What if you don't have the original account's information?

Let's say there's an api on https://example.com/api/v1/users which is world-readable and contains two values: user id and user rank. You scrape all this and put it in your database. I come to you and say "I'm user id 1234 and I want you to delete me from your db". Is this a legitimate request?

This is the situation R6DB is in. Furthermore, in such situations there's a case to be made that this information cannot be deleted if the whole point of the site is to provide global rankings.

It doesn't matter if you can correlate user id and account holder, what matters is that somebody can. That's the same reason why IPs are considered personal information.

>Furthermore, in such situations there's a case to be made that this information cannot be deleted if the whole point of the site is to provide global rankings.

You don't have to delete it, anonymizing is enough. For global rankings you don't need to know that user 1456 has rank 56, you just need to know that somebody holds that rank. So whenever a user requests to be deleted, replace his id with -1 (or choose a random number outside the normal range) and you have satisfied the request (only the PII needs to be deleted, not everything about the user).

>It doesn't matter if you can correlate user id and account holder, what matters is that somebody can

This is absurd and 100% bullshit. It means anything and everything is now personal data, even randomly generated data.

A lot of user ids are literally randomly generated data (for example any UUID used as user id). That doesn't make it less useful.

But that doesn't mean that everything is personally identifying information. "I am 53 and like Harry Potter" isn't enough to identify me, so it isn't PII and isn't covered by GDPR. My Blizzard username is enough for Blizzard to identify me, so it is PII.

The important concept here is that in Europe, data protection laws are not only protection against corperations, they are also protection against nation states. We had a few bad experiences with the effects of government surveilance, and we had a few bad dictators in the last century.

> For global rankings you don't need to know that user 1456 has rank 56, you just need to know that somebody holds that rank.

Isn't the purpose of global rankings to know how any given user is ranked globally? It's not much of a ranking system if all you can say is, "Yes, we have one million users, and they are ranked 1 to 1,000,000. We are not able to identify who is what rank."

What's wrong with "we have one million users. You are ranked 45698th. The one below you is proplaya92, the one above you chose to have his name redacted" (but we can tell you his playtime on all characters, his k/d ratio, etc).

Funny thing is that even if you do such request, company refuse and then you make a complaint which for example is thrown out, you still won't know what is the best practice, because there is no such thing as precedent there. Each case is judged individually. Actual compliance depends on particular civil servant's interpretation who is handling a complaint about your company.

The question is, who is the owner of this data? Is it Blizzard or is it R6DB? I would say, the burden is upon Blizzard, so they would be the designated Controller of the data. R6DB would then need to sign a Processor agreement with Blizzard, of which one requirement is to delete certain data upon Blizzard’s request.

R6DB could also position themselves as the controller of this data, but that would put quite a bit of the burden on them.

But this is my interpretation of the situation. Would probably need a more in-depth discussion with both parties to figure out what the intentions are.

Is that really how you think GDPR will be interpreted? As a European, are you OK with that?

If a football team plays, and a stats website (call it ERDB) uses Eredivisie's API to get player stats and then publishes them, should ERDB have to be processor? Then there would have to be a processor agreement every time Eredivisie issues an API key. And they can't have a public API. And if ERDB wants to switch from AWS to GCP that will have to get written approval from Eredivisie for a new sub-processor?

Is that really the world people want to live in?

It's an interesting question. There are some exceptions for lawful processing under GDPR[1]:

> Processing shall be lawful only if and to the extent that at least one of the following applies:

> processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

> processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

So in this case, it's probably the case that any athlete will have to sign a contract saying they are OK sharing their stats publicly in order to play. If an athlete sued Eredivisie to try to be forgotten from the league tables, how would that case be decided?

It's also worth noting that in the original "right to be forgotten" case that Google lost, the original newspaper articles reporting the criminal cases were not required to be expunged, so there is still a "public interest" defense for keeping information about people in public. It's certainly unclear exactly where the boundary is on that though.

I wonder also if there is an argument that a professional player's stats are not Personal Data; those stats are a record of events that occurred in public, while engaging in a performance. IANAL so interested in opinions of more knowledgable folks on this one.

[1]: https://gdpr-info.eu/art-6-gdpr/

> Is that really the world people want to live in?

That’s the world as legislated.

Could Blizzard deny signing the Processor agreement, thus effectively limiting the access to their, otherwise public, API?

Under GDPR, the Controller is the entity that the Data Subject gives their Personal Data to, and the preponderance of responsibility for managing that data lies with the Controller.

If the API data under discussion here includes "personal data", then Blizzard shouldn't (under GDPR) be sharing it publicly; Blizzard is the Controller, and it's their responsibility to ensure that only known and compliant Processors get access to the PI. (E.g. there is a requirement that all Processing activity is done under a binding contract (https://gdpr-info.eu/art-28-gdpr/ SS 3))

When an individual wants to be forgotten, they can contact Blizzard (as the Controller) and tell Blizzard to delete all their PI. It's Blizzard's responsibility to ensure that all Processors delete the PD that Blizzard gave to them.

So in this case, my conclusion would be that it's Blizzard's responsibility to either anonymize the data so that it contains no PD (this might be the case already), or stop sharing the PD publicly and require a DPA (Data Processing Addendum) signed by all API consumers. Obviously the second case is not very palatable.

what if data is

customer_ID -> address

I can zero in that its someone that lives in that house but not who it is.

What about

customerID -> IpAdress

I can look up ipaddress at a later point to and identify a subset of ppl with that IP.

Whould that be considered personal data.

As soon as you could reasonably pinpoint it to a certain person, it becomes PII. A classic example includes a combination of zipcode, gender and age. While individually they would not be a problem, it’s the combination of these different parameters that allow you to narrow the pool so much it can reasonably assumed to be PII.

> . While individually they would not be a problem, it’s the combination of these different parameters that allow you to narrow the pool so much it can reasonably assumed to be PII.

There are zipcodes in USA with only 1 person. So storing just zipcode would be ID information. Its an extereme example but how can machine check whats 'reasonable' in this case, go off of some census data for zipcode?

I wonder if there are any real world ( as opposed to things like ingame points) information that can be considered not PII .

There is also the interpretation of when is it PD or AD. In Norway the ‘The Norwegian Data Protection Authority‘ states 4 or less is personal, no way to link to less than 5 is anonymous.

>If they are able to corelate that data back to your account, and you account contains information that allows them to link it back to individual you, then absolutely.

It's amazing that people actually think this type of request is reasonable and that a regulation enabling this type of request will not kill Europe's competitiveness wrt internet companies.

I have no idea why you consider it unreasonable that I should be able to request data a company holds on me.