Real ID comes to WoW

[Ingmar]

I thought Arthur was Irish?

[Stabs]

Oh maybe. It's likely that the Republic of Ireland has a similar legal framework to England and Wales as both sets of Data Protection laws are derived from EU law.

In any event I'm from England and I'm also complaining.

[Arthur_Parker]

Wouldn't it require two driver's license changes and £40?

Only if you think having your driving license photo look like you is important.  

I thought Arthur was Irish?

Northern Irish, so I have dual nationality, my driving license and passport are British, I know I can apply for an Irish passport as well, not sure if I can have two valid driving licenses at the same time (a UK one and a Republic of Ireland one).

[Ingmar]

Aha, that would explain my confusion.

[slog]

The thing is under English law they're not entitled to demand a driver's licence at all.

http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/toolkit.pdf

For a subject access request all Arthur has to provide is name and address and any information he (ie Arthur) thinks is necessary to identify him (probably the account name). They are allowed to request a fee of £10. They then have 40 days to provide the information.

If they don't comply then the ICO has the following powers:

    * conduct assessments to check organisations are complying with the Act;
    * serve information notices requiring organisations to provide the Information Commissioner's Office with specified information within a certain time period;
    * serve enforcement notices and 'stop now' orders where there has been a breach of the Act, requiring organisations to take (or refrain from taking) specified steps in order to ensure they comply with the law;
    * prosecute those who commit criminal offences under the Act;
    * conduct audits to assess whether organisations processing of personal data follows good practice; and
    * report to Parliament on data protection issues of concern.
The ICO's new power to issue monetary penalties came into force on 6 April 2010, allowing the ICO to serve notices requiring organisations to pay up to £500,000 for serious breaches of the Data Protection Act.

It would be appropriate in the next communication to inform them of the law and that they do not appear to be in compliance.

[Stabs]

My next step to ask them again to remove my data, explaining that the reversal of the decision about the forums is insufficient to allay my concerns.

The step after that will be to request that they delete my personal data and draw their attention to my limited right under the Data Protection Act to tell an individual or organisation to stop processing information about you if it is causing you unwarranted and substantial damage or distress.
http://www.ico.gov.uk/what_we_cover/data_protection/your_rights/preventing_processing_of_information.aspx

They don't have to comply but if they do refuse I'm entitled to go to court to have a magistrate decide to what extent it's reasonable for them to hold personal information about me.

Naturally I'll point them to the link so they can see for themselves the UK policy on this matter. Hopefully they'll simply remove me from their database.

[Simond]

This is why Read ID will never take off past Steam-esque friends lists - Actiblizzion may have hired the finest American ambulance-chasers to momentarially wave their plans at, but they seem to have neglected to consider that what they were proposing is hilariously illegal to about two-thirds of their Western subscriber base.

[Speedy Cerviche]

Not illegal in red China

[Pezzle]

Why would it be illegal in China?  They are only stealing your accounts and selling off your goods and information, not actually subbing for those accounts themselves, right?   

[Stabs]

Beijing is wary that its push for tighter information control might prove unpopular.

Hear that Blizzard? Even the freaking Chinese government is wary about doing what you are trying because it might prove excessive.

[fuser]

Greetings,

I'll be assisting you today. I do apologize about the delays in response.

While I directly cannot release sensitive information over email, you may have it requested from custodianofrecords at blizzard (dot) com through the proper channels. I have also given you a link which describes Blizzard Entertainments privacy policy at length. I do hope this helps you with what you are trying to accomplish.

http://us.blizzard.com/en-us/company/about/privacy.html?rhtml=y

Finally got a response a week later from a live person. Surprising bit is the email address, google has one hit on the address.

edit: obscured the address a bit

[Arthur_Parker]

Had a response as well.

Disappointed to be honest, I was hoping they would go with the Beard idea.  I'll have to give a response some thought now as I wasn't expecting them to go all reasonable on me.
    

[Musashi]

Fuuuuuuuuuuuuu

[Lantyssa]

Disappointed to be honest, I was hoping they would go with the Beard idea.  I'll have to give a response some thought now as I wasn't expecting them to go all reasonable on me.

You could send them a DL with the photo and all the information blacked out.  Leave only the name.  Or maybe part of it.  Or maybe none of the name.  That could be fun, too.

[Cadaverine]

Send a photocopy of someone elses ID, with their info blacked out, then write your name in in crayon.

[Arthur_Parker]

I don't mind supply info they already have, or had at account creation.  I just wanted to highlight how silly it is to ask for extra information just to delete other information.  So I'm slightly miffed because I wanted to go down a silly route of saying ok, you think sending a bearded photo in is fine, how about I just draw one on and save £20 etc etc.  I'll ask if I can blank out date of birth etc, but I really wanted to work the picture below into it all.

[Stabs]

It seems pretty sure they devised these requirements without reference to their legal team. If you actually want deletion rather than just to mess them about you should have some legal right to force them to do so. If the ICO covers Northern Ireland then you can use the procedure I linked above.

