Session: Epic Fortnite Case and More, Paul Lanois, Fieldfisher

[Music] thank you [Music] so my name is Paul Manuel and I'm going to talk to you today about privacy so we are going to be talking about the fortnite case as well but then it was already covered this morning so I'm not going to spend too much time on it but it is still relevant obviously to to the gaming industry so you know before I begin who I am so I am Paul annual I am a director at the European Law Firm Phil Fisher I'm based in California and I advise clients in relation to privacy data protection and cyber security law and so I mentioned I'm based in California now and before joiningfield

Fisher I was working in in Switzerland and in Hong Kong I was with an International Bank credit Swiss where I was vice president and senior legal counsel and before that I've worked at European law firms in the United Kingdom in France and in Luxembourg um in relation specifically to the you know the gaming industry so I work a lot with uh clients across different Industries as well as game developers game Publishers as well as uh manufacturers of certain gaming related devices I'm thinking about virtual reality headsets and and so forth as well as manufacturers of uh connected devices and augmented reality software as well so let's you know let's begin let's begin so privacy is in the news a lot uh I'm sure you've seen some of the the headlines over the past couple of uh uh weeks months years uh so I've put here

you know some of the uh you know the recent headlines and as you can see there have been quite a number of high profile cases uh AI for example since everyone is talking about AI this there is a you had this decision from the Italian Authority uh uh earlier last month where they had initially banned the use of charge GPT in Italy because they say that uh chair GPT do not comply with the European General data protection regulation the gdpr and they will issue the small in relation to uh children being allowed on the platform and so forth so those issues have now been resolved so now charge GPT is back online in Italy um but they do have to to make quite a number of substantive changes as well to their privacy policies the notices now they are they have also committed to uh you know to implement certain parental consents and and to restrict as well the

use of the platform to Children uh there is uh there are quite a number of decisions as well in relation to a social media platforms uh Tech talk meta as well as apps which are used for for communication WhatsApp as you can see here there was a fine of 200 225 million euros against WhatsApp uh Amazon had a record fine of 888 million dollars as well in relation to uh the deployment of cookies without getting consent from the users so you really have lots of incidents in relation to privacy but then many of you may be saying well okay that's you know that's nice but what about the gaming industry specifically and what are the cases uh you know you know what are the the big decisions well you do have of course the Fortnight case whereby uh epic games the the developer fortnite they had to they were required to pay 520 million dollars in total in relation

to a certain privacy violations there was a component in relation to uh children because there was there wasn't any uh control in relation to uh children being allowed onto the platform and then they will also certain practices what the uh what what The Regulators call dark patterns whereby certain design choices as well were deemed to be misleading and to be a predatory as well so we talk about it later on as well there is a small a decision sorry a case in relation to a Swiss game developer a mini clip which was uh you know which took place with the FTC so you may be wondering well wait a minute why is the US FTC the U.S Federal Trade Commission going after Swiss game developer you know what's the connection and what happened here was that you have this game developer who indicated in their privacy policy that

they were a member of the Cooper Safe Harbor program so it's a it's a it's a program whereby you have to to commit to certain privacy commitments and you have to register with the FTC and then they would monitor you and so forth and what happened was that the company was initially a member of this program and then they decided you know what we are going to leave live but then they didn't update their privacy policy they just left it as it is and then the FTC said you know this is misleading this if you're no longer a part of the program fine but then you have to remove it from your privacy policy and so forth so that's the reason why you have this uh Swiss uh game developer who is on the list and you know this brings me to the uh to to another point that I want to mention as well is that in many cases you have game developers who would uh use a privacy policy that they found online from somebody else uh you know they would say you know what it's too

