Is it legal for Blizzard to demand a copy of my government id before deleting my account? I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so. I've seen a somewhat related question about Twitter at How can I get Twitter to delete my account?, however I do have full access to my own account and the connected email. The relevant quote at GDPR 12(6) says Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. Which is a fair point in the linked question, but since I do have full access and there is no reason to doubt that, can they actually legally demand a copy of my government id? Note I would be totally fine with waiting for a few days to verify I have not been hacked. But I am not comfortable giving out my government id to a large company, let alone one with questionable ethics.
When you make a request based on the GDPR, Art. 12(6) GDPR applies. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID: Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID. Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required. You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.
You violated Facebook's Terms of Service, and it's entirely within your contractual agreement with them for them to close your account. You agreed to abide by the contract you "clicked through" when you signed up and opened a Facebook account. They didn't break any laws when you broke your contract with them. You clearly broke the contract by violating the TOS. They are not breaking any laws by not restoring your account. What you see as the value of your personal or business data doesn't really mean anything; it was your choice to use Facebook in the first place, and your mistake to break the TOS. You could try hiring a lawyer to make a case that you see a difference between the personal data you want to retrieve and the business data that caused the violation, but that's up to you; Facebook is under no legal obligation (this could be different, according to your jurisdiction and national laws) to restore any or all access to your account or data, but it's possible they could be persuaded.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. That is not correct. According to GDPR Article 2: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data ... ... (c) by a natural person in the course of a purely personal or household activity; GDPR Recital 18 states in relevant part: (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. Personal data that is not processed by &quot;automated means&quot;, for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for &quot;personal activities&quot; is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter. Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Also possibly relevant is point (c) which reads: processing is necessary for compliance with a legal obligation to which the controller is subject; In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided. However, a comment by user PMF reads: The Data Protection laws are mostly for companies, not for individuals. This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.
I believe you have just misunderstood what you paid for. Blizzard's End User License Agreement says: Your use of the Platform is licensed, not sold, to you, and you hereby acknowledge that no title or ownership with respect to the Platform or the Games is being transferred or assigned and this Agreement should not be construed as a sale of any rights. It also says: Blizzard may change, modify, suspend, or discontinue any aspect of the Platform or Accounts at any time, including removing items, or revising the effectiveness of items in an effort to balance a Game. Blizzard may also impose limits on certain features or restrict your access to parts or all of the Platform or Accounts without notice or liability.
Does GDPR prohibit reading unsolicited emails from people who have not explicitly opted in to a mailing list? tl;dr: No. I have never heard of this, and I don't see how this could follow from the GDPR. You should follow up with the Secretary to find out how she came to her conclusion. Detailed reasoning: The GDPR restricts the processing of personal data, so it does in principle cover reading email, since reading counts as "processing", and an email may contain personal data. However, Article 2 (emphasis mine) says that: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. I would read this to mean that a human reading emails is only covered by GDPR if the emails are part of a "filing system" or intended to be. So reading the emails is ok, it's only problematic if you intend to systematically store them. Even filing them, while covered by GDPR, would presumably be allowed, because to actually act on the email, you would have to keep it, and Article 6 allows processing of personal data to "take steps at the request of the data subject prior to entering into a contract" and when "processing is necessary for the purposes of the legitimate interests pursued by the controller". One caveat: If the email contains data that falls under special categories of personal data (Article 9) you may need explicit consent for storage. That covers things like racial or ethnic origin, political opinions, religious beliefs and health information. So if someone discloses a health problem or their religious belief in their mail, you may need to ask them for permission to keep it. In summary: At most, GDPR would require you to promptly delete the email once you no longer need it (which could be immediately if the email is irrelevant to you). If the email contains data you legitimately need (e.g. a complaint you need to follow up on), you are allowed to keep it as required (based on Article 6 (f)). Note that in both cases no explicit consent is required from the email sender, unless the email contains particularly sensitive data, such as political/religious beliefs or health data.
Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Thus, I think it would be invalid to charge a fee for an address change if that change was made in exercise of your data subject rights. If you didn't invoke this right, it's debatable whether charging a fee would be proper. On the one hand, they can charge whatever service they want (provided that this was part of the contract you entered). On the other hand, they have an obligation to assist you with your exercise of data subject rights. This includes recognising a data subject request even if you didn't explicitly invoke the specific GDPR article. For example, refusing a request for erasure just because you didn't invoke some magic GDPR words would be clearly noncompliant in my opinion. If the company offers multiple customer service options, charging for some of them may be all right. Typically, the lowest-cost solution for a company to deal with GDPR requests is to offer an online self-service option. An email to the data protection officer would typically also be free. Charging for phone support might be fine though. In an insurance context, there could also be a legitimate claim that updating your address is not a mere correction of your personal data, but a modification of the contract (depending on what you're insuring). Another possible counterpoint (which I think is not valid though) would be that the company never stored inaccurate data and therefore doesn't have to satisfy a rectification request.
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
Your confusion might be caused by the fact that even with a contract, only the data necessary for that contract is covered under the GDPR. So yes, while there might be an &quot;execution of contract&quot; under the T&amp;C, this would only cover necessary data. That means you can't ask arbitrary signup data under the guise of a contract. If you need to deliver a physical product, you can store a physical address. If it's an online service, you can store an email address or similar handle. But you can't mix the two. A physical address is unnecessary for the execution of a contract that's not physical in nature. Now, you mention &quot;consent&quot;. Under GDPR, this is a distinct justification besides &quot;execution of contract&quot;. You might have consent to store a physical address in addition to an online address, e.g. if you offer a customer to physically mail a password request form. This consent is additional to the contract. Also note that the bit above only covers the lawful reasons for the processing of personal data (article 6). You also have to obey the other GDPR rules, e.g. fully inform the user, make sure that consent is freely given, etc.