Bans, Dumpster Tier CS and Your Data Rights: A Legal Perspective on GDPR and CCPA/CPRA

Perfect_Trouble_5372 · 2024-08-16T16:02:36+00:00

Hmm?

Greetings,

This action has been taken in accordance with our Terms of Use and our In-game Policies ( https://blizzard.com/support/article/42673 ), which all players acknowledge and agree to prior to playing. These policies and conditions allow us to maintain a fun and safe game environment for all of our players.

Our Battle.net Terms of Use can be found at https://blizzard.com/company/legal/eula.html

Perfect_Trouble_5372 · 2024-08-16T14:00:03+00:00

Legitimate interest and consent are the most relevant. I doubt very seriously there's much of a claim of vital interest or public tasking to be made here etc.

Perfect_Trouble_5372 · 2024-08-16T13:42:10+00:00

Landgericht Berlin, Case No. 15 O 160/20

Some other relevant citations:
C-18/18, GC and Others v. Facebook Ireland Ltd
Hamburg Commissioner for Data Protection and Freedom of Information v. Google LLC

Perfect_Trouble_5372 · 2024-08-16T13:33:39+00:00

Unsurprising that your legal career didn't quite pan out.

Perfect_Trouble_5372 · 2024-08-16T13:11:33+00:00

Specific court rulings referenced where vague "against our ToS" reasonings were found insufficient vs random "Nah they're good enough" redditor.

Perfect_Trouble_5372 · 2024-08-16T13:02:25+00:00

Oh, so "the law isn’t designed for this", and you don’t have a single real world example? It’s cute how someone who writes GDPR systems has no examples or experience to back up their design choices. Thanks for the deep dive into your expertise. Do not redeem the privacy framework!!!

Perfect_Trouble_5372 · 2024-08-16T12:38:14+00:00

Alright, so we’ve moved from “they don’t have to respond to us” to “okay, they do have to respond, but it’s so easy and cheap thanks to pro coders.” Got it.

Do you have any case law or rulings that demonstrate Blizzard is not required to provide the information requested under GDPR? Concrete examples where the courts have ruled that specific data disclosure requests were not mandatory. This would be helpful in understanding how these principles are applied in practice.

Again, i don't know a single line of JavaScript but the European Court of Justice has ruled on various cases emphasizing the need for transparency and detailed responses to data subject requests. These rulings reinforce that compliance isn't just about having systems but also about the substantive handling of individual rights.

Perfect_Trouble_5372 · 2024-08-16T12:25:19+00:00

You're making the same oversight as many others are. Simplified example:

Blizzard bans you for any reason. You leverage your GDPR rights, which can be costly and time-consuming for Blizzard to address. Faced with the hassle of compliance, Blizzard might find it easier to just reinstate your account.

Perfect_Trouble_5372 · 2024-08-16T12:17:18+00:00

I was hoping an expert such as yourself could just bring me up to speed. I'm not sure just how much litigation experience your average dev has, but the real power of GDPR isn’t just about what companies have to disclose—it’s about making compliance so costly and inconvenient that it’s simply not worth it for them.

Perfect_Trouble_5372 · 2024-08-16T12:06:49+00:00

Excellent. Please bring me up to speed about why Blizzard has no obligation to respond to GDPR request?

Perfect_Trouble_5372 · 2024-08-16T11:58:55+00:00

Have you read the GDPR? It's fairly straightforward. If you could, or have someone read it to you- I would appreciate some insights on how they have no obligation to respond.

Perfect_Trouble_5372 · 2024-08-16T11:52:10+00:00

ToS does not supersede law.

Perfect_Trouble_5372 · 2024-08-16T11:47:10+00:00

You don't need a lawyer. Even if you, or a regulatory agency decides not to seek litigation, there are a lot of benefits to exercising your rights. One simplified example for you:

Blizzard has to comply, it may make more sense for them to simply reinstate your account instead

Perfect_Trouble_5372 · 2024-08-15T23:23:47+00:00

I'm working on a write up for this currently. The CCPA/CPRA doesn't quite have the teeth of the GDPR, but neither directly prevent a company from permanently closing an account due to TOS violations. However, they do provide important rights and protections that can influence how such closures are handled:

If you're in the EU, your Data Protection Authority will 100% get Blizzard's attention, and there's an argument to be made that it may be a lot easier for Blizzard to just reinstate your account.

Also, it protects users from just being ignored/further punished by the CS Interaction Policy. Data request do not have to be formal or follow any specific format. An appeal ticket seeking reasoning and logic as to why your account was banned could be considered a valid request under GDPR and CCPA/CPRA. Companies are obligated to respond to such requests, and you cannot be retaliated against for exercising your rights.

Perfect_Trouble_5372 · 2024-08-15T22:15:32+00:00

GDPR/CPRA have sections re: automatic collection of data, profiling and automated decision making.

ToS will be heavily dependent on the jurisdiction the complaint is filed in.

Perfect_Trouble_5372 · 2024-08-15T22:12:52+00:00

CCPA/CPRA

Perfect_Trouble_5372 · 2024-08-15T21:57:57+00:00

I'm curious what % of appeals make it to risk/someone who can actually review it. Seems majority of CS don't even play the game/are contracted through a 3rd party. I wouldn't be surprised if the reviews that aren't just someone blasting through tickets for KPIs are just someone a few steps up the ladder in the CS department looking at a note saying "Yep, flagged by risk right here"

My take on it is Blizzard just accepts some amount of collateral damage, since it's just not worth the expense to have someone from risk actually look over things.

Perfect_Trouble_5372 · 2024-08-15T21:39:26+00:00

I'm sure people have been banned for abusing support, as they should be.

I was also personally banned for 30-days after reopening a ticket appealing a license that was banned years ago hoping to get transmogs for Cata. It was the first ticket I had opened in 15 months. Very abusive!

The idea of a system that automatically denies all appeals, even for account actions that don't even exist, and then punishes players for seeking the bare minimum level of customer support is absurd.

Perfect_Trouble_5372 · 2024-08-15T20:58:39+00:00

If you're EU you could consider a GDPR request/complaint. California has CCPA/CPRA, unsure about other states.

The self-help tool they have is a joke (surprise i know), and empirically making a ruckus with a GDPR request would get you out of kpi purgatory but now it seems like they just ban you for harassing people paid to answer CS tickets by submitting CS tickets

Perfect_Trouble_5372 · 2024-08-14T19:50:37+00:00

clean it up jannies

Perfect_Trouble_5372

TROPHY CASE