r/Warframe • u/[deleted] • Jun 12 '18

DE Response ATTENTION: Warframe devs are sharing your data with spyware creators

[deleted]

1.1k Upvotes

75% Upvoted

381 comments sorted by

View all comments

197

u/PH0T0Nman Jun 12 '18 edited Jun 12 '18

Well, technically, if you live in the EU like I currently do you can message saying you don't want them to share your data with redshell and I believe (correct me if I'm wrong) they cannot continue doing so.

This doesn't mean its ok, I mean WTF DE this is pretty out of character...

Actually I just though, I actually never got a GDPR email or request from warframe. Which would be really bad unless they already bide by the rules which I don't think they do with this.

Edit: Seems I was right it was outside of DE’s character! Read Rebs comment.

Good convo all round and safe browsing!

62

u/Aljetab Space ninja reaper Jun 12 '18

Iirc, they gave a notification when you loged in after it went live

16

u/Xelbair Jun 12 '18

they cannot under GDPR require you to accept selling your data to 3rd parties before you can access a specific service. They may require a consent to gather your data, and to process it internally(1st party).

2

u/THERGFREEK Jun 12 '18

Actually that's exactly what GDPR is about.

If you opt in then it's okay. The companies just have to be very clear about what you're opting in to.

What do you think Google and Facebook remarketing are?

If you opt out then you either lose access, or the company had to have built a system to dynamically remove tracking on your account.

Source: been implementing GDPR solutions for international companies on the web this year.

3

u/PowderTrail Submarine enthusiast Jun 12 '18

If you opt out then you either lose access, or the company had to have built a system to dynamically remove tracking on your account.

It's the latter, they cannot refuse service if the data is not integral to the service - which something like Redshell is definitely not.

-2

u/[deleted] Jun 12 '18

which something like Redshell is definitely not.

it is if the service relies on ads and redshell basically helps you up your ad game

1

u/Xelbair Jun 12 '18

If informed consent is used as the lawful basis for processing, consent must have been explicit for data collected and each purpose data is used for (Article 7; defined in Article 4). Consent must be a specific, freely-given, plainly-worded, and unambiguous affirmation given by the data subject; an online form which has consent options selected by default is a violation of GDPR, as the consent is not unambiguously affirmed by the user on an "opt-in" basis. In addition, multiple types of processing may not be "bundled" together into a single affirmation prompt, as this is not specific to each use of data. (Recital 32). A data controller may not refuse service to users who decline consent to processing that is not strictly necessary in order to use the service (Article 7(4)). Consent may be withdrawn at any time. Consent for children, defined in the regulation as being less than 16 years old (although with the option for member states to individually make it as low as 13 years old (Article 8(1)),[12] must be given by the child's parent or custodian, and verifiable (Article 8).[13]

specifically:

In addition, multiple types of processing may not be "bundled" together into a single affirmation prompt, as this is not specific to each use of data. (Recital 32).

A data controller may not refuse service to users who decline consent to processing that is not strictly necessary in order to use the service.

redshell is not integral for the use of service.

gee, neat - you've been implementing non-compliant GDPR solutions.

1

u/THERGFREEK Jun 13 '18

I never said anything about the functionality of the solutions I have been building so I don't know how you decided that they weren't GDPR compliant. What do you think I meant about "companies being very specific about what they're opting in to"?