Apart from anything else I've been playing Blizzard games since Warcraft 1. When I played Diablo 2 I had 8 accounts to mule all my stuff. They have my personal data with regard to more games that WoW, some of which I may have sent my personal details for 15+ years ago.

As for me I've already had one request for deletion ignored. I'll email another one, if that doesn't work then I'll send a registered mail letter giving formal 21 days notice of an assertion of my limited right under the Act. If they don't remove my data I'm prepared to start legal proceedings.

If it gets to that stage we'll have a relatively informal hearing where I will self-represent and explain that publication of data about my gaming habits could be injurious to my career with a pile of articles from google where such problems have occurred. They'll get to state their case as to why it's reasonable for them to hang on to my personal data after I have stopped playing their games. And the magistrate will decide.

At no stage will I need to provide photo ID. The courts don't ask for it. And as a matter of fact I don't own any, not having a current passport and having a driving licence that was issued before they came with photos.

[Arthur_Parker]

I thought they had closed the previous query on my other email account, they hadn't.  Spoilered reply below.

I didn't expect them to back down on the photo, the easy answer was just to agree with the nutter who wanted to grow a beard.  I'm reasonably confident that I could get them to back down on date of birth and place of birth as well.  As such, in my view, the requirements for deleting have shifted from being excessive to being understandable, given the number of hacked accounts it's sensible to have a further safeguard in place.  I'll probably just wipe my details now, they can keep my name as it's fortunately very common.

[Stabs]

Um, they haven't backed down on the photo:

The cover letter will have to include confirmation of your deletion request along with:
...
- A legible scan or photo of a piece of government-issued photo identification, such as a passport or driving license matching the first and last name of the registered account owner

[Arthur_Parker]

http://forums.f13.net/index.php?topic=19381.msg821754#msg821754

Fortunately you won't have to grow a beard and shave it afterwards. I would like to offer you to send the copy of your legit ID with the photo covered

[Azazel]

Is that Harry Potter?

[LK]

No, it's Randy Clifford.

[Azazel]

Who?

[LK]

Just some guy. Totally not Daniel Radcliffe. Totally.

[Ingmar]

http://kotaku.com/5589238/questions-and-answers-about-blizzards-real-id-plans

Yeah, yeah, it's Kotaku, sorry.

Some highlights:

- Opt-out for your name showing on friend-of-friend lists is coming
- they're working on some protections around RealID availability to addons but don't have any details to share yet
- No plans to let you use a handle instead of real name but they're not ruling it out for all time

[Azazel]

If they keep backing off, I may even play their game again.

[Musashi]

They just need to add 'invisible' mode, and not link it to real names in any way.  Even the Facebook spam should read "*Character Name* has beaten Onyxia for the 500th time!  Join him!"  And there's got to be a way to turn that off in all circumstances.

[Azazel]

The common sense, the truth, which you speak, has been evident to all but Blizzard from the beginning moment of this clusterfuck.

[sickrubik]

Even the Facebook spam should read "*Character Name* has beaten Onyxia for the 500th time!  Join him!" 

I'm not sure I quite understand what you are trying to get across here. If someone has you as a friend on facebook (the only way they will see you spam) is if they know your name already?

[Sjofn]

  Even the Facebook spam should read "*Character Name* has beaten Onyxia for the 500th time!  Join him!" 

Do you actually use Facebook? Because that would display as:

Sjofn Lofnsdottir says:
Sofi has beaten Onyxia for the 500th time! Join her!

So that's not going to hide shit. Even worse, now my horrible Facebook friends know my character name!  

[Musashi]

Yea.  I know a lot of them do that.  But I thought I saw a game on there that only displayed your character name.  I could be wrong. 

As long as they have a way to disable anything from WoW landing on Facebook, I don't care.  Or better yet not associate your Facebook with b.net in the first place.

[Sjofn]

You can't post stuff to your wall anonymously is what I mean. If I post something, it's going to say "Sjofn Lofnsdottir: I'm posting bullshit!" If I elect to irritate my friends with WoW stuff, it's going to say Sjofn Lofnsdottir is harrassing them with WoW stuff. Because that's how Facebook itself works. Now obviously, this means any Facebook posting pretty much must remain optional (which it would, even the real Facebook games don't MAKE you post shit). Your suggestion that it must use your character name, because of how Facebook works, would have the amusing side effect of making it easier to connect "Sofi" to "Sjofn Lofnsdottir" though.

[ajax34i]

Why doesn't Blizzard change its deletion policy to the following:

1.  If you want your account deleted, you must delete all your characters first.  Log into the game and delete all characters on the account.
2.  Wait a month to make sure you're not changing your mind.
3.  Use the Delete Account button under Account Services and we'll do it.

I mean, the reason for all their worry and need to make sure that it's YOU is related to the (emotional) value of the characters, not the account itself.

[waffel]

I haven't played in 4 years. I'm not emotionally involved in something after 4 years of not seeing it (except maybe a really hot ex)

[Mattemeo]

Why doesn't Blizzard change its deletion policy to the following:
1.  If you want your account deleted, you must delete all your characters first.  Log into the game and delete all characters on the account.

This is the problem here. A fair few people who'd like to delete their account don't want to spend $15 resubbing to do so.