PSA: Relevant section of the new PoE Terms of Service under the GDPR

"

Abdiel_Kavash wrote:

There are only two significant changes in parts other than the Privacy and Cookie Use policy:

didn't they add the whole new section for "PRIVACY POLICY: GDPR TERMS"?

While Exile009 is correct in that it's kind of disgusting that businesses have specifically designed ToS agreements to be as dense, unreadable, and offputting as possible to force people to ignore them and just go "yes FINE I get it I have no rights and no privacy yadda yadda yadda" (guilty as charged - I never read ToS agreements because they're insane, and I simply assume I'm shafted in all possible ways anyways), the GDPR is in part aiming to help address this. For those people who're still too Twitterpated to pay attention to what looks like a very useful summary...:

"

Exile009 wrote:

tl;dr version - Right of Access, Right to Rectification, Right to Erasure, Right to Withdraw Consent, Right to Restrict Processing, Right to Object to Processing, Right to Data Portability, Right to Complain to a supervisory authority. To exercise any of your above rights, contact support@grindinggear.com.

The General Data Protection Regulation (GDPR) is a European law that says companies can't steal your private data or use it to fuck you over/profiteer with marketing firms unless they explicitly ask you if they can do that. You've got a number of rights according to the system, each of which you can exercise by contact Grinding Gear's support system.

"

Exile009 wrote:

"Right of Access - if you ask Grinding Gear Games, it will confirm whether it is processing your personal data and provide you with a copy of that personal data.

GGG isn't allowed to hide your data from you or prevent you from knowing what they've collected. If you say "give me a copy of everything you've got on me", they're legally obligated to do it.

"

Exile009 wrote:

Right to Rectification - if the personal data Grinding Gear Games holds about you is inaccurate or incomplete, you have the right to have it rectified or completed. Grinding Gear Games will take every reasonable step to ensure personal data which is inaccurate is rectified. If Grinding Gear Games has shared your personal data with any third parties, it will tell them about the rectification where possible.

If you find out data that GGG has on you is incorrect, you can demand they fix it and they have to do so. Furthermore, they have to tell anyone else who got a copy of your incorrect data from them to also fix it.

"

Exile009 wrote:

Right to Erasure – Grinding Gear Games will delete your personal data when it is no longer needed for the purposes for which you provided it. You may request that Grinding Gear Games delete your personal data and it will do so if deletion does not contravene any applicable laws. If Grinding Gear Games has shared your personal data with any third parties, it will take reasonable steps to inform those third parties to delete such personal data.

At any time, you can tell Grinding Gear to purge your data from their systems and they have to do so. This will probably break your ability to use GGG's stuff, but Grinding Gear is not allowed to say 'no' if you tell them to erase your information in their systems. They can probably ask you why or warn you that doing so will essentially void your ability to play the game, but they CANNOT refuse to delete your information. Same as before, as well: if anyone else has a copy of GGG's data on you and you ask GGG to delete it, they are required to tell the other people who have your information to delete it, as well.

"

Exile009 wrote:

Right to Withdraw Consent - if the basis of Grinding Gear Games’ processing of your personal data is consent, you can withdraw that consent at any time.

You can un-agree to anything Grinding Gear asks you to agree to at any time, including things such as 'by using this website, you agree to our We-Can-Steal-Your-Data-Whenever' agreements that the GDPR was specifically put in place to break. Any permission you've given Grinding Gear concerning your personal data, you can revoke at any time and un-permit.

"

Exile009 wrote:

Right to Restrict Processing - you may request that Grinding Gear Games restrict or block the processing of your personal data in certain circumstances. If Grinding Gear Games has shared your personal data with third parties, it will tell them about this request where possible.

You can set terms on where, when, and how GGG is allowed to process your data. This is a little confusing, but seems to amount to you having the ability to selectively decide how Grinding Gear can use your data, rather than having to agree to an all-or-nothing Google Tyranny type dealio where either you disengage from the service completely or Google is free to do whatever it likes with your data.

"

Exile009 wrote:

Right to Object to Processing - you may request that Grinding Gear Games stops processing your personal data at any time and it will do so to the extent required by the GDPR.