complicated I'm just going to do a copy and paste of another game developer because they're doing something similar to what I'm doing and you know it looks nice so I'll just copy and paste and then I'll use it as my own privacy policy so that's something that we see a lot and unfortunately in many cases it does lead to uh to problems down the road because uh you know they haven't really considered the content of the product obviously policy maybe the the company is doing slightly different things they may not be collecting the same types of data or they may be they may be using the data for another purpose and uh you know if that's the case then the privacy policy would be deemed a misleading and uh you know this could lead to sanctions as well on the data protection laws um you know I'm sure many of you have heard of the gdpr the European General data protection regulation in the EU and you may be thinking well okay well that's the EU but what about here in the US and what are the what are the laws in

place and uh you know historically there haven't been too many uh uh you know rules or laws in relation to to privacy in the U.S so you do have of course the FTC who goes off the companies whenever they deem the practice to be deceptive or misleading but then you know traditionally they haven't been uh you know too many comprehensive privacy laws but then recently this has changed and it's and it's still changing because you have more and more privacy laws which are being introduced here in the US so on the on the slide like I've put in the the new privacy laws which are in effect this year so you have you have uh the California consumer privacy like the CCPA which already entered into false back in 2020 but then there were certain amendments which were introduced earlier uh earlier desio to the amendment supplied since January and then Virginia as well have a new Privacy Law that has entered into effect in January in July

we'll see Colorado Connecticut and then at the end of the Utah and uh you know as we look at uh you know the following years there will be other laws as well Indiana Montana Tennessee Washington and so forth so you you know really I would say that privacy is becoming more and more a concern for regulators and legislators across the states Innovation specifically you know to the to the types of data which which is covered in one point I I I you know I wanted to to highlight as well is that the employee data HR related data that is under the scope of California losses some many people don't realize that but then in relation to your employees you do have certain privacy uh obligations you have to have a certain disclosures as well in relation to uh to data that you collect from your employees employees have certain invites and you have to to abide by those in California you don't see those yet

across the other states so surviving mind is different and then in relation to data that you collect in relation to business partners and so forth that is also under the scope of California Privacy Law even though it's not yet covered in the other state laws the the sanctions you can see here on the slide uh it's it can be quite High because the the amounts indicated here up by per violation so each violation would uh it would mean that you would have to multiply the amount uh by the number of times that an individual has been impacted by the violation uh the uh the last point I wanted to to quickly mention on the state laws is that in relation to the right of action and individuals do not have the right to sue so they are not able to bring an action for a violation of the respective Privacy Law uh and in in California the wire is limited so the the individuals

can only Sue in relation to uh uh to data which was impacted by a data breach but this doesn't mean that uh individuals have no big cause because in effect what they're going to do is that they will just complain to the Attorney General's office they will complain to the regulators and then The Regulators would investigate and they would uh bring in enforcement actions and in fact when you talk to Regulators they will tell you that most of the time the investigations that they begin would be due to complaints that they receive from individuals and otherwise they would be looking at what's happening on in what's happening in the news and they also check social media as well to check you know what's going on what are the Hot Topics at the moment is there any uh in other lots of unhappy people on social media and if that's the case then maybe that gives a ground to to investigate

um personal data that's it that's a topic which you know may seems to be quite obvious but then it's not always that uh that obvious for everyone because uh many times we hear developers saying well you know we don't Collide personal data so the data protection laws don't apply to us so you know we don't necessarily know the names of the individuals we don't collect that we just collect the email address we have a user account and so forth so uh you know really we want we don't have any personally identified viable information and you know that was valid for many years until recently because with the new data protection laws whether it's in the US or in the EU you have a much broader definition so you would have this concept of personal data for example under the gdpr or even under the uh the new U.S state laws where they would say well any information that is related to an individual which is identified or identifiable that is personal data so the IP address would be

one example that is explicitly mentioned in California law for example or in the or in the gdpr you have the email address which is also another type of uh personal data and you know even if you have they use an account or an email address which is uh you know which may appear to be generic for example let's say super SQL SQL survey super secret squival007 gmail.com some of you may be saying you know what's that it's not uh it's not a name I can't determine who it is well it doesn't matter that is under data protection laws that is information relating to an individual that is uh identifiable therefore it is personal data another big Point under the data protection laws would be the selling or sharing of personal information and I know what many of you may be thinking we

