4 ms·

Because GDPR puts restrictions on how inactive or deprecated account data can be kept - to prevent mining of forgotten accounts I suspect was the intention

by jjcon 4y ago

temporary22 4y ago
i never heard of this, can you link the gdpr article on this?
rlpb 4y ago
I don't think that extends to "forgetting" that you purchased a game so now you have to buy it again. That would be absurd.
- jjcon 4y ago
  They aren’t the only gaming company to interpret GDPR that way and they are arguably target #1 by EU regulators so they don’t have room to misinterpret Here is one of the provisions of interest: https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/ Ubisoft also cites GDPR provisions for deletion of inactive accounts: https://www.gamepressure.com/newsroom/ubisoft-removes-player-account-all-in-accordance-with-the-law/za3e20 https://www.gamepressure.com/newsroom/ubisoft-removes-player...
  - MattPalmer1086 4y ago
    This is nonsense. While you cannot keep personal data lying around forever with GDPR, deleting accounts after 6 months or a year or inactivity is a choice being made by the company. They could equally well have said that an account which was inactive for 2 years, or 3 years would be deleted and still be legally compliant.
    - jjcon 4y ago
      The requirement is “no longer than necessary” - meta started migrating people away from oculus accounts with the release of the quest 2 over 2 years ago in 2020. If you have regulators breathing down your neck being conservative on time isn’t a terrible idea.
  - rlpb 4y ago
    > They aren’t the only gaming company to interpret GDPR that way and they are arguably target #1 by EU regulators so they don’t have room to misinterpret Malicious compliance. They deliberately misinterpret and continue to get pulled up on it. For example, just recently: https://www.bbc.co.uk/news/technology-63784393 https://www.bbc.co.uk/news/technology-63784393 This completely contradicts any argument that their interpretation of privacy regulation is remotely compliant. They cross the line in their favour relentlessly.
    - jjcon 4y ago
      Malicious compliance maybe but compliance nonetheless - I’m not necessarily defending them here for the record but GDPR has been cited for a lot of inactive account removals recently - meta is already feeling heat from EU regulators - they may not want to take chances.
MattPalmer1086 4y ago
GDPR just says you cannot keep personal data for longer than is required for the purpose it was collected for (with some exceptions where it can be kept longer). If you have paid for digital goods with an account, the data is clearly required! Deleting an inactive account after say a year is a choice made by the company, not directly imposed by GDPR.
- jjcon 4y ago
  The problem is that distinction isn’t made clear in the actual law - which is again - why meta is far from alone here even in the gaming space itself. It’s on the EU to clarify compliance here otherwise we will continue to have stories pop up like this.
  - MattPalmer1086 4y ago
    The law is deliberately silent on exactly how long "necessary" is, as it cannot possibly define that for all uses of personal data in all circumstances. It's trying to establish principles of good personal data governance, rather than being prescriptive about all uses of data. This does make it hard for legal teams to determine compliance I guess. But don't expect the EU to be more definite any time soon!

Because GDPR puts restrictions on how inactive or deprecated account data can be kept - to prevent mining of forgotten accounts I suspect was the intention

by jjcon 4y ago

Because GDPR puts restrictions on how inactive or deprecated account data can be kept - to prevent mining of forgotten accounts I suspect was the intention

temporary22 4y ago

i never heard of this, can you link the gdpr article on this?

rlpb 4y ago

I don't think that extends to "forgetting" that you purchased a game so now you have to buy it again. That would be absurd.

jjcon 4y ago
They aren’t the only gaming company to interpret GDPR that way and they are arguably target #1 by EU regulators so they don’t have room to misinterpret Here is one of the provisions of interest: https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/ Ubisoft also cites GDPR provisions for deletion of inactive accounts: https://www.gamepressure.com/newsroom/ubisoft-removes-player-account-all-in-accordance-with-the-law/za3e20 https://www.gamepressure.com/newsroom/ubisoft-removes-player...
- MattPalmer1086 4y ago
  This is nonsense. While you cannot keep personal data lying around forever with GDPR, deleting accounts after 6 months or a year or inactivity is a choice being made by the company. They could equally well have said that an account which was inactive for 2 years, or 3 years would be deleted and still be legally compliant.
  - jjcon 4y ago
    The requirement is “no longer than necessary” - meta started migrating people away from oculus accounts with the release of the quest 2 over 2 years ago in 2020. If you have regulators breathing down your neck being conservative on time isn’t a terrible idea.
- rlpb 4y ago
  > They aren’t the only gaming company to interpret GDPR that way and they are arguably target #1 by EU regulators so they don’t have room to misinterpret Malicious compliance. They deliberately misinterpret and continue to get pulled up on it. For example, just recently: https://www.bbc.co.uk/news/technology-63784393 https://www.bbc.co.uk/news/technology-63784393 This completely contradicts any argument that their interpretation of privacy regulation is remotely compliant. They cross the line in their favour relentlessly.
  - jjcon 4y ago
    Malicious compliance maybe but compliance nonetheless - I’m not necessarily defending them here for the record but GDPR has been cited for a lot of inactive account removals recently - meta is already feeling heat from EU regulators - they may not want to take chances.

MattPalmer1086 4y ago

GDPR just says you cannot keep personal data for longer than is required for the purpose it was collected for (with some exceptions where it can be kept longer). If you have paid for digital goods with an account, the data is clearly required! Deleting an inactive account after say a year is a choice made by the company, not directly imposed by GDPR.

jjcon 4y ago
The problem is that distinction isn’t made clear in the actual law - which is again - why meta is far from alone here even in the gaming space itself. It’s on the EU to clarify compliance here otherwise we will continue to have stories pop up like this.
- MattPalmer1086 4y ago
  The law is deliberately silent on exactly how long "necessary" is, as it cannot possibly define that for all uses of personal data in all circumstances. It's trying to establish principles of good personal data governance, rather than being prescriptive about all uses of data. This does make it hard for legal teams to determine compliance I guess. But don't expect the EU to be more definite any time soon!