13 ms·
Doom Eternal Privacy Policy Allows Collection and Disclosure of Medical Records
- everdrive 6y agoThinking about this for a minute. It's got to be a matter of the DRM system. They're anticipating that they could collect any data from your PC, and are trying to cover their bases.
- dang 6y agoThe submitted title breaks the site guidelines by editorializing. Normally we'd change it to the article title, but in this case every single comment in the thread would become meaningless, so I'm going to downweight the submission instead. "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html If you want to say what you think is important about an article, that's fine, but do so in the comments. Then your view will be on a level playing field with everyone else's. https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22level%20playing%20field%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- caconym_ 6y agoSeems like it's less editorializing and more using the title to draw attention to a fact (not an opinion, it's either true or it isn't) about an existing web page that might not have been obvious to somebody clicking on a link titled 'ZENIMAX MEDIA ONLINE PRIVACY POLICY' and linking to the same. Is this not allowed? Usually I actually appreciate it when the link goes straight to the primary source in these cases rather than some intermediate news site. edit: maybe I'm looking at an edited title?
- dang 6y agoCherry-picking one detail and making that the title is actually the leading form of editorializing. Titles are by far the biggest influence on threads, so this is a big deal. On HN, being the submitter of an article doesn't confer any special rights to frame it for everyone else. That's why we ask people to express their opinions in the comments rather than the title. HN readers should make up their own minds about what parts of an article are important. It's true that this policy can't just be applied mechanically and that there's room for nuance. In this case, though, the argument that reverting the title makes the submission a non-story is actually accurate. If the responses in the comments are correct, then indeed it is a non-story.
- gentleman11 6y agoTo be honest, I started to write a tweet to get around this rule, but it felt childish to approach it in that way and I considered a shallow blog post instead. Next time I'll write the tweet so that the submission can rise to story status like this thread: https://twitter.com/olenskae/status/1283000201993748482 https://twitter.com/olenskae/status/1283000201993748482 or this one: https://twitter.com/paulg/status/1282052801347100675 https://twitter.com/paulg/status/1282052801347100675
- deleted 6y ago[deleted]
- caconym_ 6y agoThis is exactly what I was thinking. It's not editorializing. It's framing a discussion of a certain part of a web page that is not an article by using a title that is a factual statement about said web page. The obvious "workaround" is to publish some low-effort tweet or blog post or whatever, which further muddies the waters re: the other "guideline" which says you should submit primary sources if possible. I get wanting to take a hard line on titles, but I think the "guideline" as written is confusing. The bit about editorializing should be taken out, to make it clear that actual editorializing isn't precisely what's prohibited.
- dang 6y agoI don't think that's right. We have a decade of experience with this, and while there are always corner cases, the HN rule and associated moderation practice works surprisingly well. It creates a relatively level playing field and lets the community consider a submission from first principles. That leads to much more diverse discussion than you get if the title is skewed and primes everybody. If people start making tweets purely to put their spin on an article, HN users will probably notice and flag the post. I mean, who knows. People are welcome to try. We're not trying to stop anyone from expressing their view—but most of the time it's cheap and inflammatory when someone hijacks a title to do so. Title dynamics are fascinating. It used to irritate me that people place so much importance on titles, but eventually I got it. One way of looking at it is, it's a power law: the first 1% of information in (let's call it) an article stream has 90% of the importance. Poof, now it makes sense why titles are so impactful. I suppose that many power laws seem paradoxical when not recognized as such.
- gentleman11 6y agoEdit: the link broke shortly after I posted it, this one is working: https://www.zenimax.com/legal_privacy_us/ https://www.zenimax.com/legal_privacy_us/ Bought Doom Eternal on the steam sale just recently and found this: "Customer Records: paper and electronic customer records containing personal information, such as name, signature, physical characteristics or description, address, telephone number, education, current employment, employment history, social security number, passport number, driver’s license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, or any other financial or payment information, medical information, or health insurance information." This is explicitly listed as collected and disclosed They also list browsing history: "Usage Data: internet or other electronic network activity information, including, but not limited to, browsing history"
- BitwiseFool 6y agoI'm glad you found and posted this. I'm surprised at how much this policy page looks like a website from 1995. How did you find this?
- akerro 6y ago>I'm surprised at how much this policy page looks like a website from 1995. It's almost as someone planned to make it hard to read!
- deleted 6y ago[deleted]
- tzs 6y agoHow is it hard to read? Both versions I've seen linked here are essentially plain text with sensible use of simple styling (bold and italics), with a couple tables of text, and some borders in a couple sections to group things. The only things that might make it a little harder for some people are one of them used green text on a black background, and for both of them if you browser window is wide the lines might be a bit too long.
- 6y ago
- Argorak 6y agoI think this is mostly laziness - they just say "yes" to everything, without checking if it actually happens. They also share: > thermal, olfactory, or similar information such as, CCTV footage, photographs, and call recordings and other audio recording (e.g., recorded meetings and webinars). I like olfactory a lot.
- scotth 6y agoThis couldn't possibly be true, could it? Bad copy paste job?
