4 ms·

Technically the minimum required by the GDPR is that you can send them an email and the company must comply within 30 days.

jiveturkey 7y ago
It's one month, not 30 days (important distinction), and can more-or-less arbitrarily be extended to 3 months. Also, it doesn't require that any specific action be taken, just that the subject be informed within that time period. Most notably, nothing within the GDPR requires removal of an account, only (in some cases) removal of Personal Data.
- xaerise 7y ago
  With GDPR you have the right to be forgotten. Therefor they need to remove all data about you that is not protected by any other law ( like billing information or something like that ). According to GDPR Art. 17(2)
  - msla 7y ago
    GDPR isn't global law.
    - baroffoos 7y ago
      It applies to any user in the EU and since its hard to know if a particular user is or is not in the EU or a citizen of the EU its easier to just do the right thing by everyone.
      - msla 7y ago
        > It applies to any user in the EU and since its hard to know if a particular user is or is not in the EU or a citizen of the EU its easier to just do the right thing by everyone. This still assumes you care about being punished by the EU. A company with no financial contact with the EU doesn't have to care about that, any more than a company with no financial contact with Saudi Arabia has to worry about offending the House of Saud.
- munk-a 7y ago
  Hilariously the fact that they ask for a photo ID suddenly raises the amount of PII tied to your account by like 1000% - Blizzard knows very little of who I am, but if I gave them my photo ID then they're suddenly quite knowledgeable.
  - jiveturkey 7y ago
    Only if they retain the information. They can just throw it away after "verification".
    - munk-a 7y ago
      They could - or their marketing department could get some C-level pressure put on retaining it so they can try and "reactivate the potential customers" later. Similar to how Twitter sent out marketing to contact devices registered for account recovery.
- jimmaswell 7y ago
  Why is plus or minus a few days an important distinction here?

jiveturkey 7y ago

It's one month, not 30 days (important distinction), and can more-or-less arbitrarily be extended to 3 months. Also, it doesn't require that any specific action be taken, just that the subject be informed within that time period. Most notably, nothing within the GDPR requires removal of an account, only (in some cases) removal of Personal Data.

xaerise 7y ago
With GDPR you have the right to be forgotten. Therefor they need to remove all data about you that is not protected by any other law ( like billing information or something like that ). According to GDPR Art. 17(2)
- msla 7y ago
  GDPR isn't global law.
  - baroffoos 7y ago
    It applies to any user in the EU and since its hard to know if a particular user is or is not in the EU or a citizen of the EU its easier to just do the right thing by everyone.
    - msla 7y ago
      > It applies to any user in the EU and since its hard to know if a particular user is or is not in the EU or a citizen of the EU its easier to just do the right thing by everyone. This still assumes you care about being punished by the EU. A company with no financial contact with the EU doesn't have to care about that, any more than a company with no financial contact with Saudi Arabia has to worry about offending the House of Saud.
munk-a 7y ago
Hilariously the fact that they ask for a photo ID suddenly raises the amount of PII tied to your account by like 1000% - Blizzard knows very little of who I am, but if I gave them my photo ID then they're suddenly quite knowledgeable.
- jiveturkey 7y ago
  Only if they retain the information. They can just throw it away after "verification".
  - munk-a 7y ago
    They could - or their marketing department could get some C-level pressure put on retaining it so they can try and "reactivate the potential customers" later. Similar to how Twitter sent out marketing to contact devices registered for account recovery.
jimmaswell 7y ago
Why is plus or minus a few days an important distinction here?