GDPR agreement invalid?

[Alzager.7265]

When starting the game, I was prompted to agree to the new privacy policy today, since the GDPR is now in effect. Now I am not a lawyer or anything, but it seems to me, that the GDPR agreement in this case is invalid.

According to Art. 4 GDPR, 11

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

And Art. 7 GDPR , (4)

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

expanded on in Recital 43, 2

Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

consent is not freely given, since

create a profile for marketing campaigns

Cookies and Tracking Pixels

are in no way necessary for playing the game.

In general, you can not have a catch all agreement under the GDPR, if those things are not necessary for that service.See also

[SlippyCheeze.5483]

@"Alzager.7265" said:Now I am not a lawyer or anything, but it seems to me, that the GDPR agreement in this case is invalid.

You know that ANet had actual, real lawyers look at this, and help them understand how to conform to the regulations, right? As "not a lawyer", that means that "seems to [you]" is kinda meaningless.

If you believe there is an issue, you should consult your own lawyer and, if necessary, proceed to take this up with the appropriate court.

edit: actually, I don't know what the process of filing a GDPR complaint is, so I should have said: "if you believe there is an issue, follow the GDPR process for getting one resolved."

[Inculpatus cedo.9234]

Seems to me you must create a 'profile' to play the game, and cookies, etc. are used for the Forums, various guildwars2 sites, or if one should ever need Support.

Regardless, if one is uncomfortable with the agreement, one can choose to forego agreeing, or, at the very least, send enquiries to the provided address.

Good luck.

[Copyright.9082]

Happy to see that you, i.e. the GW2 team, are paying attention to GDPR, however you seem to have missed the first line of it.

The very objective of that Regulation is to protect personal data. How do you interpret that as imposing marketing content to your users?

On this point, I quote: "We may use contact and identification information like phone number, address, or social media profile information to contact you about our Services, for customer support, to provide you with marketing, or to contact you regarding an event or contest."(Article V.1 Limited Purpose, GW Privacy Policy).

I have to agree to gw2 sending me marketing content in order to play the game. In other words, there is no option that allows you to disagree upon that and still play the game.

This manifestly shows that you have no consideration for your users. In addition, the way you communicated that, i.e. by invoking GDPR in parallel, either means that you don't know what GDPR is; which is legally worrying for you, or that you think of us as fools.

---

Regarding OP's legal interrogation, Article 7.4 of GDPR, cited above, refers to a situation called "bundling", when an operator, i.e. GW2, bundles consent for necessary purposes together with consent for processes that might be considered "unnecessary", i.e. marketing content,etc. These unnecessary processes are not essential for the operator to perform the contract and will most likely lead to the conclusion that consent is not "freely given".

Also, consent of the data subject is one of the six grounds for lawful processing of personal data.

---

[Ellieanna.5027]

@"Classic Perception.2507" said:Happy to see that you, i.e. the GW2 team, are paying attention to GDPR, however you seem to have missed the first line of it.

The very objective of that Regulation is to protect personal data. How do you interpret that as imposing marketing content to your users?

On this point, I quote: "We may use contact and identification information like phone number, address, or social media profile information to contact you about our Services, for customer support, to provide you with marketing, or to contact you regarding an event or contest."(Article V.1 Limited Purpose, GW Privacy Policy).

I have to agree to gw2 sending me marketing content in order to play the game. In other words, there is no option that allows you to disagree upon that and still play the game.

This manifestly shows that you have no consideration for your users. In addition, the way you communicated that, i.e. by invoking GDPR in parallel, either means that you don't know what GDPR is; which is legally worrying for you, or that you think of us as fools.

---

Regarding OP's legal interrogation, Article 7.4 of GDPR, cited above, refers to a situation called "bundling", when an operator, i.e. GW2, bundles consent for necessary purposes together with consent for processes that might be considered "unnecessary", i.e. marketing content,etc. These unnecessary processes are not essential for the operator to perform the contract and will most likely lead to the conclusion that consent is not "freely given".

Also, consent of the data subject is one of the six grounds for lawful processing of personal data.

---

Then contact those who are in charge of the GDPR and tell them. Because I'm fairly certain Anet's legal team followed the law as explained to them.Also, based on what you quoted, that sentence does not say anything about needing to agree to play the game. It says they may use your information to contact you based on the things listed.

[Inculpatus cedo.9234]

You can unsubscribe from the Newsletter (the 'marketing') at any time. Also, you must check a box to agree to the mailings in the first place, which has nothing to do with agreeing to the Policy, and/or playing the game.

[SlippyCheeze.5483]

@"Classic Perception.2507" said:Happy to see that you, i.e. the GW2 team, are paying attention to GDPR, however you seem to have missed the first line of it.

A helpful map of the GDPR complaints process is online, which should guide you through the process of filing your complaint.