- mywittyname 6y agoMaybe consumers should have the ability to sue companies who force them into irrelevant, spurious, or onerous terms of service. It's not enough that these likely won't hold up in court, because the possibility exists that they may.
- sailfast 6y agoI'm not sure how this would hold up given the inability of United States congresspersons to prevent forced arbitration language being inserted into just about every contract we sign every day.
- wittyreference 6y ago> who force them into irrelevant, spurious, or onerous terms of service I suspect most courts would consider a video game the very height of an optional activity - which would make it hard to suggest a contract, regardless of how onerous, would be something the person was "forced" into.
- balls187 6y ago"Such as" to me implies an example of the type of data that is considered "Customer Data", not necessarily that they do collect it. I'm not as worried about them collecting that data directly from me, but rather cross referencing the data they have on me, with other paid-for data sources, which would give them that information.
- teej 6y agoI wonder if this is laziness (my bet) or if it’s due to the seizure warning they show before the game starts.
- danielscrubs 6y agoWhich would break GDPR laws even if you got customers to sign it. Really sloppy work.
- bibinou 6y agoit's an inclusing OR defining the concept of personal information.
- falcolas 6y agoA quick reminder - this is the same game which had a ring-0 anti-cheat system installed and run with the game. They stepped it back a bit after the outcry (and install on people's system), but IIRC it is still installed and run if you play Doom Eternal multi-player. So, it's entirely conceivable that this very "covered" data was collected and pushed up to their systems as a part of their "anti-cheat" detection, either from a HD sweep or from in-memory data in other applications (like the browser).
- chrisseaton 6y agoI don't understand - how do they escape from user-space to ring zero?
- falcolas 6y agoWhen it's installed, via a ubiquitous UAC dialog. It runs as a system kernel extension.
- chrisseaton 6y agoOh right - can you not install it with only user permissions? Why does it need administrator privileges to be installed? Just for this escalation?
- falcolas 6y agoThe installer does not allow modification to the privileges it gets by the user. You can install it or not. If not, you’ll consequently be locked out of all or part of the game it’s associated with.
- dcow 6y agoWhen you click “allow” when its installer (or originally its store’s installer) asks for administrative privileges.
- deleted 6y ago
- archi42 6y ago"Do-Not-Sell. California residents have the right to opt-out of our sale of their personal information. Opt-out rights can be exercised by going to https://bethesda.net/document/cookie-preferences https://bethesda.net/document/cookie-preferences. We do not sell personal information about residents who we know are younger than 16 years old." Holy sht; not that it surprises me, but, well...
- XCSme 6y agoThe Do-Not-Sell should be the default, and maybe be incentivized somehow to turn it on if you prefer to do so.
- archi42 6y agoYeah, neat idea: One free loot box per month (and maybe a free novelty skin on xmas "I sold my soul and all I got was this lousy shirt"). :P
- coderintherye 6y agoDepending on the state you live in, write to and convince your state legislatures to pass a law. Once > X number of states have such laws, it will be the right economic choice for companies to make it the default for everyone rather than doing it selectively by state.
- lbacaj 6y agoAs someone who currently works in healthcare tech I can tell you that taking on health records is one of the riskiest things any company could ever do. In fact we try to keep health records as isolated as technically, and humanly, possible. For each HIPAA violation a company will be fined $10,000 dollars per customer. If ten million records on a database are part of a breach the company can be out of business. It boggles the mind that anyone would want to take on that liability. https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials...
- roywiggins 6y agoIt takes more than storing medical data to be covered by HIPAA. Usually you have to be a medical provider or have a business agreement with a medical provider. If I upload an MRI scan to imgur, imgur isn't instantly governed by HIPAA. This means data harvesting companies can siphon up this stuff where they can find it. As long as they don't have a particular contractual relationship with an actual hospital, it's just like any other data, and they're not governed by HIPAA. There may be some other ways to get governed by HIPAA, but that's the general rule. It's hard to do by accident.
- londons_explore 6y agoData brokers aren't interested in a couple of records here or there of x-rays from Imgur. They want millions of records with some kind of identifier, and some kind of predictive value. Eg. The number of ice creams I buy might be a good predictor of if I'll be buying diabetes treatment next year. Without all 3, your data won't be used.
- zionic 6y agoWe need more laws about this for financial data, surfing history, customer purchase data, location data etc. Hoarding customer data should be a liability!
- Nbox9 6y agoAs a software developer I personally refuse to work on HIPAA compliant software, because if there is a HIPAA violation I can be held liable.
- yumraj 6y agoBut how do they get this data? I wonder if someone just copy pasted this form without actually reading, though perhaps that is giving too much benefit of doubt.
- deleted 6y ago[deleted]
- m3kw9 6y agoI’m not sure how my medical records can be taken from playing this game?
- Rebelgecko 6y agoI don't know about this game in particular, but many games install spyware for anticheat and DRM purposes. For example, Blizzard's anticheat software phones home with the title bar text of every open window on the computer. If I leave a browser tab open from my doctor's portal, I can totally envision how Blizzard would end up collecting some of my medical data.
