Hacking EU Users: Super Ban - GDPR Template

[biggyd]

I have something us EU Citizens can try. I believe this data collection is going against the privacy laws in the EU.

If you have been "Superbanned" and you can not update your hardware device that you paid 'money' for. You could start with this:

Please see the Nintendo site for the proper mail. As it is a GmbH (Germany) you could do it to "[email protected]" but there are more emails, check your local site.

Belgium: [email protected]
Germany: [email protected]
Spain: [email protected]
France: [email protected]
Italy: [email protected]
Netherlands: [email protected]
Austria: [email protected]
Portugal: [email protected]
Switzerland: [email protected]
UK & Ireland: [email protected]

Or my regular mail:

Nintendo of Europe GmbH
Herriotstrasse 4
D-60528 Frankfurt am Main
Germany


Request to see the Data they have of your Device (GDPR Data Request):

------------------------------------------------------------------------------------------------------------------

Spoiler: GDPR Data Request

Subject: Request to access to personal data according to Art. 15 GDPR

My reference: 2018-######
Date: 2018-MM-DD

To Whom It May Concern:

I am hereby requesting access according to Article 15 GDPR. Please confirm whether or not you are processing personal data (as defined by Article 4(1) and (2) GDPR) concerning me.

In case you are, I am hereby requesting access to the following information pursuant to Article 15 GDPR:
1. all personal data concerning me that you have stored;
2. the purposes of the processing;
3. the categories of personal data concerned;
4. the recipients or categories of recipient to whom the personal data have been or will be disclosed;
5. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
6. where the personal data are not collected from the data subject, any available information as to their source;
7. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for me.

If you are transferring my personal data to a third country or an international organization, I request to be informed about the appropriate safeguards according to Article 46 GDPR concerning the transfer.

My request explicitly includes any other services and companies for which you are the controller as defined by Article 4(7) GDPR.

As laid down in Article 12(3) GDPR, you have to provide the requested information to me without undue delay and in any event within one month of receipt of the request. According to Article 15(3) GDPR, you have to answer this request without cost to me.

I am including the following information necessary to identify me:
Name: [OPTIONAL]
E-mail: [OPTIONAL] (eshop email, If you use it on the switch, I recommend you add it)
Console-Serial: ########
Console-MAC-Address: ########

If you do not answer my request within the stated period, I am reserving the right to take legal action against you and to lodge a complaint with the responsible supervisory authority.

Yours sincerely,

########

------------------------------------------------------------------------------------------------------------------

Extra Info:

Do not forget to change the Date & "#######"

You can also add your eshop email or other info (if you have a Nintendo account) if you wish. They are required to give you all the data they have.

This way you can request to see the Data Nintendo has of you.

After this, you could go to the next step and request that Nintendo deletes all data they have (meaning the block) from their server. If you still get the error, this means that they have not.

Request to delete the Data they have of your Device (GDPR Erasure request):

------------------------------------------------------------------------------------------------------------------

Spoiler: GDPR Erasure request

Subject: Request for erasure of personal data according to Art. 17 GDPR

My reference: 2018-######
Date: 2018-MM-DD

To Whom It May Concern:

I am hereby requesting immediate erasure of personal data concerning me according to Article 15 GDPR.

Please erase all personal data concerning me as defined by Article 4(1) GDPR.

I am of the opinion that the requirements set forth in Article 17(1) GDPR are fulfilled.

If I have given consent to the processing of my personal data (e.g. according to Article 6(1) or Article 9(2) GDPR), I am hereby withdrawing said consent.
In addition, I am objecting to the processing of personal data concerning me (which includes profiling), according to Article 21 GDPR.

In case you have disclosed the affected personal data to third parties, you have to communicate my request for erasure of the affected personal data, as well as any references to it, to each recipient as laid down in Article 19 GDPR. Please also inform me about those recipients.

If you object to the requested erasure, you have to justify that to me.

My request explicitly includes any other services and companies for which you are the controller as defined by Article 4(7) GDPR.

As laid down in Article 12(3) GDPR, you have to confirm the erasure to me without undue delay and in any event within one month of receipt of the request.

