Can you use GDPR as a weapon against an organization you are mad at?
It sounds like we're about to find out.
GDPR as a weapon against Blizzard gaming
This story is about Blizzard Entertainment, creator of the "World of Warcraft" video game.
The company pulls in revenue from around the globe, including a large chunk from mainland China.
Against this backdrop we find a high-stakes World of Warcraft Tournament Champion. He went onto social media in support of those in Hong Kong who are protesting against China.
Following his comments, Blizzard stripped the player of his championship. And that set the gaming community off.
Flooding a company with GDPR requests
Now, a gaming forum is offering gamers, who are upset with Blizzard, instructions on how to exercise their rights under GDPR Article 15. It allows you to request records of all data an organization has on you if you are an EU data subject.
We'll let digital publication Boing Boing take it from here:
"Today, outraged games on Reddit's /r/hearthstone forum are scheming a plan to flood Blizzard with punishing, expensive personal information requests under the EU's expansive General Data Privacy Regulation—Blizzard depends on the EU for another massive share of its revenue and it can't afford the enormous fines it would face if it failed to comply with these requests, which take a lot of money and resource to fulfill."
What does GDPR Article 15 allow you to do?
When Boing Boing said these personal data requests "take a lot of money and resource to fulfill," they weren't kidding.
We looked up GDPR's Article 15, and here are some of the time consuming highlights organizations face if they receive a request for personal data:
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information as to their source
And there is more; these are just some of the rights EU data subjects have.
Hopefully, Blizzard Entertainment is ready for a blizzard of requests from gamers across the EU.