- dvdgsng 6y agoCrazy. Any more examples, details and links?
- goldfishlover 6y agoIsn't doom eternal mostly single player? what's the deal here?
- fpgaminer 6y agoI've had my gaming machine on a separate box for awhile now. Games and their DRM have been getting worse and worse. Even games like Kerbal Space Program, which I loved, harvested all your browsing data. Like, seriously, WTF? So I've kept all that garbage on its own box. It's nicer that way anyway, since I don't use Windows as my daily driver it helps me keep a Windows machine around for other toxic software like Photoshop. I previously did it in a VM with GPU passthrough, which worked quite well and I think is a decent option for people who can't afford the cost/space of a second machine. Nowadays, thanks to the death of Moore's Law, I had a perfectly capable older machine lying around that I could use instead. That's slightly less maintenance, since the GPU passthrough would occasionally need twiddling after qemu or kvm updates. EDIT: I will add, for the couples years I was doing GPU passthrough, I didn't notice any difference in performance compared to when I moved the same GPU over to a physical box. In fact, there was this weird audio bug that I originally thought was because of the VM, but it persisted on the real machine and turned out to just be a bug in NVidia's audio driver. So besides the maintenance burden, GPU passthrough was great.
- GaryNumanVevo 6y agoYup, I do all my banking / financial stuff on an old netbook. I keep the OS up to date as best I can, it feels good to know everything is kept separate.
- dyingkneepad 6y ago> I've had my gaming machine on a separate box for awhile now. I do the same, I bought my box from Sony, it's called Playstation 4. Never had to worry about driver updates, incompatible games, sanboxing, anything. 5/5 would recommend.
- yjftsjthsd-h 6y agoOkay, but I like mods.
- aaomidi 6y agoI don't trust random third party code that doesn't even at least have a company behind them tbh.
- tasubotadas 6y agoCopy-paste gone wrong by lazy laywers. They will release a fixed version in a few days.
- vsareto 6y agoPeople are wondering why they would include this, but I bet accessibility settings could be considered medical information e.g. if you turn on colorblind or other assistance. If the game sends back all of your settings, they'd see you turned that on and could make a reasonable guess that you are.
- gentleman11 6y agoGood point, but its listed as explicitly disclosed and/or sold
- nimbius 6y agoBethesda seems to have conflated playing their game with applying for a job with the UAC on phobos.
- nitwit005 6y agoIt's just a table of definitions pulled straight from the California Consumer Privacy Act (CCPA), which defines 11 categories of information, and requires that you disclose if you collect it.
- A4ET8a8uTh0 6y agoThis just makes my blood boil. I am definitely not unbiased here. I purchased Doom on steam before it got laden with the heavy DRM. It was a fun ride, but it is now hard for me to justify the full price I paid. It is only a shame I can't attempt to return it now after they rendered it unusable from my perspective. Still, my gaming PC is also my tax PC, and minor projects PC and since I am no longer a kid, I have a lot of information floating on it I would not want other people to know. How is this normal state of affairs? I will submit request for refund just in case. It might get denied, but maybe they will at least get the message.
- Dirak 6y agoTheres only mention of medical or health records on the page that I could find is: "Categories of personal information:" "Customer Records: paper and electronic customer records containing personal information, such as name, signature, [...] medical information, or health insurance information" I would give ID the benefit of doubt here and say this just boilerplate legal text.
- bhouston 6y agoThis is nothing story. There are categories of data per the California privacy law. This is a whole category called "Consumer Records" and because they collection some of it in this category they have to declare the whole category. Tons of companies do the same - 4M for example: https://www.google.com/search?q=paper+and+electronic+customer+records+containing+personal+information%2C+such+as+name%2C+signature%2C+physical+characteristics+or+description%2C+address%2C+telephone+number%2C+education%2C+current+employment%2C+employment+history%2C+social+security+number%2C+passport+number%2C+driver%E2%80%99s+license+or+state+identification+card+number%2C+insurance+policy+number%2C+bank+account+number%2C+credit+card+number%2C+debit+card+number%2C+or+any+other+financial+or+payment+information%2C+medical+information%2C+or+health+insurance+information&oq=paper+and+electronic+customer+records+containing+personal+information%2C+such+as+name%2C+signature%2C+physical+characteristics+or+description%2C+address%2C+telephone+number%2C+education%2C+current+employment%2C+employment+history%2C+social+security+number%2C+passport+number%2C+driver%E2%80%99s+license+or+state+identification+card+number%2C+insurance+policy+number%2C+bank+account+number%2C+credit+card+number%2C+debit+card+number%2C+or+any+other+financial+or+payment+information%2C+medical+information%2C+or+health+insurance+information https://www.google.com/search?q=paper+and+electronic+custome...
- rosywoozlechan 6y agoThis is like the prop 65 warning, companies are covering their asses, which results in the law becoming effectively meaningless. Because there could potentially be some medical records that you disclosed, say in a chat message, they have to say that they collect it. By making these strict laws California has basically opted everyone into everything being collected, because to say otherwise would put companies into into unnecessary legal jeopardy.