5 ms·

Billing information = PII, so it is subject to privacy regulations. In many jurisdictions the law allows to store and process PII no longer than needed. If an a

Billing information = PII, so it is subject to privacy regulations. In many jurisdictions the law allows to store and process PII no longer than needed. If an account becomes inactive and all other retention deadlines expire, keeping the data may be a violation. To be on the safe side and to satisfy users I would allow users in such cases to download the digitally signed account data and offer the possibility to upload it again.

deleted 3y ago
[deleted]
Shank 3y ago
This doesn't make any sense. This makes sense if the account is inactive and has no active licenses to it, but like, if you buy game X with whatever the industry-current licensing is, and the expectation is that you have a license as long as you have an account, termination is silly. You have an active agreement (i.e., the license) to use the product. That's a contractual/business relationship. You could just as easily delete all of the PII in the account by sending someone an email saying "your licenses are now attached to these codes, please use them to reactivate your licenses with a new account if you want to access them" but they don't. They just delete them. There are many ways to square this circle.
- ivan_gammel 3y ago
  If you can prove that there is a person with the access to the account and it was the intent of the buyer for this person to have access, then fine, account can be kept. The email notification they send is proving exactly that.
  - jstanley 3y ago
    You have it backwards. Only if you can prove that there is not a person with access to the account and intention to access it can the account be deleted.
    - ivan_gammel 3y ago
      This proof is technically impossible and thus does not make sense as a solution. We are living in the world where zero trust is default and bad things happen, so the ONLY right way to protect customer data is to verify the identity regularly, rather than declaring it valid once and forever until proven otherwise.
      - eviks 3y ago
        We aren't living in this world, that's your imagination. Rather than making the users suffer by default, identify a more specific "bad thing" and address only that with the min user inconvenience
      - horsawlarway 3y ago
        Dude... come off it. You're wrong here, both legally and technically (and in my opinion, also ethically). In the bluntest possible way, even if you were correct (and you're not...): They could have just deleted the billing information and not the account. Ubisoft designed products that require an online account to use - Ubisoft is on the hook for providing that online access for account holders because they paid for that product. Alternatively - in any region with good consumer protection laws, they're about to issue a lot of full refunds.
      - brnt 3y ago
        A digital purchase is often the purchase of a license to download and execute the product. If that's the contract, then it is necessary to keep some PI on file in order to respect the terms of the contract: offer a download upon request to a particular person. No need to keep PI on file indefinitely: the purchaser is enabled to take their wares and the store to remove accounts if dealing with PI laws is too much hassle. If this is too much hassle, they could instead sell a license to execute the software, regardless of how it is obtained (but offering a way to download for now, putting the purchaser in charge of backing up those files). Similar to what GOG are doing. But no, that's not enough control for them either. They want to have their cake and eat it too.
- brnt 3y ago
  Precisely. Storefronts want their cake and eat it too: they want to take control they have over the license from the user, but without the obligation of actually keeping it accessible forever to the user.
pjc50 3y ago
The GDPR has no rules around "activity", and lots of justifications available for "necessary to the business", in this case to continue to allow people to play the games they've paid for. Only angle I can see that this might work for is reducing the number of people you have to email when you get breached.
realusername 3y ago
Billing information isn't the same as game access, they can always delete the billing information and keep everything else. There's nowhere in the world that a list of owned games is considered as PII.
jon-wood 3y ago
I'm almost certain this is the reason. A lawyer somewhere in the company has seen "PII retained indefinitely" and lost their shit over it without ever looking at the context around that. No doubt a bunch of people internally have been hammering them with "but this will look terrible when we remove people's access to products they bought".
- patrickk 3y ago
  Any lawyer even vaguely familar with GPDR wouldn't be worried about this. There is a text that states: "processing is necessary for the performance of a contract to which the data subject is party.." and "processing is necessary for compliance with a legal obligation to which the controller is subject". It could be easily argued that providing an end customer with access to digital products they bought is part of the service that data subjects signed up for, so retaining PII indefintely is 100% allowed (unless the data subject explicitly requets their account to be permanently deleted). [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- ajmurmann 3y ago
  You are probably right. Most of my experience with corporate lawyers has been all about minimizing risk even if it means losing out on substantial business while there has been zero interest to find a solution. The root cause, as usual, is terrible incentive design where lawyers get punished when a legal problem occurs, but don't get rewarded when they consulted on finding a good solution that allowed the business to thrive.
daemin 3y ago
If that's the case then it would be simpler to just put that as the reason accounts can be closed. It would shift the blame to some government and at least give an air of transparency to the whole thing.
- Anthony-G 3y ago
  I’m in Europe so I’m more familiar with GDPR than privacy regulations for other jurisdictions but it would be a gross abuse/misinterpretation of GDPR to use it as an excuse for closing down accounts of customers who have already paid for their games. GDPR does require data controllers to remove data subjects from their database but only if there is no legitimate reason to keep their account information.
  - ivan_gammel 3y ago
    Active account is a legitimate reason. Inactive account and no explicit consent to keep the data -> no evidence that customer still wants to keep the data -> no legitimate reason -> better be deleted. As a child you may leave your toy in playground, return back in 1 hour and it may still be there. If you come back in 10 years it would be an unjustified expectation to find it there. As an adult you buy a property, abandon it and in 30-40 years it is no longer yours. Why in the digital world it should not be the same?
    - eviks 3y ago
      The answer is pretty obvious - because the digital world is fundamentally different, and you toy doesn't occupy any playground space, and also it's not publicly accessible, and you haven't paid for your toy to stay they, etc
    - Bluecobra 3y ago
      Except I never abandoned my copy of Far Cry 4. A better analogy would be a book on a shelf. I may not complete a book I bought 10 years ago but I may revisit it anytime.
whstl 3y ago
If you can't hold billing information just delete it. If you can't keep first/last name, or birthday, just delete it. However in pretty much every jurisdiction, keeping any kind of information FOR THE BENEFIT OF THE CUSTOMER is 100% allowed, encoded in the law, used as examples and is within the spirit of the law. Any judge, lawyer or layman would laugh at the idea that GDPR can be used as an excuse to force users to re-buy products.
- ivan_gammel 3y ago
  If you are no longer certain that customer has access to their account, indefinite data storage becomes a liability, not a service. „For the benefit of the customer“ is too vague justification for it, you need a more specific reason.
  - worrycue 3y ago
    Then just delete the offending information. No need to delete the account and the game they contain.
  - whstl 3y ago
    Nope. It's not really vague at all, and is quite clear in the law in several places. You can keep data in your servers without consent if that data is there to serve the interests of user. In this case, the interest of the user is getting access to the games they purchased and paid for (!!!). This is called "legitimate interest". A company can keep the address and phone of their customers if they're providing services that require address and phone. Package delivers don't even have to ask for consent to deliver a package to someone, for example. If you need email to guarantee that the user can access the games, it's fine to keep it. The law is not as stupid as Silicon Valley tries to paint it. I'm pretty certain that Ubisoft is breaking GDPR and other similar laws in several places, but "keeping data to provide a service" is the one place they're not.
    - ivan_gammel 3y ago
      Given an inactive account that does not respond to emails and the risk of PII theft, what is the best interest of a customer? Now add the costs of maintaining such accounts, which did not accept the latest ToS, did not migrate to the latest version of software etc, what is the best interest of the business? I do not think that the answer "keep the data" is obvious. In real world nearly everything has an expiry date, beyond which product is no longer usable if you do not invest in maintenance. Who said that in digital world it should be different?
Hendrikto 3y ago
> In many jurisdictions the law allows to store and process PII no longer than needed. 1. I think this is a misunderstanding of the GDPR. You are allowed to keep and process PII, as long as you have a justification. Keeping the user‘s purchases around would be such a justification, as would be consent. 2. Even if you were right, they could still keep your account and games around, and just delete the billing info.