I am including the following information necessary to identify me:
Name: [OPTIONAL]
E-mail: [OPTIONAL] (eshop email, If you use it on the switch, I recommend you add it)
Console-Serial: ########
Console-MAC-Address: ########

If you do not answer my request within the stated period, I am reserving the right to take legal action against you and to lodge a complaint with the responsible supervisory authority.

Yours sincerely,

########

------------------------------------------------------------------------------------------------------------------

Good luck and godspeed.

Make sure you are an EU citizen & bought it in the EU (they will be able to check that on the serial).

Why would they get nervous about this you may ask?

------------------------------------------------------------------------------------------------------------------

GDPR fines info:

If there is one thing that people know about the GDPR it's that GDPR fines(administrative fines) can go up to 20 million Euros or 4 percent of annual global (note global!) turnover, whichever of both is highest.
They are not going to risk this for a banned account.

------------------------------------------------------------------------------------------------------------------

Guarantees?

Absolutely none. What do you have to lose? (Except for time, but I've minimized this for you).

Some people in this topic have magic-8-balls and a glass ball to see the future. Or have a 20 year law degree and such to know everything. My advise, ignore them. Commenting without having it tried out is utterly useless.

One personal friend of mine has done a data request, I'll post some of those results here once he gets an answer.

------------------------------------------------------------------------------------------------------------------


Some Feedback & Interesting info:

Comment: Nintendo owns the games. Reply ->

Not how it works in Europe, at the moment it's unclear. But right now European Court have said that you can sell it on, and therefore there must be a ownership for you.

https://en.wikipedia.org/wiki/Digital_goods

It's fully possible that Nintendo is breaking the law by blocking your account with games on it. That's what I'm most intrested about. Because that would be a whole lot of stores would have problems. Today for example EULA means jack in Sweden, it got no legal grounds. First, they must proove that "I ACCEPTED" it. Not my cat, my neighbour, my girlfriend, but I, as the account owner accepted the EULA. And a lot of the parts in the EULA breaks Swedish law. That's why I think Nintendo don't have a single leg to stand on if it reaches the European Court. My purchase is that I own said product. It might even be illegal for the to block the console since it violates the usage of it. As it haven't been tried in court, it's a grey area.

 

[guitarheroknight]

There's no fuckery in Europe!

 

[Nightflash]

Though I would be delighted if this actually turns out to be working the way you intend it to be, I highly doubt they will kindly grant your request as in "You asked for it, here we will reverse your ban even though you heavily violated our Terms of Service"

Edit: I never fully read their ToS (I mean who did and still remembers?) but I guess they are protecting their butt against anything like this. Or at least they will in the next ToS update

 

[antiNT]

That's intersesting, have you sent the mail to Nintendo already ?

 

[wurstpistole]

I was thinking for one second that this way I am essentially giving away who I am, and they know who pirated stuff on their console. Making me a target.
Then again, my account is linked to the console in question anyway, fully with mail adress and credit card information.

 

[barronwaffles]

Although I don't think it has been legally contested yet I think you need to spend more time studying the GDPR and what is considered to be 'Personal Data' under it.

 

[biggyd]

Though I would be delighted if this actually turns out to be working the way you intend it to be, I highly doubt they will kindly grant your request as in "You asked for it, here we will give you everything back even though you heavily violated our Terms of Service"

It does not matter if you voilated their ToS. They can sue you, or whatever, sure. But they are required to give you access to your data.

Edit: On your edit, they can update their ToS however they want. The GDPR rule always outweights any ToS. Or else every company would have updated their ToS before the GDPR and would have made it all useless. ;-)

That's intersesting, have you sent the mail to Nintendo already ?

I have not. This is just advice to people who wish to do so. It is more like "What do you have to lose?"

 

[Nightflash]

It does not matter if you voilated their ToS. They can sue you, or whatever, sure. But they are required to give you access to your data.

Yes, I didn't question the access to our data but I meant the ban reversal

 

[ghjfdtg]

Here is why this won't work: The data stored about the state of your console is not your personal data. It's data about your console.

They will happily delete any telemetry data but they won't take your cert from the blacklist.

