law since the individual cannot be identified.
- geocar 8y ago
  > But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?! That's one way to do it. Another way would be to ask them to log in and set some preference (change their info field or name to "DELETE ME") or something like that.
zizee 8y ago
As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills. This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests. They will be forced to either shutdown, or be in breach of law. Perhaps some people will say "good, if you cannot run a site conforming to all laws of the land then you should shutdown". If you think that, consider this: as these laws pile up it will get more and more difficult to operate, leaving only the very tech/law savvy, and big business. This is not the democratization of information that the web promised oh so many years ago. On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? [edits: punctuation/grammar]
- ThePhysicist 8y ago
  I think most of the larger forum software providers have implemented functions to comply with GDPR (i.e. delete, restrict and extract user data). Concerning backups: If you have a short turnaround time (e.g. 14 days) it shouldn’t be a problem, the legislation acknowledges the fact that deleting data and ensuring data integrity (also in accordance with GDPR) are sometimes mutually exclusive from a practical point of view. You need to make sure that deletion requests also get honored when restoring from backup though, so ideally you want to store the requests in a third system and check them when you restore backups. Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO.
  - zizee 8y ago
    Thank you for your thoughtful response and information. I need time to digest this information to see how it affects my opinions, which might take longer than the half life of this discussion, so my apologies in advance for probably not responding :-)
  - 8y ago
menzoic 8y ago
How would this work if the data was stored on an immutable blockchain?
- mailbag 8y ago
  crypto-shredding is arguably an option https://en.wikipedia.org/wiki/Crypto-shredding https://en.wikipedia.org/wiki/Crypto-shredding
- M2Ys4U 8y ago
  Storing it on an immutable blockchain probably violates the GDPR in the first place, at least if you have no method to render the data unreadable. To wit, Article 25 of the GDPR ("Data protection by design and by default"): > 1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. > 2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.
sharpshadow 8y ago
Guys think about the ranking lists.. you want your data deleted and you kind of also have to delete all related data to that account like everything. I can imagine already some people hacking top 100 ranking list accounts and deleting them to remove them from the ranking to get elevated themselves.
- zaarn 8y ago
  You don't have to delete everything. In case of ranking lists, it would sufficient to tombstone the data; replace the name with "[deleted account]" and link it to a page that explains the account data was requested to be deleted. GDPR Deletion Requests only cover data for which's processing you either used consent, used the legitimate interest clause or is part of a protected category (sexuality, religion, etc.). Some parts of "legitimate interest" that continue to be legitimate interest (like for example, billing information for tax and fraud prevention) you may continue to keep it around as well.
scarejunba 8y ago
I wonder if there's business in GDPR trolling websites. Does it count as extortion if you give someone personal data and then say they must delete it or pay you money to not kick up a fuss. Honestly, it sounds like it should be legal. Like the way ADA or CEQA trolling is. After all, that provides a valuable function.
- geocar 8y ago
  Yes. And I think there's an astroturfing movement from large data warehouses in the US that attempt to add confusion by talking about weird cases that don't really exist. The GDPR is actually quite simple to comply with for most people: European businesses have been doing it for years since the GDPR is largely the unification of various data protection regulations. I suspect as more people learn that, that trolling business will fall by the wayside...
deleted 8y ago
[deleted]
tql 8y ago
So the GDPR is only about personal data? What are my responsibilities if I run a chan, i.e., I store no personal data about my posts other than the IP address where they originated? What if I use some tracking technology such as a cookie or localStorage to identify unique browsers regardless of their IP address?
- geocar 8y ago
  You have to make it clear to people that you're using these technologies and how long you keep their data. You should also explain how you keep this data safe. If you suffer a data breach you have to disclose this, and you are potentially liable for it if you could've protected users from that breach by technological means (applying patches, salting passwords, encryption, and so on). If your breach includes too much personal data() this could be serious. If you think you want to keep data forever, then your liabilities for that data extend forever. You should consider if this is really what you want, or if you might want to simply delete old backups and scrub identifying information after some time. () The regulator will evaluate this by considering how the people that personal data is about will be affected. This is a difficult question to ask -- a chan user might at worst suffer potential embarrassment being linked to posts, so I suspect the regulator will view loss lightly, unless it could easily and reasonably be prevented. The ICO has really good guidance about this on their website: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/
  - bumbledraven 8y ago
    > a chan user might at worst suffer potential embarrassment being linked to posts Embarassment? People lose their jobs in America for espousing commonly-held conservative views. They can be arrested in Europe for the same thing.
    - geocar 8y ago
      I understand your point, but this isn't a special risk introduced by the GDPR, and from the perspective of a regulator, I don't think they are going to consider the linking someone to illegal behaviour to be additional liabilities for the company suffering the breach. That being said, if your "chan" provides a safe haven for illegal behaviour, you might have other non-GDPR problems as well.

