News for hackers. Stuff that matters.
Re:Open-Sourcing our GDPR Compliance Preparation For Article... by wongarsu on Saturday May 19, 2018 @12:06PM (#17108439)
It doesn't matter if you can correlate user id and account holder, what matters is that somebody can. That's the same reason why IPs are considered personal information.

>Furthermore, in such situations there's a case to be made that this information cannot be deleted if the whole point of the site is to provide global rankings.

You don't have to delete it, anonymizing is enough. For global rankings you don't need to know that user 1456 has rank 56, you just need to know that somebody holds that rank. So whenever a user requests to be deleted, replace his id with -1 (or choose a random number outside the normal range) and you have satisfied the request (only the PII needs to be deleted, not everything about the user).

Re:Open-Sourcing our GDPR Compliance Preparation For Article... by emilfihlman on Saturday May 19, 2018 @05:25PM (#17109811)
>It doesn't matter if you can correlate user id and account holder, what matters is that somebody can

This is absurd and 100% bullshit. It means anything and everything is now personal data, even randomly generated data.

Re:Open-Sourcing our GDPR Compliance Preparation For Article... by wongarsu on Saturday May 19, 2018 @06:26PM (#17110053)
A lot of user ids are literally randomly generated data (for example any UUID used as user id). That doesn't make it less useful.

But that doesn't mean that everything is personally identifying information. "I am 53 and like Harry Potter" isn't enough to identify me, so it isn't PII and isn't covered by GDPR. My Blizzard username is enough for Blizzard to identify me, so it is PII.

The important concept here is that in Europe, data protection laws are not only protection against corperations, they are also protection against nation states. We had a few bad experiences with the effects of government surveilance, and we had a few bad dictators in the last century.

Re:Open-Sourcing our GDPR Compliance Preparation For Article... by Guest9812398 on Saturday May 19, 2018 @03:16PM (#17109274)
> For global rankings you don't need to know that user 1456 has rank 56, you just need to know that somebody holds that rank.

Isn't the purpose of global rankings to know how any given user is ranked globally? It's not much of a ranking system if all you can say is, "Yes, we have one million users, and they are ranked 1 to 1,000,000. We are not able to identify who is what rank."

Re:Open-Sourcing our GDPR Compliance Preparation For Article... by wongarsu on Saturday May 19, 2018 @06:13PM (#17110002)
What's wrong with "we have one million users. You are ranked 45698th. The one below you is proplaya92, the one above you chose to have his name redacted" (but we can tell you his playtime on all characters, his k/d ratio, etc).