Hacker News Reader

Comment by Mindwipe | Hacker News Reader

"Sony correctly implements GDPR requirements in the EU" is a less exciting headline I guess.

That is not how gdpr works. If you have a legitimate reason to hold the data. You can. Ensuring people have access to purchases is a very legitimate reason.

Is there evidence that European courts have sided with that? “We’re holding onto all your data indefinitely just in case you log in again several years from now” seems to be the antithesis of GDPR and I can’t discern the difference between that and what you’re suggesting.

I believe EU has dug their own hole here. And the best move would be to pass more legislation to explicitly require the retention (and transfer, ideally) of purchased digital goods.

No need to wait for the courts’ opinions: controllers must keep the data for a limited amount of time (which can be something like “3 years after the last connection”) under GDPR article 5(1)e.

To save everyone a click:

> Personal data shall be: kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. (..)

Note that this does not say "it must be stored for a limited amount of time" - it says "no longer than necessary".

Your basic account data (such as username and password, or an email for password recovery) is still necessary to log in to the platform and make use of your purchases. As long as there is no clear indication that the user will never log in again (such as due to death, or because they explicitly deleted their account), it would be reasonable to keep it around.

On the other hand, it may make sense to delete some data. For example, it may make sense to store your full name and address info to make checkout more convenient. If a user hasn't bought stuff in a while, it makes sense to delete it and have them re-enter it in the future.

There might be a bit of a gray space for things like game achievements (especially when there's a public profile) or savefile backups, but reading it as "you MUST delete all digital purchases because GDPR" is just not true.

I'd consider keeping the other personal data to be still easily justifiable, as you might want to support various account recovery options. And the odds that a user forgot their password only increases for old accounts.

5(1)c seems far more relevant than e. “Data minimization” is what’s relevant here. And the article is sufficiently vague that the onus is on companies to decide what is absolutely minimal - that includes, implicitly, removing inactive accounts. Unless the courts have made a judgement to the contrary.

"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed"

Keeping "account X purchased game Y" forever is necessary for the purpose of tracking ownership.

Based on how big companies typically behave, I assume that they are storing a metric buttload of other data on their users, which is not necessary for that purpose, and which they aren't inclined to separate out.

This is just like the cookie popup nonsense. You don't have to ask for permission to store necessary cookies. Cookie popups are ubiquitous because sites would rather bother every single visitor so that they can store unnecessary cookies.

> Is there evidence that European courts have sided with that?

Is there evidence of the contrary? Maybe any store can just delete your personal data right after charging your card and claim GDPR prevents them from shipping your product.

Silly arguments work both ways. You just picked the one that confirms your bias.

GDPR under no circumstances forces processors to delete everything, it defines legitimate interest. Retaining a person's purchases is as legitimate as it gets so the data can be retained for as long as the purchase is valid. And the license itself isn't even the user's personal data, it's just a license, so Sony could give the option to export that license to be used later - even in a cryptographically secure format that can only work if e.g. the account is created with the same email address. If they delete the personal data and throw out the baby with the water, it's not GDPR forcing them to do it.

The GDPR does not say that controllers must always delete personal data on request. Article 17(1)(a) — erasure is required only when:

"the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed"

https://gdpr-info.eu/art-17-gdpr

It's like the cookie banner all over again. This law never, ever required a cookie banner.

The big companies are master in malicious compliance that benefit them, and let them blame the EU for it.

Rules of thumbs, international billion dollars company should be assumed to be the ones being the bad guys until proven otherwise. They have lost the benefit of the doubt decades ago.

In practice most of the purposes you'd encounter in the wild are directly linked to user activity, so account deletion means most of the reasons to keep it disappear.

You still need to keep it if there's a law saying that you need to have that data, of course, but that's the exception.

If it’s malicious compliance and not required why does the EU Commission website have it?

https://commission.europa.eu

Because if enough idiots do it, stupid managers think it's the standard. The EU Commission is unlikely to know anything about their website, it's made by some department that blindly follows a manager's order that just looked at what others did and copied it.

We could all have used the DNT header as a bypass when the GPDR came out, and you can still use cookies for non tracking purposes without any banner.

So the EU commission put out a rule that you say has been widely misunderstood and implemented via malicious compliance. Where is the EU statement and education on this? Why aren’t they louder in explaining this isn’t what they wanted? And they allow their own websites to do the very thing that they supposedly don’t want?

Do you maybe want to reconsider? Perhaps instead companies are putting in a good faith effort to comply. I have been invoked in discussions around legal compliance of all sorts of regulation and trust me: no one has ever ever expressed “let’s do some terrible thing because we disagree with regulation”. It’s conspiratorial thinking.

No need for a conspiracy. There was the DNT standard, companies made more money from not taking it into consideration.

That's it.

They chose the annoying banners, then they chose dark patterns on those banners.

It is a choice.

At best they were lazy and greedy. At worse they were malicious.

Don’t change the topic.

The general council (lawyers) at companies are making the decisions around cookies banners and the like, not the folks trying to make money. Regardless of how you might interpret the law and requirements around GDPR, the legal profession as a whole seems to think the crap we live with today is necessary. If it isn’t, it’s on the EU technocrats to clarify in communications, written rules, and on their own damn website what it is supposed to look like.

Two things can be true.

And clearly, you think billion-dollar companies making dark patterns, ignoring web standards and choosing to track people left and right are less to blame the inconvenience of a banner (that warns you they do) than the people trying to protect your privacy and did it imperfectly.

I have made enought web sites and app that don't have a banner to know it's perfectly possible, even today.

I have implemented DNT support and know it was a great solution before it was taken away.

I have worked with enough clients to know why they chose the banner anyway.

Unlike you I actually read the law, and worked at implementing it. Including with and without a banner.

So I have to conclude you are not an honest actor in this debate, and you are clearly angry as well.

So I'll leave you at that.

You bet I am angry. I am tired of people defending a law by saying “that’s not what it was meant to do!” As if the intent matters one bit. What matters is the result of the law. And the result of this regulation is to make the web universally crappier than it was before. It did basically nothing to improve things in the real world.

And that data must be held for a limited amount of time under GDPR article 5(1)e. Sony’s policy is very much a consequence of this.

Reply on news.ycombinator.com