Fighting Back: Privacy issues arising from the ban

Overview
In order to ban people Blizzard would have used some form of surveillance. Depending on where you live, privacy laws exist that protect consumers from surveillance. Also, depending on where you live, data protection laws exist that give a consumer the right to request from companies like Blizzard ALL the information they have collected about you. Under most legal jurisdictions, companies like Blizzard cannot circumvent privacy and data protection laws with an End User Licence Agreement (EULA), which is the clickwrap that Blizzard requires in order for you to play World of Warcraft.

Background to this thread
I started a forum post here and I have been flooded with private messages from forum members all over the world who share my concerns about the privacy and data protection issues related to this ban. From what I can tell, people cannot post replies to that thread due to forum permission rules and a lot of the private discussions I have had with people may help others. Therefore I have decided to move the thread here to raise the profile of these issues, give people the opportunity to post replies, and to try to limit the amount of time I've spent replying to private messages (however if you really do need to message me then please do).

How does privacy and data protection law help me appeal the ban?
The simple answer is I don't know at this point. Until requests for information are honoured by Blizzard no one knows if any privacy or data protection lines were crossed or even if it will help appeal the ban.

However my personal experience, and from what others have told me suggests that:

• Ban appeals are not being fully investigated in accordance with legal rights, and
• Blizzard is actively avoiding their legal obligation to supply information when requested.

The above points suggest that Blizzard either:

• Doesn't understand their legal obligations, or
• Wants to avoid their legal obligations.

Either way I believe that unless we push this matter further, Blizzard will not respect our rights. At some point you will have to fight for your privacy and data protection rights and this ban is where I draw the line.

What can I do?

1. Try to understand your privacy and data protection rights

I've already made a start for people in the USA, EU and Australia but I will not spend more of my time researching the specific laws in your legal jurisdiction. The law may seem intimidating but it really isn't... THE LAW IS FOR EVERYONE AND IS THERE TO SERVE YOU. Many countries have organisations that help people understand and access the law, and there are usually organisations that care about privacy and data protection rights. If you do not feel comfortable researching the law yourself, find out about these organisations and call or email them for information. Once you do, come back here and post about it, that way you can help other people with information and encouragement.

2. Request information from Blizzard

Many countries give you the right to access all the information held about you. In order to determine how Blizzard has tracked you, you must request the information. Don't give up if they refuse requests or do not pass along all the information. Blizzard will want to make it as difficult as possible, especially if they know they have crossed the line. How you go about requesting the information will depend on where you live and what laws apply which is why the first step is to know your rights. What I am suggesting at the moment is to write a support ticket on Battle.net once you know your rights and request the information that way, or ask how you can access the information. Since I live in the EU I will be putting some EU specific information in later thread replies.

3. Keep track of everything

It will be very important to keep track of:

• Who - Get a Blizzard representative's name or handle
• What - Record what was said, for example take screen shots or save to PDF and keep records in a folder on your computer with all the information or print it and keep hard copies in one place
• When - Keep a record of what time and date you had the correspondence with Blizzard, and
• How - Note down the form of communication, for example phone call, snail mail, email, Battle.net ticket or on-line chat.

Some people who have private messaged me have unfortunately not keep a record of discussions with Blizzard representatives, and if what they have told me is true, are very disturbing and relevant to all of our data protection and privacy rights. Several people have also told me that Blizzard representatives have acted unlawfully by refusing or cancelling support tickets when data protection requests have been made. This is all important evidence and may be useful to you and the community in the future. Please keep track of all this information and try to record it accurately.

4. Come back here and discuss it

You might not understand the information Blizzard send you, or how it relates to your country's privacy and data protection laws, but others here might. Please come back and post about it as it may help other people in your country.

Does my country have these laws?
If you live in an EU member country, Australia or the state of California then the answer is yes. As for the rest of the USA, I don't know. I put a lot of information on my previous post about this here.

Final thoughts
Don't forget that we're a community and that many people here are happy to help, myself included. Feel free to private message me and don't give up!

 

EU Data Protection Rights

What are my rights?

If you live in the EU you have the right to be confident that organisations handle your personal information responsibly and in line with good practice.

You will have a legitimate concern about the way an organisation is handling your information if it:

• Is not keeping your information secure
• Holds inaccurate information about you
• Has disclosed information about you
• Is keeping information about you for longer than is necessary, or
• Has collected information for one reason and is using it for something else.

Can I access my personal information?