deleted 3y ago

[deleted]

Shank 3y ago

This doesn't make any sense. This makes sense if the account is inactive and has no active licenses to it, but like, if you buy game X with whatever the industry-current licensing is, and the expectation is that you have a license as long as you have an account, termination is silly. You have an active agreement (i.e., the license) to use the product. That's a contractual/business relationship. You could just as easily delete all of the PII in the account by sending someone an email saying "your licenses are now attached to these codes, please use them to reactivate your licenses with a new account if you want to access them" but they don't. They just delete them. There are many ways to square this circle.

ivan_gammel 3y ago
If you can prove that there is a person with the access to the account and it was the intent of the buyer for this person to have access, then fine, account can be kept. The email notification they send is proving exactly that.
- jstanley 3y ago
  You have it backwards. Only if you can prove that there is not a person with access to the account and intention to access it can the account be deleted.
  - ivan_gammel 3y ago
    This proof is technically impossible and thus does not make sense as a solution. We are living in the world where zero trust is default and bad things happen, so the ONLY right way to protect customer data is to verify the identity regularly, rather than declaring it valid once and forever until proven otherwise.
    - eviks 3y ago
      We aren't living in this world, that's your imagination. Rather than making the users suffer by default, identify a more specific "bad thing" and address only that with the min user inconvenience
    - horsawlarway 3y ago
      Dude... come off it. You're wrong here, both legally and technically (and in my opinion, also ethically). In the bluntest possible way, even if you were correct (and you're not...): They could have just deleted the billing information and not the account. Ubisoft designed products that require an online account to use - Ubisoft is on the hook for providing that online access for account holders because they paid for that product. Alternatively - in any region with good consumer protection laws, they're about to issue a lot of full refunds.
    - brnt 3y ago
      A digital purchase is often the purchase of a license to download and execute the product. If that's the contract, then it is necessary to keep some PI on file in order to respect the terms of the contract: offer a download upon request to a particular person. No need to keep PI on file indefinitely: the purchaser is enabled to take their wares and the store to remove accounts if dealing with PI laws is too much hassle. If this is too much hassle, they could instead sell a license to execute the software, regardless of how it is obtained (but offering a way to download for now, putting the purchaser in charge of backing up those files). Similar to what GOG are doing. But no, that's not enough control for them either. They want to have their cake and eat it too.
brnt 3y ago
Precisely. Storefronts want their cake and eat it too: they want to take control they have over the license from the user, but without the obligation of actually keeping it accessible forever to the user.