As a lawyer competent to interpret the new law you should have absolutely no trouble with the court route, or hitting up the appropriate supervisory authority in your jurisdiction. Heck, I'm pretty sure I'm telling you nothing that you don't already know, what with your legal expertise on the subject and all, but hey, might help someone else out who isn't actually a lawyer, but still thinks they are more competent than the ANet / NCSoft lawyers. :)

[Alzager.7265]

@Ellieanna.5027 said:Also, based on what you quoted, that sentence does not say anything about needing to agree to play the game. It says they may use your information to contact you based on the things listed.

It does not say so in that document, but when I, a EU citizen, start the game, I have to agree to the entire privacy policy (linked above) to play the game. And since this is a part of the privacy policy, I in fact have to agree to this, to play the game. I am sure, that it is the same for all other EU citizens and possibly all other players.

@Inculpatus cedo.9234 said:You can unsubscribe from the Newsletter (the 'marketing') at any time. Also, you must check a box to agree to the mailings in the first place, which has nothing to do with agreeing to the Policy, and/or playing the game.

As I said above, I have to agree to this, to play the game. It has nothing to do with the opt in for the mailing list. Even if I do not opt in to the mailing list, I have to agree to the marketing.

@Classic Perception.2507 said:This manifestly shows that you have no consideration for your users. In addition, the way you communicated that, i.e. by invoking GDPR in parallel, either means that you don't know what GDPR is; which is legally worrying for you, or that you think of us as fools.

This is a point, I wanted to make, but then forgot. Clearly Arenanet does not care about their users privacy, but about getting and using as much data, as they can, otherwise why not make those unnecessary things opt in independently of whether it is legaly required or not?

[Rose Solane.1027]

I don't think it is a matter of being a more competent lawyer than the ArenaNet lawyers. If you followed the See also link in the first post you could see that complains are filed against some of the biggest companies (Google for example) in the world. I am sure Google has very competent lawyers. That does not mean that I trust Google or any other companies to follow the new law by the letter. The GDPR isn't created for the benefit of companies, it hinders them in what they used to do. Specifically because already existing rules can be forced with penalties that are so severe that ignoring the rules/laws can be too costly.

That said, I am not sure if it makes a whole lot of sense to discuss the GDPR in this forum. It will have little consequence for most players (at least in the EU) as nothing substantial has changed. The big change is that the fines for not following the law are much higher but that has little consequence for the day to day business of a player.

[SlippyCheeze.5483]

@"Rose Solane.1027" said:I don't think it is a matter of being a more competent lawyer than the ArenaNet lawyers. If you followed the See also link in the first post you could see that complains are filed against some of the biggest companies (Google for example) in the world. I am sure Google has very competent lawyers.

They do, and you are absolutely right: Google had their lawyers help them conform to the law, as those lawyers interpret it, and other people are having their lawyers pursue the matter because they don't agree with that interpretation. This is a perfectly legitimate dispute, and follows the correct approach to the problem: if you believe that a GDPR violation is happening, use the GDPR complaint procedure.

Here, in this forum, we have people claiming that, by their reading of the law, ANet are violating the GDPR. There are two issues with that:

1. Not being lawyers, trying to interpret the law, is ... always risky. This is double true when the law is so new, and untested in the courtroom, so there is limited history to base conclusions on.
2. They are posting to the discussion forum of the game, not following the GDPR complaint process.

The "more competent than" commentary addresses only point 1, the "here is the process" commentary only point 2.

[Faowri.4159]

Gotta agree - having been involved in implementing this for a business (in financial services, no less, which has a particularly keen lens upon it right now from a regulatory/legislative perspective), I'm pretty sure forcing users to consent to marketing that is NOT essential to delivery of the service is in contravention of GDPR. I wonder if they're spinning it as a 'legitimate interests' for the business? Should imagine the restrictions on this clause will be the very first thing that gets battled over in court.

Very annoying, though, especially as I have no option but to tick to play a game I have ALREADY purchased. It would be nice if businesses actually considered consumer rights first instead of following the 'what can we get away with legally' approach.

EDIT: I was able to click 'I accept' without checking the marketing box. Not very clear at all but hopefully this means I have opted out :P

[BunjiKugashira.9754]

@Faowri.4159 Since ANet's main revenue comes from selling GW2 and ingame purcheses and NOT from advertisements, I can't see a legitimate interest in using data for that.

Btw: Does ANet make any money via advertisements at all? You kinda miss out on these details whith a good adblocker. ;D

[SlippyCheeze.5483]

@BunjiKugashira.9754 said:@Faowri.4159 Since ANet's main revenue comes from selling GW2 and ingame purcheses and NOT from advertisements, I can't see a legitimate interest in using data for that.

Btw: Does ANet make any money via advertisements at all? You kinda miss out on these details whith a good adblocker. ;D

No advertising visible anywhere without one. (You can always open an incognito window to check, but .. yeah, they don't do that.)