You can tell Grinding Gear that you want them to stop using your data. At any time you can say "Stop doing stuff with my data", which is different than "delete my data". Again, this also extends to anyone else who obtained a copy of GGG's data on you - any such organization is also bound by GGG's agreements with you.

"

Exile009 wrote:

Right to Data Portability - you may obtain your personal data from Grinding Gear Games that you have consented to give it or that is necessary to perform a contract with you. Grinding Gear Games will provide this personal data in a commonly used, machine-readable and interoperable format to enable data portability to another data controller. Where technically feasible, and at your request, it will transmit your personal data directly to another data controller.

Grinding Gear isn't allowed to hoard your data. You can demand at any time that they give it to you in easily usable form, or give it directly to someone else you want to have it in that same usable form. They can't try to make it difficult for you to move your data around.

"

Exile009 wrote:

Right to Complain to a supervisory authority - you can report any concerns you have about Grinding Gear Games’ privacy practices to the relevant data protection supervisory authority e.g. in the United Kingdom, this is the Information Commissioner’s Office.

You're explicitly allowed to go to whatever watchdog organization your region/country has and complain about possible issues you have with Grinding Gears' handling of your data. If you believe GGG is being noncompliant with the GDPR or their own rules, then you as an individual are allowed by European law to tell someone about that and Grinding Gear can't punish you for it, i.e. through termination of service (banning you from the game forever).

"

Exile009 wrote:

Where personal data is processed for the purposes of direct marketing, you have the right to object to such processing, including profiling related to direct marketing. If you would like to exercise any of your above rights, please contact us at support@grindinggear.com. If you are not satisfied by the way your query is dealt with by Grinding Gear Games, you may refer your query to your local data protection supervisory authority."

'Direct Marketing' means bullshit like what Cambridge Analytics pulled that started this whole mess. You can tell Grinding Gear they're not allowed to sell your data to filthy marketing clowns, and can also tell Grinding Gear not to use your data for consumer profiling or any other market analysis work. If you want to take advantage of any of these powers granted you as a consumer by the GDPR, contact support@grindinggear.com and tell them what you want done with your data. If GGG doesn't comply with your request, you can report them to whatever official privacy watchdog is active in your region and then GGG will have to answer to them.

How much of this applies to individuals outside of Europe is anyone's guess. But if you're in Europe, the GDPR provides strong protection against data bullfuckery and the rampant theft of private data by corporations looking to maliciously abuse it for unearned profits.

Now if only we can make steps on the Terms of Service thing and start passing some laws on things companies aren't allowed to put in their ToS (example: I guarantee that virtually every ToS you've ever agreed to states that you're not allowed to sue or otherwise seek legal restitution from the company and have to 'agree to arbitration' instead, i.e. if the company fucks you over you're legally disallowed from complaining about it), we'd start making actual process in the digital rights front.

Here's how I know you supposed TOS readers are full of shit.

Nobody says a thing for months or years, then ONE person reads it and post about some BS stuff in it. All of sudden EVERYONE is an expert and are like "of course I read it!" Come on bruh...

"

Shabob wrote:

Here's how I know you supposed TOS readers are full of shit.

Nobody says a thing for months or years, then ONE person reads it and post about some BS stuff in it. All of sudden EVERYONE is an expert and are like "of course I read it!" Come on bruh...

There was no reason to post anything since nothing actually changed. The new law is active since today, so it is pretty obvious that this is a good time to comment on it.

From what I experienced so far GGG already didn't do things that are too offendable, so they mostly had to do some rewriting to make clear how they act.

The two most important things is are transperancy, iE you can now demand information on which data a company owns (this is even true if you dont interact, facebook has to give you that data even if you dont have a facebook account), this part was already true due to court decisions but was codified into law. Another thing that was also decided by court is the right to be forgotten, it basically gives you the right to demand deletion of your data.

And the reason why people are more knowledgable now is because european media does a lot to inform them about the new rules, because while they are good for customers, they can be harsh for people running small online communities, because they also have to comply with those rules, so a lot of people having their own internet presence in some form have to comply and simply need to be informed.

Interestingly while usually US laws are driving the international standard this time it is the europeans, because many companies (including bigger ones like microsoft) announced that they will apply the european rules worldwide and give all their customers the same rights.