122 points by dlgeek 8y ago

The subtitle is "[d]isgruntled ex-guildie effectively invents new way to grief in EVE" but it sounds like the request in question was sent to a website outside of EVE. This could happen with other games or, you know, websites unrelated to games at all...

tapland 8y ago
Corp (guild) forums are an important part of EVE and preferred over posting news and operations on Discord for example since you can set it up to serve unique texts to each user, making it easier to find them if they leak to other corps, and hidden changes in the website that will give it away in case the corp news leak by screenshot.
- LeftTurnSignal 8y ago
  /sidenote I've tried playing Eve quite a few times, and it just isn't my thing. Reading about Eve, however, has always been an absolute joy. Even comments like this (which makes complete sense in hindsight) shows me how much (for better or worse) people put into a "sandbox" or game like Eve. I swear some of the stories are much better than the stuff they toss in theatres.
ng12 8y ago
Too bad geocities is gone, I could've GDPR'd every guestbook I'd ever signed.

ThePhysicist 8y ago

I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. If there is data left just collect it, send it to the person and delete it afterwards (surely there’s a way to search posts by author in their forum software). I can understand that such requests are difficult to answer for companies that run many different IT services, but this case seems pretty trivial to me.

trothamel 8y ago
It seems like the AggregateIQ case shows the problem with this - by obeying the request, they admit that the EU has jurisdiction over them. That's probably the wrong thing to do when they have no connection to the EU, other than people from the EU choosing to connect to a server hosted elsewhere. It's probably the same reason why Hacker News does nothing to comply with the GDPR.
- nindalf 8y ago
  Has someone associated with HN explicitly said anything about complying with GDPR? If yes, do you have a link?
- doppel 8y ago
  Jurisdiction is a tricky concept in cases like these where we are dealing with digital content. AggregateIQ could have ignored the GDPR-request, ignored any rulings and keep chugging along as long as they stuck to Canada (assuming Canada was not going to side with the EU). In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. Same as if some banana republic dictator declares you persona non grata - if you never intend to visit and otherwise have no business in that country, who cares? The difference is that the EU is not a banana republic (opinions may vary), and so many choose to respect and accept this their judgement in cases like this to stay on good terms.
  - treis 8y ago
    >In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. That's not entirely true. You can go to a Canadian court to enforce an EU judgement against assets in Canada. So for example, if you cause a car accident in Germany, the plaintiff can sue you in Germany to get a judgement and then sue you in Canada to enforce that judgement. How Canadian (or US or otherwise) courts will treat a GDPR judgement remains to be seen, but it's not a guarantee that it won't be enforced.
- adventured 8y ago

anonymfus 8y ago

Why they don't want to answer request? It's still would be a nice thing to do ever if not required by law.

ocdtrekkie 8y ago
Indeed. This is a protection we should all really have, and there's no real reason you should be unwilling to tell a person what information you are storing on them.
wvenable 8y ago
They could probably spend all day every day answering these requests. How do they even know it's valid? Could I just request all your information?
- peteretep 8y ago
  > How do they even know it's valid? They can require you to prove this before processing your application, under GDPR.

dmitriid 8y ago

> the corp in question was blindsided by the request just as many real-life businesses were when the law came into effect last year “blindsided” bullcrap again

jplayer01 8y ago
Probably because it's a single guy running a small forum for a 70 man guild in a spaceship MMO. Why would anybody in that situation expect to get a GDPR request? Especially when it's clear the person in question is just bullying the forum owner.
- Symbiote 8y ago
  The greatest GDPR risk to my employer is from former employees wanting to cause hassle. We have very little user data, just an email address and a name, and no tracking. Of course we have much more information about staff. That's going to be a common situation, especially for non-tech or offline businesses.
cavanasm 8y ago
Keep in mind "corp" is just a guild in this particular video game. Likely they just have a free/low cost forum page with some minimal aethetic modifications.

fhrow4484 8y ago

What's interesting, and pointed out by a Reddit comment: https://www.reddit.com/r/legaladvice/comments/acsdf3/comment/eddcc3u https://www.reddit.com/r/legaladvice/comments/acsdf3/comment... There's no way to identify that the person making the request is who he/she says he/she is. The irony is that for services like Facebook, Facebook could ask for a scan of your id/passport to confirm it's you, (and would it also have to keep that scan saved somewhere in case it later needs to prove that it "authenticated" the gdpr request correctly?) But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?!

a_imho 8y ago
The authentication scheme should be the same that is used for signup e.g. email.
icebraining 8y ago
Doesn't Even have some sort of user profile? Bob could update it saying "yes, I made a GDPR request to X on date Y".
- fhrow4484 8y ago
  That's true, here it could be sufficient.
entity345 8y ago
This right of access to your personal data has existed in the EU for 20 years. This is not new. And yes, there is a need to verify IDs. Most companies don't have online forms for this so the way has always been to send an email and enquire, or to write on paper with a copy of a valid ID. This is not new. The question is whether data submitted under a pseudonym (e.g. forum activity) are actually personal information by law since the individual cannot be identified.
geocar 8y ago
> But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?! That's one way to do it. Another way would be to ask them to log in and set some preference (change their info field or name to "DELETE ME") or something like that.