You have the right to get a copy of the information that is held about you. This is known as a subject access request. This right of subject access means that you can make a request under your country's data protection law(s) to any organisation processing your personal data. You can ask the organisation you think is holding, using or sharing the personal information you want, to supply you with copies of both paper and computer records and related information.

How do I make a request?

To make a subject access request to Blizzard you will need to write a physical letter and physically post it off to them. It seems like Blizzard are refusing any other means of request. At the moment it isn't known if Blizzard charge for 'subject access'... which they may be entitled to. By law this cannot be excessive but be aware that it may cost in the region of 10EUR. Because Blizzard could charge for each request you make, make sure you make as broad a request as needed without asking for too much information. I will provide a letter template below but I can't be sure if it will be correct or not.

[Your full address]
[Phone number]
[The date]

Blizzard Entertainment SAS
Service Juridique
145, rue Yves Le Coz
78000 Versailles
France

Dear Sir or Madam

Subject access request

[Your Blizzard account name/email address/or any other details to help identify you and the information you want.]

I have deep concerns about how Blizzard Entertainment Europe (Blizzard) has handled my information with respect to my privacy and data protection rights. I want to find out:

• How and what information Blizzard has collected about my account
• If Blizzard holds inaccurate information about me
• If information has been disclosed to any 3rd parties
• If information about me has been held longer than is necessary, or
• If information collected for one reason has been used for something else.

Please supply the information about me and my account I am entitled to under the [put your country's data protection law name here]. To help narrow down my information request I would like information relating to:

• All information held in related to my World of Warcraft account since the start of 01/01/2015
• All information collected in relation to the 6-Month Suspension Account Action Notification dated [put your date], and
• Any and all logic involved in any automated decisions made about my account.

If you need any more information from me, or a fee, please let me know as soon as possible.

It may be helpful for you to know that a request for information should be responded to within 40 days.

If you do not normally deal with these requests, please pass this letter to your Data Protection Officer. If you need advice on dealing with this request, please seek legal advice.

Yours faithfully
[Signature]​

Some tips when sending your letter

• Write legibly - Typed or word processed documents are easiest to read. If you write your complaint by hand, make sure your writing is easy for others to understand.
• Keep your language simple - Although you will have checked our website to see what the relevant legislation says, don’t feel you have to quote it to raise a complaint. Just explain clearly and simply what has happened and, where appropriate, the effect it has had on you.
• Be specific - If you've had your account for a long time resist any temptation to include historical or unrelated complaints in your letter. This can confuse matters and leave Blizzard unsure which of your concerns you really want them to deal with.
• Don’t move the goalposts - Include full details of your concern at the beginning. If Blizzard responds properly, don’t raise additional unrelated matters as part of that complaint. However, if it appears that Blizzard has misunderstood you, or has not given a full response, you should let them know.
• Stay reasonable - You may be justifiably angry or upset about what has happened. Keeping your letter calm and polite will help you get your points across more clearly. Remember that the person you are dealing with might have had nothing to do with the problem you had. Also, remember that they are only human. A rude letter might make it difficult for them to want to help.
• Don't get personal - Don’t insult members of the organisation’s staff. Apart from being unreasonable behaviour, the response may lack focus if the writer feels obliged to defend his or her colleagues or staff.
• Request and respect time-scales - Ask when you can expect Blizzard to respond and resist any temptation to contact them again before that. However, if you do not receive a response on time, you should chase it, although give them an extra couple of days to allow for administrative or postal delays.
• Include all necessary information - Include all relevant details such as account email or name to help Blizzard identify you and your concern correctly.
• Include all necessary evidence - It might be a good idea to send a hard copy of your ban email attached to the letter. I wouldn't include additional documentation ‘just in case’. The more documents you send, the more likely it is that key information will be missed.
• Keep good records - Keep a record of when the letter was sent, ideally track it, and make notes of all related correspondence. Keep copies of everything.
• Exhaust the process - If the ‘final’ response from Blizzard does not suitably comply with the Subject Access Request, you can take the matter further, however you will need to prove that you have exhausted Blizzard's internal process before bringing the matter to your country's Data Protection regulator.

 

USA
Unfortunately the USA, is IMHO, a mess when it comes to privacy. There really doesn't seem much in the way of Federal law and it seems like it is left to State law to legislate for the rights of citizens.

Federal Law - Children's Online Privacy Protection (COPPA)
As far as I can tell the only Federal Laws that are applicable in this circumstance is if you are a player who is under 13, or if you are a parent who has a child who plays WoW with your account. If this is the case, then Children's Online Privacy Protection (COPPA) will apply (also see the Wikipedia page to get a good overview. Violating COPPA can result in heavy fines from the Federal Trade Commission. The rules around COPPA are so strict that for many companies, the easiest way to become compliant is to avoid collecting ALL personal information in the first place. A great 'Frequently Asked Questions' about COPPA is here.

