37 ms·

Discord fined €800k

72 points by zhengiszen 4y ago

zgs 4y ago
Add three to six more zeros and these breaches will be taken seriously.
- ohbtvz 4y ago
  I take it you didn't read the article. The fine is low in part because discord cooperated and proactively complied with the regulator's orders before the fine was issued.
yellow_lead 4y ago
This is less than cost of compliance.
- colechristensen 4y ago
  > “The amount of the fine was decided regarding the breaches identified, the number of people concerned, but also taking into account the efforts made by the company throughout the procedure to reach compliance and the fact that its business model is not based on the exploitation of personal data,” the regulator said.
  - nerdponx 4y ago
    > the fact that its business model is not based on the exploitation of personal data Is it? I suppose you can take their turning down of Microsoft as a token of good faith, but it's also possible that they just think they can cash out for more in the future. If that's the case, then accumulating a massive user dataset is very much the business model, because the business model is to eventually sell the company for as much as possible.
    - adesanmi 4y ago
      Isn’t Discord’s primary monetisation strategy Nitro?
      - ldh0011 4y ago
        Not that I trust discord for sensitive communications but I'm personally quite happy to pay $ for my animated emojis and increased upload limit instead of them monetizing my info.
        nerdponx 4y ago
        My problem is that paying for the emojis doesn't actually stop them from monetizing your info.
  - lzooz 4y ago
    >its business model is not based on the exploitation of personal data Absolutely not arbitrary at all :')
  - KennyBlanken 4y ago
    > its business model is not based on the exploitation of personal data, That's strange, given the software's functionality includes showing friends and people in servers you're in what games you're playing, for how long, and even what game mode and so on. There's zero chance they're not monetizing that in some fashion. Almost certainly in aggregate, but I'd be shocked if they aren't doing non-aggregate data sharing behind some very tightly closed doors. Also, just an fyi that tencent has heavily invested in Discord - though the exact amount is unknown.
- viraptor 4y ago
  That doesn't quite hold for gdpr fines. It's a fine + you're going to comply, or we'll start stacking more fines. By definition this is a fine on top of the cost of compliance.
  - mrits 4y ago
    There are a lot of different ways to measure this. You could look at this as renting time for non-compliance. What they were able to work on by kicking this can down the road I don't know.
    - Wobble4978 4y ago
      "You could look at this as renting time for non-compliance. " How is this "time" and not "infringements" from your view?
m0rissette 4y ago
Sweet sweet paywalled site
0xd1r 4y ago
Possibly a better resource for those unable to access because of the paywall: https://www.cnil.fr/en/discord-inc-fined-800-000-euros https://www.cnil.fr/en/discord-inc-fined-800-000-euros
- stefan_ 4y ago
  > At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted. > The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts. Ahh yes, finally, government-enforced password policies. They have lost their mind. > However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applications. And they have thoughts on UI design too! This is like the opposite of what GDPR should be.
  - Scaevolus 4y ago
    The password thing is silly, but the actual complaint with "X minimizes to tray" is that it doesn't disconnect ongoing voice calls, which _could_ be confusing.
    - shrimp_emoji 4y ago
      Yep. Full section: When a user logged into a voice room closes the DISCORD application window by clicking on the "X" icon at the top right of the window in Microsoft Windows, they actually just put the application in the background and stay logged into the voice room. However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applications. DISCORD's behavior is different and may lead to users being heard by other members in the voice room when they thought they had left. The restricted committee considered that DISCORD should specifically inform users by making them aware that their words are still being transmitted and heard by others. However, as part of the procedure, DISCORD INC.set up a pop-up window to alert people connected to a voice room, when the window is closed for the first time, that the DISCORD application is still running and that this setting can be changed directly by the user.
optimalsolver 4y ago
>Compliance Week Sounds like a fun and entertaining publication.
- dbcurtis 4y ago
  Compliance Weak might be a good name for the El Reg version
judge2020 4y ago
The comments by CNIL (EN): https://www.cnil.fr/en/discord-inc-fined-800-000-euros https://www.cnil.fr/en/discord-inc-fined-800-000-euros A non-paywalled (but not great) article (use an ad blocker): https://www.bankinfosecurity.com/discord-fined-by-french-cnil-for-gdpr-violations-a-20494 https://www.bankinfosecurity.com/discord-fined-by-french-cni...
charcircuit 4y ago
The complaints boil down to >Discord not deleting inactive accounts I personally don't want my old accounts to be deleted. Just because I don't sign on to a site that doesn't mean I want everything to be deleted. >Closing the Discord window doesn't quit the entire application and just closes the window This is normal behaviour of programs. In fact most macos programs work this way. Windows still shows Discord in the bottom right no people can access it if they need it even if they don't want a window for it. >Discord's password requirements were not what they wanted Most people's discords accounts are stolen via token stealers and not by having their passwords guessed. They had proper rate limiting so this isn't a big deal. >They didn't create various paperwork Legal compliance is annoying. I hate how foreign governments can trample over US products.
- ohbtvz 4y ago
  > I hate how foreign governments can trample over US products. As if the US government never trampled over non-US companies. The US runs one of the most protectionist economies out there.
  - charcircuit 4y ago
    I don't approve of that either.
- anfogoat 4y ago
  > This is normal behaviour of programs. In fact most macos programs work this way. Windows still shows Discord in the bottom right no people can access it if they need it even if they don't want a window for it. Excuse me, it's the EU who determines what is normal and what is not. Not some decades old conventions.
  - unityByFreedom 4y ago
    Hahaha. Yes some stodgy bureaucrats surely know more than designers of OS and software. Please. There's definitely a gap to bridge but let's not pretend one side knows everything.
- 4y ago
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
frozencell 4y ago
Reddit France updating their terms and posting a community thread just yesterday (r/france) Coincidence I THINK NOT
asicsp 4y ago
Dupe: "Discord fined €800k for failing to comply with several obligations of the GDPR" https://news.ycombinator.com/item?id=33637977 https://news.ycombinator.com/item?id=33637977 (258 points | 9 days ago | 285 comments)
dbg31415 4y ago
So the problem with Discord is that following GDPR would just make for a really crappy user experience. Let's say you're a community moderator, and you type out the rules for the community. Well... now, unless someone wants to re-do everything you did, those rules will forever say, "YourName said..." and if someone leaves a server, and asks for their content to be removed... it would make for a big mess for users and moderators, "See the pinned posts!" "Uh, what pinned posts?" Also, quotes and replies of your messages... do those have to be removed? Someone responds to your message, and quotes, "> YourName said..." before their response. And along the same logic... there are a lot of bots that automatically track all the updates to messages, so that people can't say something nasty, and edit it and say, "No, I didn't say anything nasty!" The bots see all... and normally they record it in a public channel for the admins, where the bot just says, "YourName edited their post from X, to Y!" Do all those have to be removed? Not to mention emoji, and sponsorship, and the list of "joined the server" / "YourName kicked SomePunk because..." where the admin leaves a note outlining why they booted someone. Would all that have to be expunged upon request? Dunno man, I'm all for GDPR, but I think Discord is sort of like Hacker News... like public forums shouldn't have to remove content someone put up. Just find a way to change ownership or change YourName to [DeletedUser123] would be fine... still sucks from a UX perspective I think, and all the messages quoting you, and bots recording your changes... those are still there. Can't really un-pee in the pool. But you know that using Discord. Edit... I confused GDPR with CCPA for "request to export" / "request to delete" -- sorry. Meh, I'll leave this up because I'm an idiot, and I still think Discord / "public" places should be except from requests to delete data.

