Hacker News Reader

Comment by jjcon | Hacker News Reader

Because GDPR puts restrictions on how inactive or deprecated account data can be kept - to prevent mining of forgotten accounts I suspect was the intention

View on HN

GDPR just says you cannot keep personal data for longer than is required for the purpose it was collected for (with some exceptions where it can be kept longer).

If you have paid for digital goods with an account, the data is clearly required! Deleting an inactive account after say a year is a choice made by the company, not directly imposed by GDPR.

The problem is that distinction isn’t made clear in the actual law - which is again - why meta is far from alone here even in the gaming space itself. It’s on the EU to clarify compliance here otherwise we will continue to have stories pop up like this.

The law is deliberately silent on exactly how long "necessary" is, as it cannot possibly define that for all uses of personal data in all circumstances.

It's trying to establish principles of good personal data governance, rather than being prescriptive about all uses of data.

This does make it hard for legal teams to determine compliance I guess. But don't expect the EU to be more definite any time soon!

I don't think that extends to "forgetting" that you purchased a game so now you have to buy it again. That would be absurd.

They aren’t the only gaming company to interpret GDPR that way and they are arguably target #1 by EU regulators so they don’t have room to misinterpret

Here is one of the provisions of interest:

https://gdpr-info.eu/art-5-gdpr/

Ubisoft also cites GDPR provisions for deletion of inactive accounts:

https://www.gamepressure.com/newsroom/ubisoft-removes-player...

This is nonsense. While you cannot keep personal data lying around forever with GDPR, deleting accounts after 6 months or a year or inactivity is a choice being made by the company.

They could equally well have said that an account which was inactive for 2 years, or 3 years would be deleted and still be legally compliant.

The requirement is “no longer than necessary” - meta started migrating people away from oculus accounts with the release of the quest 2 over 2 years ago in 2020.

If you have regulators breathing down your neck being conservative on time isn’t a terrible idea.

> They aren’t the only gaming company to interpret GDPR that way and they are arguably target #1 by EU regulators so they don’t have room to misinterpret

Malicious compliance. They deliberately misinterpret and continue to get pulled up on it. For example, just recently: https://www.bbc.co.uk/news/technology-63784393

This completely contradicts any argument that their interpretation of privacy regulation is remotely compliant. They cross the line in their favour relentlessly.

Malicious compliance maybe but compliance nonetheless - I’m not necessarily defending them here for the record but GDPR has been cited for a lot of inactive account removals recently - meta is already feeling heat from EU regulators - they may not want to take chances.

i never heard of this, can you link the gdpr article on this?

Reply on news.ycombinator.com