are not selling data we are not a data brokerage film we are a game developer so why do we need to you know to talk about this well you have on the California law and the other state laws you have a very broad definition of selling of personal data so they say that whenever you disclose data to a third party and you get some form of benefits whether it's money or something else then that is a sale of personal information on the California law and there was for example a couple of months ago there was this big decision by the California attorney general against a huge Cosmetics company and that company was fined uh 1.3 million dollars and the Attorney General's argument was to say well there was a sale of personal information because the company was using analytics they were using an analytics provider they were disclosing information because they wanted to have

Insight on who is using the uh you know the website you know what features are being used so that it was you know there wasn't necessarily the names of the users but then the analytics provider was collecting data usage information to understand which which section of the site is being clicked on and so forth and due to that that is considered to be a sale and therefore you need to disclose it in your privacy notices and you also need to provide individuals with the ability to opt out of the sale of personal information and you have quite a number of companies who have been receiving a smaller over the past couple of months and notices from the California attorney general for violations of the CCPA so you have uh in a way you have one here so this is actually a screenshot from The Office of the Attorney General where they mentioned uh cases that they have actually looked into they have

anonymized it so they don't disclose the name of the offending game developer or the in this case the game publisher but then they did say that you know they reached out again they reached out to a game distributor and apply AC policy was not considered to be satisfactory there were certain deficiencies there was the categories of information disclosed which was missing and the fact that the company was actually selling personal information within the the meaning of California law and there was no opt-out in relation to the disclosure to third parties uh there is another case as well against a game developer a mobile game developer where uh the the Attorney General said that uh there were insufficient Protections in relation to to miners uh that they didn't uh provide any optimal

mechanism as well or obtain opt-in for for minus so there are cases uh against uh against um sorry against game developers Showdown privacy another big topic uh as well uh you you do have quite a number of companies who are often being targeted uh Tech talk YouTube and and so forth uh where they had to pay huge amounts in fines for violations of uh of children Privacy Law uh just recently last month you had the the UK ICU the information commission's office who went off The Tick Tock for uh misusing children's data for not getting power into consent in relation to data that they collect from individuals under the age of 13. uh you have requirements under the uh under the new state laws as well in relation to design so this this may surprise many of you because uh

traditionally privacy laws do not really cater too much about the design choices but then now uh you have certain design requirements for example in relation to the accept button that you have is it the same size as the button to refuse is it the same color is it more prominently placed and so forth and if that's the case be careful because it is considered to be a dark pattern uh the fortnite case for example did mention dot patterns and it is a new requirement which has been put into the California and the Colorado State Privacy Law so you do have requirements as I mentioned the size of the accept accept button the uh the fact that for example that you shouldn't have any boxes which are pretty or pre-selected that would be considered a dark pattern do you have any what they call emotionally manipulative language or visuals in order which I use to push users to click on something for example

is telling them that uh yes I want to miss out on this uh you know that would be considered uh emotionally manipulative so be careful in the in relation to the language that you use in in your apps are the other points as well that which I mentioned in the in the the regulations in relation to dark patterns you mustn't create any false sense of urgency you cannot use double negative you cannot uh have lots of pop-ups appearing which may be considered disruptive to the user's experience because the user will of course be tempted to click on the button yes so that they can get rid of the the pop-ups uh you need to make sure that you don't create too many steps in in order to benefit from a privacy uh options and then you mustn't have any language which is deemed

explosive Amazon exploit vulnerabilities of young children you have to make sure as well that yeah you don't require too many clicks and you know be careful as well because next year you would have the California age-appropriate design code act which will come into effect in July 2024 and then they would also that legislation will also impose certain requirements in relation to how you design uh apps and how they maybe are targeting children and other vulnerable individuals I'm not sure how much time I have amount of time okay okay yeah let me know if there are any questions otherwise I'm I'm still around here if you have any questions um thank you very much more that's great um

[Music] [Applause] [Music]