zizee 8y ago

As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills. This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests. They will be forced to either shutdown, or be in breach of law. Perhaps some people will say "good, if you cannot run a site conforming to all laws of the land then you should shutdown". If you think that, consider this: as these laws pile up it will get more and more difficult to operate, leaving only the very tech/law savvy, and big business. This is not the democratization of information that the web promised oh so many years ago. On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? [edits: punctuation/grammar]

ThePhysicist 8y ago
I think most of the larger forum software providers have implemented functions to comply with GDPR (i.e. delete, restrict and extract user data). Concerning backups: If you have a short turnaround time (e.g. 14 days) it shouldn’t be a problem, the legislation acknowledges the fact that deleting data and ensuring data integrity (also in accordance with GDPR) are sometimes mutually exclusive from a practical point of view. You need to make sure that deletion requests also get honored when restoring from backup though, so ideally you want to store the requests in a third system and check them when you restore backups. Concerning the democratic aspect of participating in the online world I think GDPR actually helps, as before it was not possible to reliably get your own data deleted, rectified or transferred, which is not very democratic either IMHO.
- zizee 8y ago
  Thank you for your thoughtful response and information. I need time to digest this information to see how it affects my opinions, which might take longer than the half life of this discussion, so my apologies in advance for probably not responding :-)
- 8y ago

menzoic 8y ago

How would this work if the data was stored on an immutable blockchain?

mailbag 8y ago
crypto-shredding is arguably an option https://en.wikipedia.org/wiki/Crypto-shredding https://en.wikipedia.org/wiki/Crypto-shredding
M2Ys4U 8y ago
Storing it on an immutable blockchain probably violates the GDPR in the first place, at least if you have no method to render the data unreadable. To wit, Article 25 of the GDPR ("Data protection by design and by default"): > 1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. > 2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

sharpshadow 8y ago

Guys think about the ranking lists.. you want your data deleted and you kind of also have to delete all related data to that account like everything. I can imagine already some people hacking top 100 ranking list accounts and deleting them to remove them from the ranking to get elevated themselves.

zaarn 8y ago
You don't have to delete everything. In case of ranking lists, it would sufficient to tombstone the data; replace the name with "[deleted account]" and link it to a page that explains the account data was requested to be deleted. GDPR Deletion Requests only cover data for which's processing you either used consent, used the legitimate interest clause or is part of a protected category (sexuality, religion, etc.). Some parts of "legitimate interest" that continue to be legitimate interest (like for example, billing information for tax and fraud prevention) you may continue to keep it around as well.

scarejunba 8y ago

I wonder if there's business in GDPR trolling websites. Does it count as extortion if you give someone personal data and then say they must delete it or pay you money to not kick up a fuss. Honestly, it sounds like it should be legal. Like the way ADA or CEQA trolling is. After all, that provides a valuable function.

geocar 8y ago
Yes. And I think there's an astroturfing movement from large data warehouses in the US that attempt to add confusion by talking about weird cases that don't really exist. The GDPR is actually quite simple to comply with for most people: European businesses have been doing it for years since the GDPR is largely the unification of various data protection regulations. I suspect as more people learn that, that trolling business will fall by the wayside...

deleted 8y ago

[deleted]

tql 8y ago

So the GDPR is only about personal data? What are my responsibilities if I run a chan, i.e., I store no personal data about my posts other than the IP address where they originated? What if I use some tracking technology such as a cookie or localStorage to identify unique browsers regardless of their IP address?

geocar 8y ago
You have to make it clear to people that you're using these technologies and how long you keep their data. You should also explain how you keep this data safe. If you suffer a data breach you have to disclose this, and you are potentially liable for it if you could've protected users from that breach by technological means (applying patches, salting passwords, encryption, and so on). If your breach includes too much personal data() this could be serious. If you think you want to keep data forever, then your liabilities for that data extend forever. You should consider if this is really what you want, or if you might want to simply delete old backups and scrub identifying information after some time. () The regulator will evaluate this by considering how the people that personal data is about will be affected. This is a difficult question to ask -- a chan user might at worst suffer potential embarrassment being linked to posts, so I suspect the regulator will view loss lightly, unless it could easily and reasonably be prevented. The ICO has really good guidance about this on their website: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/
- bumbledraven 8y ago
  > a chan user might at worst suffer potential embarrassment being linked to posts Embarassment? People lose their jobs in America for espousing commonly-held conservative views. They can be arrested in Europe for the same thing.
  - geocar 8y ago
    I understand your point, but this isn't a special risk introduced by the GDPR, and from the perspective of a regulator, I don't think they are going to consider the linking someone to illegal behaviour to be additional liabilities for the company suffering the breach. That being said, if your "chan" provides a safe haven for illegal behaviour, you might have other non-GDPR problems as well.