3 ms·

> I understand game developers want to make money but what is the logic here? I think the logic here is that they don't want to get a huge fine from CNIL (Fren

> I understand game developers want to make money but what is the logic here? I think the logic here is that they don't want to get a huge fine from CNIL (French data regulator) and possibly other GDPR countries that choose to interpret the requirements in a similar way. There's a reason so many different services are rolling out inactive account deletion policies now.

happymellon 3y ago
The GDPR is all about personal information. What is personal about user `mikepavone22` owning FIFA 2019? Or is this because they demand personal information for your account, such as your date of birth? Because they shouldn't be able to restrict your access to a service based upon them gathering your personal details.
- mordae 3y ago
  Once the data are tied to email, IP address, SSN, eID, ID card or even a name, they are personal data. Sure, "owns FIFA 2019" is not sensitive data like "suffers from depression" or "voted Green" would be, but it's still data about a person. Many people confuse identifiers with personal data. Next time, assume personal data means all columns of the "user" table and everything that can be sensibly joined to them. "Anonymized" means setting all non-synthetic identifiers to NULL. "Pseudonymized" means replacing all non-synthetic identifiers with generated ones. "Sufficiently" means you ask yourself: "Would I be plausibly able to identify rows related to this one person I personally know stuff about?" But obviously, keeping user accounts to be able to provide them with their games is a given. No data protection agency would be able to convince a court that you should have made the games inaccessible without explicit instruction from the user. It's a textbook example of legitimate interest.
  - happymellon 3y ago
    > Once the data are tied to email, IP address, SSN, eID, ID card or even a name, they are personal data. I don't use these game services, but do they really mandate that you provide this?

happymellon 3y ago

The GDPR is all about personal information. What is personal about user `mikepavone22` owning FIFA 2019? Or is this because they demand personal information for your account, such as your date of birth? Because they shouldn't be able to restrict your access to a service based upon them gathering your personal details.

mordae 3y ago
Once the data are tied to email, IP address, SSN, eID, ID card or even a name, they are personal data. Sure, "owns FIFA 2019" is not sensitive data like "suffers from depression" or "voted Green" would be, but it's still data about a person. Many people confuse identifiers with personal data. Next time, assume personal data means all columns of the "user" table and everything that can be sensibly joined to them. "Anonymized" means setting all non-synthetic identifiers to NULL. "Pseudonymized" means replacing all non-synthetic identifiers with generated ones. "Sufficiently" means you ask yourself: "Would I be plausibly able to identify rows related to this one person I personally know stuff about?" But obviously, keeping user accounts to be able to provide them with their games is a given. No data protection agency would be able to convince a court that you should have made the games inaccessible without explicit instruction from the user. It's a textbook example of legitimate interest.
- happymellon 3y ago
  > Once the data are tied to email, IP address, SSN, eID, ID card or even a name, they are personal data. I don't use these game services, but do they really mandate that you provide this?