 

[biggyd]

Yes, I didn't question the access to our data but I meant the ban reversal

We bought a device from Nintendo, and probably also some cartriges of games. We are by law allowed to update this. They cannot block us because they see something on their servers. ToS or not. They could go to court and the court may decide on this. But not them. Of course they are just blocking it and expect little to no resistance.

--------------------- MERGED ---------------------------

Here is why this won't work: The data stored about the state of your console is not your personal data. It's data about your console.

They will happily delete any telemetry data but they won't take your cert from the blacklist.

The cert is on your switch, which you bought. Meaning your data. They have to delete it from their blacklist. If they do not, they are not complying with the GDPR removal request. What they could do, is get everyone to court, have a long case, trying to prove that they are doing something illigal bla bla bla. They could lose or win, but one thing would be for sure, they will lose money. This is the EU, not US. So people are not paying millions in fines. The consumer is safe.

 

[ghjfdtg]

Whatever. Try to fight in court and i guarantee you will lose. It's not worth the effort trying to get unbanned.

 

[Kukielka]

Here's the thing, this will do absolutely nothing. Why?
GDPR restricts the data collection of personal information.
The serial# of the console ist not personal info.
They can still collect data as long as no IPs are attached to the log e.g.
They can still save the serial# and tag is as banned.

 

[Cyan]

it's not your data, you only have a temporary license to use it. you paid for the license to play a game, not the game's data.
you lost that license's right by going against their TOS.

Also, you are not fully blocked to update your own hardware, you can update it with a game cartridge. they only restricted network access to their servers because again you didn't follow their code of conduct.

GRPD is about telling you what they do with your personal information.

 

[c80]

Request to see the Data they have of your Device (GDPR Data Request):

This won't work because GDPR protects only personal data.

Die DSGVO schützt nur PERSONENBEZOGENE Daten. Das kann also niemals funktionieren.

 

[biggyd]

Whatever. Try to fight in court and i guarantee you will lose. It's not worth the effort trying to get unbanned.

It will not get that far (court). This topic is more something you 'could' do. It has no guarantees. But it is better than nothing.

Here's the thing, this will do absolutely nothing. Why?
GDPR restricts the data collection of personal information

As mentioned, you could put your email info in there for your Nintendo account. The GDPR data request will force them to give you all data they have on your account. Again as above, it is something, better than sitting and doing nothing. What do you have to lose?

 

[Kukielka]

As mentioned, you could put your email info in there for your Nintendo account. The GDPR data request will force them to give you all data they have on your account. Again as above, it is something, better than sitting and doing nothing. What do you have to lose?

Time. You waste Time.

 

[biggyd]

it's not your data, you only have a temporary license to use it. you paid for the license to play a game, not the game's data.
you lost that license's right by going against their TOS.

Also, you are not fully blocked to update your own hardware, you can update it with a game cartridge. they only restricted network access to their servers because again you didn't follow their code of conduct.

And how do you update your game (cart)?

Time. You waste Time.

Sure, that is your opinion, be optimistic or pessimistic. Freedom of choice.

 

[Kukielka]

And how do you update your game (cart)?

Most do it via Tinfoil / Devmenu and install the NSP manually.
I update via SXOS cause Nintendo seems to not ban me since I use my own legit card dumps.

Sure, that is your opinion, be optimistic or pessimistic. Freedom of choice.

Not beeing optimistic, nor pessimistic. This is realism. I work in this kind of business myself. A ban is a ban. There is no magical keyword you have to say to get unbanned.

 

[c80]

that is your opinion

That's not an opinion, that's a fact. I think you don't understand GDPR

 

[Cyan]

the game update is maybe not part of their obligation to deliver to you. you bought the game, not the updates.
the only issue could be with games you buy on cart but can't play AT ALL if you don't complete the data (L.A Noir, Banner saga 3), but it should be clearly mentionned on the cartridge's box that you NEED network access to get full game.
if you buy it but are banned, not their fault, unless it's not written on the box.

then, yeah, if you are banned after buying one of these games with mandatory connection to start it, if you format, and lose your SD, then you can't get it back. that's another story. I don't know about it. just try asking them.