Discord fined €800k

72 points by zhengiszen 4y ago

zgs 4y ago

Add three to six more zeros and these breaches will be taken seriously.

ohbtvz 4y ago
I take it you didn't read the article. The fine is low in part because discord cooperated and proactively complied with the regulator's orders before the fine was issued.

yellow_lead 4y ago

This is less than cost of compliance.

colechristensen 4y ago
> “The amount of the fine was decided regarding the breaches identified, the number of people concerned, but also taking into account the efforts made by the company throughout the procedure to reach compliance and the fact that its business model is not based on the exploitation of personal data,” the regulator said.
- nerdponx 4y ago
  > the fact that its business model is not based on the exploitation of personal data Is it? I suppose you can take their turning down of Microsoft as a token of good faith, but it's also possible that they just think they can cash out for more in the future. If that's the case, then accumulating a massive user dataset is very much the business model, because the business model is to eventually sell the company for as much as possible.
  - adesanmi 4y ago
    Isn’t Discord’s primary monetisation strategy Nitro?
    - ldh0011 4y ago
      Not that I trust discord for sensitive communications but I'm personally quite happy to pay $ for my animated emojis and increased upload limit instead of them monetizing my info.
      - nerdponx 4y ago
        My problem is that paying for the emojis doesn't actually stop them from monetizing your info.
- lzooz 4y ago
  >its business model is not based on the exploitation of personal data Absolutely not arbitrary at all :')
- KennyBlanken 4y ago
  > its business model is not based on the exploitation of personal data, That's strange, given the software's functionality includes showing friends and people in servers you're in what games you're playing, for how long, and even what game mode and so on. There's zero chance they're not monetizing that in some fashion. Almost certainly in aggregate, but I'd be shocked if they aren't doing non-aggregate data sharing behind some very tightly closed doors. Also, just an fyi that tencent has heavily invested in Discord - though the exact amount is unknown.
viraptor 4y ago
That doesn't quite hold for gdpr fines. It's a fine + you're going to comply, or we'll start stacking more fines. By definition this is a fine on top of the cost of compliance.
- mrits 4y ago
  There are a lot of different ways to measure this. You could look at this as renting time for non-compliance. What they were able to work on by kicking this can down the road I don't know.
  - Wobble4978 4y ago
    "You could look at this as renting time for non-compliance. " How is this "time" and not "infringements" from your view?

