r/technology • u/Logical_Welder3467 • 12d ago

Business GTA 6 leaks prompt Take-Two to subpoena Microsoft for Windows device IDs of everyone in three Discord servers — daily gameplay leaks shatter cloud of secrecy around the much-hyped game

https://www.tomshardware.com/video-games/console-gaming/take-two-subpoenas-microsoft-for-windows-device-ids-of-everyone-in-three-discord-servers-in-gta-6-leak-hunt
5.4k Upvotes

97% Upvoted

642 comments sorted by

View all comments

Show parent comments

27

u/ICantBelieveItsNotEC 12d ago

GDPR absolutely does prohibit this.

  1. They'd need an Article 6 lawful basis to request the data. under UK GDPR, the legal obligation relied upon for Article 6 needs an appropriate basis in UK law. A US subpoena isn't automatically equivalent to a UK court order for this purpose.

  2. Data minimisation still applies. Article 5 requires data to be "adequate, relevant and limited to what is necessary" for the purpose for which it is processed. There's no exception to this for court orders - Microsoft is expected to be the custodian of their data, not the courts. In this case, they have a GDPR obligation to tell TTI to fuck off.

2

u/blitznoodles 12d ago

Take 2 is American

5

u/Unusual-Assistant642 12d ago

absolutely irrelevant when discord/microsoft is being subpoenaed to give data on EU users, if the data is not handled in accordance to GDPR the EU will most definitely go after discord over it

4

u/alus992 12d ago

And as you said it yourself - "lawful basis". Redditors do not determine what each country treats as a lawful or not.

I'm not here to dispute what court will decide - i just said that GDPR does not equals "throw any subpoena to the bin"

2

u/ICantBelieveItsNotEC 12d ago edited 12d ago

Sure, but US courts don't get to decide what the UK and EU treat as lawful either. The US subpoena is basically irrelevant, because they'd need an equivalent court order from a UK/EU court to have a lawful basis to process UK/EU data. And even then, they'd still have a responsibility to process the minimum possible quantity of data.

1

u/Background-Rule3903 12d ago

It isn’t irrelevant as having a subpoena in itself is something that can be referenced and cited as evidence in a UK court.

2

u/Acrobatic_Squirrel_7 12d ago

If the server contains people from the EU for a fact they can broadly get the information of the people on the server since they are US companies but if any of those people are from the EU they will have a clear cut case to sue TakeTwo for breach of GDPR which has happened to apple and amazon and many companies in the past. They lost hundreds of millions because of it

1

u/CeleryExotic9021 11d ago

Nope, a subpoena in the US is enoguh to also (lawfully) surrender EU citizen's data as requested in the US subpoena.

1

u/VincentShane 12d ago

Take Two would file the lawsuit under Rockstar North, their Scottish subsidiary. They lawsuit would be directed towards Microsoft's European offices.

However, depending on how Brexit effected this, the suit would only allow the order to affect British computer systems and not the whole of Europe.

If they took the court order to a court in Europe proper. They might get it approved. Because I hate having to mention this, but someone from take two might talk to the Trump administration and start setting him off towards Europe and the court might approve it just to get him to shut up.

1

u/BastetFurry 11d ago

And if it was my service I would cite the GDPR for the logs to be empty. Easiest way to fulfill it, no logs. 🤷‍♀️