3 ms·

If you are no longer certain that customer has access to their account, indefinite data storage becomes a liability, not a service. „For the benefit of the cus

If you are no longer certain that customer has access to their account, indefinite data storage becomes a liability, not a service. „For the benefit of the customer“ is too vague justification for it, you need a more specific reason.

worrycue 3y ago
Then just delete the offending information. No need to delete the account and the game they contain.
whstl 3y ago
Nope. It's not really vague at all, and is quite clear in the law in several places. You can keep data in your servers without consent if that data is there to serve the interests of user. In this case, the interest of the user is getting access to the games they purchased and paid for (!!!). This is called "legitimate interest". A company can keep the address and phone of their customers if they're providing services that require address and phone. Package delivers don't even have to ask for consent to deliver a package to someone, for example. If you need email to guarantee that the user can access the games, it's fine to keep it. The law is not as stupid as Silicon Valley tries to paint it. I'm pretty certain that Ubisoft is breaking GDPR and other similar laws in several places, but "keeping data to provide a service" is the one place they're not.
- ivan_gammel 3y ago
  Given an inactive account that does not respond to emails and the risk of PII theft, what is the best interest of a customer? Now add the costs of maintaining such accounts, which did not accept the latest ToS, did not migrate to the latest version of software etc, what is the best interest of the business? I do not think that the answer "keep the data" is obvious. In real world nearly everything has an expiry date, beyond which product is no longer usable if you do not invest in maintenance. Who said that in digital world it should be different?
  - vincnetas 3y ago
    What is the expiration date of US constitution? Reasonable expectation for personal account of a human being would be maximum life expectancy of a human or notification of death of the user.
    - ivan_gammel 3y ago
      US constitution has already expired in my opinion as an external observer. ,) It is not a good example, anyway, because it is not a product and not something in possession. Reasonable expectation of account life time is the period when the user needs it, no more and no less, and it is not the same period as the life of the user.
  - Beldin 3y ago
    Privacy laws are not about the best interest of the business. As pointed out above, you are allowed to keep all data necessary to provide your customer what they purchased. Losing that data is not the customer's problem, but yours. If you cannot keep your customer data safe indefinitely, then maybe you should've settled on a business model that does not require keeping customer data indefinitely.
  - whstl 3y ago
    What “PII” has risk of theft? Passwords should be properly hashed. Heck, just delete the password and let the user ask for another if need be. If there is ANY unnecessary data that was collected but that doesn’t need to be there, or that needs consent to be stored, just delete it. Easy peasy. List of games owned? Email address? That doesn’t need consent, because it’s legitimate interest. It is 100% in the customer’s interest to have game ownership information long term, and deleting it would cause actual loss to the customer. That’s probably as bad as having PII leak! And what's that “cost of maintaining accounts”? Less than a kb of data per customer, on average? Probably just a few database tables? Once again, if there's unnecessary PII, just delete it. This whole thing is just to force customers to re-purchase games. > In real world nearly everything has an expiry date, beyond which product is no longer usable That’s clearly not true. There are several products that don’t have it. But in the case of games/software it is worse, because the expiration date is 100% artificial: since the games need authorization servers to run, the expiration is under control of the company.

worrycue 3y ago

Then just delete the offending information. No need to delete the account and the game they contain.

whstl 3y ago

Nope. It's not really vague at all, and is quite clear in the law in several places. You can keep data in your servers without consent if that data is there to serve the interests of user. In this case, the interest of the user is getting access to the games they purchased and paid for (!!!). This is called "legitimate interest". A company can keep the address and phone of their customers if they're providing services that require address and phone. Package delivers don't even have to ask for consent to deliver a package to someone, for example. If you need email to guarantee that the user can access the games, it's fine to keep it. The law is not as stupid as Silicon Valley tries to paint it. I'm pretty certain that Ubisoft is breaking GDPR and other similar laws in several places, but "keeping data to provide a service" is the one place they're not.

ivan_gammel 3y ago
Given an inactive account that does not respond to emails and the risk of PII theft, what is the best interest of a customer? Now add the costs of maintaining such accounts, which did not accept the latest ToS, did not migrate to the latest version of software etc, what is the best interest of the business? I do not think that the answer "keep the data" is obvious. In real world nearly everything has an expiry date, beyond which product is no longer usable if you do not invest in maintenance. Who said that in digital world it should be different?
- vincnetas 3y ago
  What is the expiration date of US constitution? Reasonable expectation for personal account of a human being would be maximum life expectancy of a human or notification of death of the user.
  - ivan_gammel 3y ago
    US constitution has already expired in my opinion as an external observer. ,) It is not a good example, anyway, because it is not a product and not something in possession. Reasonable expectation of account life time is the period when the user needs it, no more and no less, and it is not the same period as the life of the user.
- Beldin 3y ago
  Privacy laws are not about the best interest of the business. As pointed out above, you are allowed to keep all data necessary to provide your customer what they purchased. Losing that data is not the customer's problem, but yours. If you cannot keep your customer data safe indefinitely, then maybe you should've settled on a business model that does not require keeping customer data indefinitely.
- whstl 3y ago
  What “PII” has risk of theft? Passwords should be properly hashed. Heck, just delete the password and let the user ask for another if need be. If there is ANY unnecessary data that was collected but that doesn’t need to be there, or that needs consent to be stored, just delete it. Easy peasy. List of games owned? Email address? That doesn’t need consent, because it’s legitimate interest. It is 100% in the customer’s interest to have game ownership information long term, and deleting it would cause actual loss to the customer. That’s probably as bad as having PII leak! And what's that “cost of maintaining accounts”? Less than a kb of data per customer, on average? Probably just a few database tables? Once again, if there's unnecessary PII, just delete it. This whole thing is just to force customers to re-purchase games. > In real world nearly everything has an expiry date, beyond which product is no longer usable That’s clearly not true. There are several products that don’t have it. But in the case of games/software it is worse, because the expiration date is 100% artificial: since the games need authorization servers to run, the expiration is under control of the company.