GDPR Client Access

Question

question

qogadmin asked Jul 12, '18

GDPR Client Access

We have already implemented the Unity privacy via a button which opens up a Unity URL to show information on what Unity analytics covers and the ability to opt out along with built in functionality to control the data in the app itself. We're now in the process of adding in Playfab privacy, but our entire system is a mix between read-only client side data, and CloudScript functions to simulate server. The Export/DeleteMasterPlayerData calls seem to be locked behind the Admin API which would imply the only way to have access to these functions is either manually, or via a separate server app with admin access which is prohibitive currently. Is there no other way to have buttons on the client which the user can press and get their data emailed to them without going through Admin API?

Player Data

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2018-07-13T01:13:49Z

brendan answered Jul 13, '18

Right now, the design is to allow titles to support user requests via a customer service team, or their own site (so, your game site could be the server making the requests, for example). We do plan to provide similar functionality in the Client API at a future date.

2

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Paul Pacheco commented · Nov 30, 2018 at 05:15 PM

Any progress on this?

It seems the whole export data is very labor intensive. Users click on export data, and we are responsible for checking our email and send the information to the users, who may not have an email address set up (anonymous login).

Can this not be done self service?

For example, user clicks on export data, the api returns a link. If the user clicks on the link too soon, it can say "Collecting your data... please check in a few minutes", if the data is ready, the link would have all the data.

0 ·

brendan Paul Pacheco commented · Nov 30, 2018 at 05:55 PM

We've made a very conscious effort to remain a "whitelabel" service. For the most part, players aren't even aware that they are using PlayFab, since we only appear as a logo in your splash screens and/or credits. That's intentional - PlayFab doesn't "own" the player. So unless it's something that we heard from a significant portion of our developer community about, it's unlikely that we'll be creating any new player-facing content.

For completeness (I know you're not asking this, but it may be something others are wondering), it's not going to be the case that there will be an API call that immediately returns all the data in the foreseeable future. To ensure full GDPR compliance, we have to do multiple searches through the data to be absolutely certain that all information about the individual has been accounted for.

0 ·

question