[Copyright.9082]

@SlippyCheeze.5483 said:

@"Classic Perception.2507" said:Happy to see that

you, i.e. the GW2 team,

are paying attention to GDPR, however you seem to have missed the first line of it.

A helpful

map of the GDPR complaints process

is online, which should guide you through the process of filing your complaint.

As a lawyer competent to interpret the new law you should have absolutely no trouble with the court route, or hitting up the appropriate supervisory authority in your jurisdiction. Heck, I'm pretty sure I'm telling you nothing that you don't already know, what with your legal expertise on the subject and all, but hey, might help someone else out who isn't actually a lawyer, but still thinks they are more competent than the ANet / NCSoft lawyers. :)

1. No one is talking about sueing.

2. The issue (to me) is not really whether Anet is in compliance with GDPR even though a lot of companies have been condemned for "bundling". What i'm pointing out is invoking GDPR to justify that marketing content. That Regulation has nothing to do with marketing and it's kind of like saying "Since our players probably don't know what GDPR is, we pretty much can tell them anything".

It's just an overall dishonest process imo.

[GreyWolf.8670]

@"Classic Perception.2507" said:Happy to see that you, i.e. the GW2 team, are paying attention to GDPR, however you seem to have missed the first line of it.

The very objective of that Regulation is to protect personal data. How do you interpret that as imposing marketing content to your users?

On this point, I quote: "We may use contact and identification information like phone number, address, or social media profile information to contact you about our Services, for customer support, to provide you with marketing, or to contact you regarding an event or contest."(Article V.1 Limited Purpose, GW Privacy Policy).

I have to agree to gw2 sending me marketing content in order to play the game. In other words, there is no option that allows you to disagree upon that and still play the game.

This manifestly shows that you have no consideration for your users. In addition, the way you communicated that, i.e. by invoking GDPR in parallel, either means that you don't know what GDPR is; which is legally worrying for you, or that you think of us as fools.

---

Regarding OP's legal interrogation, Article 7.4 of GDPR, cited above, refers to a situation called "bundling", when an operator, i.e. GW2, bundles consent for necessary purposes together with consent for processes that might be considered "unnecessary", i.e. marketing content,etc. These unnecessary processes are not essential for the operator to perform the contract and will most likely lead to the conclusion that consent is not "freely given".

Also, consent of the data subject is one of the six grounds for lawful processing of personal data.

---

I opted out of all marketing mails. Maybe yours is broken?

[SlippyCheeze.5483]

@Classic Perception.2507 said:

@SlippyCheeze.5483 said:

@Classic Perception.2507 said:Happy to see that

you, i.e. the GW2 team,

are paying attention to GDPR, however you seem to have missed the first line of it.

A helpful

map of the GDPR complaints process

is online, which should guide you through the process of filing your complaint.

As a lawyer competent to interpret the new law you should have absolutely no trouble with the court route, or hitting up the appropriate supervisory authority in your jurisdiction. Heck, I'm pretty sure I'm telling you nothing that you don't already know, what with your legal expertise on the subject and all, but hey, might help someone else out who isn't actually a lawyer, but still thinks they are more competent than the ANet / NCSoft lawyers. :)

1. No one is talking about sueing.

Why not? You stated that you believe that ArenaNet are misusing data in a way that violates the GDPR, and you want them to stop. You have two meaningful paths to make that happen, one of which is to take them to court, and the other is to complain to your appropriate regulatory authority. Pick one, or be done with it.

Oh, and just in case you missed it, you explicitly referenced the law suites against Google, Facebook, et al, in your initial post. So you kind did open this by mentioning a "see also" of, y'know, suing people for their lack of GDPR compliance.

Because I try very hard to assume the best of people, I assumed that you mentioned that because, y'know, you thought that other law suits about GDPR compliance were relevant here because ANet should be aware of the legal risks. Did you have some other intention in mind? Did it just slip in there, perhaps, on accident?

2. The issue (to me) is not really whether Anet is in compliance with GDPR even though a lot of companies have been condemned for "bundling". What i'm pointing out is invoking GDPR to justify that marketing content. That Regulation has nothing to do with marketing and it's kind of like saying "Since our players probably don't know what GDPR is, we pretty much can tell them anything".

You are foolishly conflating two things: the updated and resigned privacy policy is part of what ANet were, presumably, advised by their lawyers would be required to meet their obligations under the GDPR, and the language about being contacted for marketing purposes.

Which, incidentally, you have definitely agreed to prior to the GDPR inspired update, since that language has been present in the document since September 20th, 2012, and you have clearly agreed to those terms at some point during that time.

It's just an overall dishonest process imo.

I'm certain you mean well, but you apparently have no intention of seeing meaningful change happen, and no knowledge of the documents you agreed to prior to this update. That isn't a firm ground to make that sort of accusation from, but, again...

If you actually care, do something about it, don't just post on the forums.