m0rissette 4y ago

Sweet sweet paywalled site

0xd1r 4y ago

Possibly a better resource for those unable to access because of the paywall: https://www.cnil.fr/en/discord-inc-fined-800-000-euros https://www.cnil.fr/en/discord-inc-fined-800-000-euros

stefan_ 4y ago
> At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted. > The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts. Ahh yes, finally, government-enforced password policies. They have lost their mind. > However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applications. And they have thoughts on UI design too! This is like the opposite of what GDPR should be.
- Scaevolus 4y ago
  The password thing is silly, but the actual complaint with "X minimizes to tray" is that it doesn't disconnect ongoing voice calls, which _could_ be confusing.
  - shrimp_emoji 4y ago
    Yep. Full section: When a user logged into a voice room closes the DISCORD application window by clicking on the "X" icon at the top right of the window in Microsoft Windows, they actually just put the application in the background and stay logged into the voice room. However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applications. DISCORD's behavior is different and may lead to users being heard by other members in the voice room when they thought they had left. The restricted committee considered that DISCORD should specifically inform users by making them aware that their words are still being transmitted and heard by others. However, as part of the procedure, DISCORD INC.set up a pop-up window to alert people connected to a voice room, when the window is closed for the first time, that the DISCORD application is still running and that this setting can be changed directly by the user.

optimalsolver 4y ago

>Compliance Week Sounds like a fun and entertaining publication.

dbcurtis 4y ago
Compliance Weak might be a good name for the El Reg version

judge2020 4y ago

The comments by CNIL (EN): https://www.cnil.fr/en/discord-inc-fined-800-000-euros https://www.cnil.fr/en/discord-inc-fined-800-000-euros A non-paywalled (but not great) article (use an ad blocker): https://www.bankinfosecurity.com/discord-fined-by-french-cnil-for-gdpr-violations-a-20494 https://www.bankinfosecurity.com/discord-fined-by-french-cni...

charcircuit 4y ago

The complaints boil down to >Discord not deleting inactive accounts I personally don't want my old accounts to be deleted. Just because I don't sign on to a site that doesn't mean I want everything to be deleted. >Closing the Discord window doesn't quit the entire application and just closes the window This is normal behaviour of programs. In fact most macos programs work this way. Windows still shows Discord in the bottom right no people can access it if they need it even if they don't want a window for it. >Discord's password requirements were not what they wanted Most people's discords accounts are stolen via token stealers and not by having their passwords guessed. They had proper rate limiting so this isn't a big deal. >They didn't create various paperwork Legal compliance is annoying. I hate how foreign governments can trample over US products.

ohbtvz 4y ago
> I hate how foreign governments can trample over US products. As if the US government never trampled over non-US companies. The US runs one of the most protectionist economies out there.
- charcircuit 4y ago
  I don't approve of that either.
anfogoat 4y ago
> This is normal behaviour of programs. In fact most macos programs work this way. Windows still shows Discord in the bottom right no people can access it if they need it even if they don't want a window for it. Excuse me, it's the EU who determines what is normal and what is not. Not some decades old conventions.
- unityByFreedom 4y ago
  Hahaha. Yes some stodgy bureaucrats surely know more than designers of OS and software. Please. There's definitely a gap to bridge but let's not pretend one side knows everything.
4y ago

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

frozencell 4y ago

Reddit France updating their terms and posting a community thread just yesterday (r/france) Coincidence I THINK NOT

asicsp 4y ago

Dupe: "Discord fined €800k for failing to comply with several obligations of the GDPR" https://news.ycombinator.com/item?id=33637977 https://news.ycombinator.com/item?id=33637977 (258 points | 9 days ago | 285 comments)

dbg31415 4y ago

So the problem with Discord is that following GDPR would just make for a really crappy user experience. Let's say you're a community moderator, and you type out the rules for the community. Well... now, unless someone wants to re-do everything you did, those rules will forever say, "YourName said..." and if someone leaves a server, and asks for their content to be removed... it would make for a big mess for users and moderators, "See the pinned posts!" "Uh, what pinned posts?" Also, quotes and replies of your messages... do those have to be removed? Someone responds to your message, and quotes, "> YourName said..." before their response. And along the same logic... there are a lot of bots that automatically track all the updates to messages, so that people can't say something nasty, and edit it and say, "No, I didn't say anything nasty!" The bots see all... and normally they record it in a public channel for the admins, where the bot just says, "YourName edited their post from X, to Y!" Do all those have to be removed? Not to mention emoji, and sponsorship, and the list of "joined the server" / "YourName kicked SomePunk because..." where the admin leaves a note outlining why they booted someone. Would all that have to be expunged upon request? Dunno man, I'm all for GDPR, but I think Discord is sort of like Hacker News... like public forums shouldn't have to remove content someone put up. Just find a way to change ownership or change YourName to [DeletedUser123] would be fine... still sucks from a UX perspective I think, and all the messages quoting you, and bots recording your changes... those are still there. Can't really un-pee in the pool. But you know that using Discord. Edit... I confused GDPR with CCPA for "request to export" / "request to delete" -- sorry. Meh, I'll leave this up because I'm an idiot, and I still think Discord / "public" places should be except from requests to delete data.