I believe this specifically relates to Warden as the FTC has made clear, the passive tracking of children’s personal information through a persistent identifier, and not just its active collection, also is covered by COPPA. If you are making a complaint, then quote the Electronic Frontier Foundation's article that specifically calls Warden "spyware".

If these circumstances apply, the parent of the child who plays will need to submit a complaint to the FTC through the FTC’s website, Federal Trade Commission | Protecting America's Consumers, or via a toll free number, (877) FTC-HELP.


California
See my other post here for information.


Massachusetts
At the request of someone who PM'd me I did some research on what laws may be applicable. It was difficult and I would say don't waste your time looking at Massachusetts 201 CMR 17, which is more about protecting identity theft more than anything else. That said I did manage to dig up this resource which pointed me to Massachusetts General Laws Part I Title X Chapter 66A Section 2 which looks very applicable.

Sections (i) and (j) are extremely relevant in accessing and determining what data has been collected about you. I would suggest altering the EU data request letter I wrote above, and referencing Massachusetts law. As for where to send it, I don't know if the following is correct:

• Email: legal@blizzard.com (source)
• Snail Mail:
  
  
  Blizzard Entertainment
  Attn: Legal Department
  P.O. Box 18979
  Irvine, CA 92623 ​
  
  
  (source)​

Michigan
At the request of someone who PM'd me I did some research on what laws may be applicable. I'm sad to say that Michigan law does not seem to give the same online privacy and data protection laws that other states offer (or could be applicable in this case). I searched extensively using the law search here, and read these sections of law: §445.63, §37.251, §205.827, §257.40b, §500.503, §445.61, §445.63, §445.72, and §750.539c. If there is someone here who knows of any other laws not listed here that may applicable please PM me.

 

Blizzard will never discuss how they caught you. They will never hand out info as this is fuel for bot makers to
avoid detection.

Although i respect your point and effort made, i think this is useless. U honestly think, blizzard will risk a scandal
about privacy issues? Bossland is in court with blizzard for years. You think info like this hasnt been asked before?

I do hate em for banning me, but i dont believe they did something that invaded my privacy to stop me.

all these white knights all of a sudden... jezus

 

As another thread stated. When you give them consent to scan, the laws are not valid.

 

In the states thats the case....i believe in EU they actually can be required to divulge such information, but I believe you'd need to file a suit or get a lawyer to bring a class-action up...and does Bosslandgmbh really need that publicity when they just won a case? Did you really care about your botting accounts that much? I for one lost 1 account but my main is still here, and have botted on my main since glider...just manage to take breaks at the right time on that account I guess, but I can say right now I care none about an account being banned...I care more about being able to bot in the future, I would definitely not continue to play wow without a bot, and currently I have yet to come across a bot that was as functional as glider, pirox or hb, so I can't use them to their full potential. PQR was nice but not afk so I didn't like it nearly as much.

 

I doubt any court in any country would make a company give up information that would be considered a trade secret. ie: the method they used to detect or conclud that we were using a bot program.

 

Glider successfully got them to admit to the existence of Warden via the courts, so a court can and will do it.

 

Saying they have a program that can detect a bot is not the same as saying how it works and what it's looking for.

 

They don't need a court to do that, it's already been done by reverse engineers. Regardless, my point was not that we should do it, but that the laws in EU do in fact state that they can be forced to divulge information about single account bans and what not.

 

Honestly that would be too much of an inconvenience and cost for an individual to want to go to court over a video game.

 

They do act as if they might have step into some privacy laws, but they would need a good push to make them start to sweat.

 

it aint happening. just swallow the pill and get over it.

 

The cost to push a lawsuit big enough to get the information out of blizzard would greatly outweigh the reward of it.

 

It's was purely marketing trick by blizzard, they are hungry fucks and it's fucking disgusting for what they did. Others can do whatever the fuck they wanna do.. I'm glad ain't be spending a single cent on any stuff related to name blizzard entertainment

 

Just appeal saying you had a car accident and you dont have arms anymore. Botting was the only way for you to play world of warcraft !

 

You are awesome comedian!!! )))
I laught over laught)))

 

Different laws in different legal jurisdictions offer different protections.

While you may know about your legal jurisdiction, you cannot make such a broad sweeping statement about all legal jurisdictions.

 

The law is the law and Blizzard isn't above it. At least in the EU they have to.

 

Exactly.