pjc50 3y ago

The GDPR has no rules around "activity", and lots of justifications available for "necessary to the business", in this case to continue to allow people to play the games they've paid for. Only angle I can see that this might work for is reducing the number of people you have to email when you get breached.

realusername 3y ago

Billing information isn't the same as game access, they can always delete the billing information and keep everything else. There's nowhere in the world that a list of owned games is considered as PII.

jon-wood 3y ago

I'm almost certain this is the reason. A lawyer somewhere in the company has seen "PII retained indefinitely" and lost their shit over it without ever looking at the context around that. No doubt a bunch of people internally have been hammering them with "but this will look terrible when we remove people's access to products they bought".

patrickk 3y ago
Any lawyer even vaguely familar with GPDR wouldn't be worried about this. There is a text that states: "processing is necessary for the performance of a contract to which the data subject is party.." and "processing is necessary for compliance with a legal obligation to which the controller is subject". It could be easily argued that providing an end customer with access to digital products they bought is part of the service that data subjects signed up for, so retaining PII indefintely is 100% allowed (unless the data subject explicitly requets their account to be permanently deleted). [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
ajmurmann 3y ago
You are probably right. Most of my experience with corporate lawyers has been all about minimizing risk even if it means losing out on substantial business while there has been zero interest to find a solution. The root cause, as usual, is terrible incentive design where lawyers get punished when a legal problem occurs, but don't get rewarded when they consulted on finding a good solution that allowed the business to thrive.

daemin 3y ago

If that's the case then it would be simpler to just put that as the reason accounts can be closed. It would shift the blame to some government and at least give an air of transparency to the whole thing.

Anthony-G 3y ago
I’m in Europe so I’m more familiar with GDPR than privacy regulations for other jurisdictions but it would be a gross abuse/misinterpretation of GDPR to use it as an excuse for closing down accounts of customers who have already paid for their games. GDPR does require data controllers to remove data subjects from their database but only if there is no legitimate reason to keep their account information.
- ivan_gammel 3y ago
  Active account is a legitimate reason. Inactive account and no explicit consent to keep the data -> no evidence that customer still wants to keep the data -> no legitimate reason -> better be deleted. As a child you may leave your toy in playground, return back in 1 hour and it may still be there. If you come back in 10 years it would be an unjustified expectation to find it there. As an adult you buy a property, abandon it and in 30-40 years it is no longer yours. Why in the digital world it should not be the same?
  - eviks 3y ago
    The answer is pretty obvious - because the digital world is fundamentally different, and you toy doesn't occupy any playground space, and also it's not publicly accessible, and you haven't paid for your toy to stay they, etc
  - Bluecobra 3y ago
    Except I never abandoned my copy of Far Cry 4. A better analogy would be a book on a shelf. I may not complete a book I bought 10 years ago but I may revisit it anytime.

whstl 3y ago

If you can't hold billing information just delete it. If you can't keep first/last name, or birthday, just delete it. However in pretty much every jurisdiction, keeping any kind of information FOR THE BENEFIT OF THE CUSTOMER is 100% allowed, encoded in the law, used as examples and is within the spirit of the law. Any judge, lawyer or layman would laugh at the idea that GDPR can be used as an excuse to force users to re-buy products.

ivan_gammel 3y ago
If you are no longer certain that customer has access to their account, indefinite data storage becomes a liability, not a service. „For the benefit of the customer“ is too vague justification for it, you need a more specific reason.
- worrycue 3y ago
  Then just delete the offending information. No need to delete the account and the game they contain.
- whstl 3y ago
  Nope. It's not really vague at all, and is quite clear in the law in several places. You can keep data in your servers without consent if that data is there to serve the interests of user. In this case, the interest of the user is getting access to the games they purchased and paid for (!!!). This is called "legitimate interest". A company can keep the address and phone of their customers if they're providing services that require address and phone. Package delivers don't even have to ask for consent to deliver a package to someone, for example. If you need email to guarantee that the user can access the games, it's fine to keep it. The law is not as stupid as Silicon Valley tries to paint it. I'm pretty certain that Ubisoft is breaking GDPR and other similar laws in several places, but "keeping data to provide a service" is the one place they're not.
  - ivan_gammel 3y ago
    Given an inactive account that does not respond to emails and the risk of PII theft, what is the best interest of a customer? Now add the costs of maintaining such accounts, which did not accept the latest ToS, did not migrate to the latest version of software etc, what is the best interest of the business? I do not think that the answer "keep the data" is obvious. In real world nearly everything has an expiry date, beyond which product is no longer usable if you do not invest in maintenance. Who said that in digital world it should be different?

Hendrikto 3y ago

> In many jurisdictions the law allows to store and process PII no longer than needed. 1. I think this is a misunderstanding of the GDPR. You are allowed to keep and process PII, as long as you have a justification. Keeping the user‘s purchases around would be such a justification, as would be consent. 2. Even if you were right, they could still keep your account and games around, and just delete the billing info.