Maybe not for GDPR, but for me anything about me is personal and private unless I decide otherwise. Even if it's something as meaningless as my games library. To steal a line from the trailer I linked previously - "it's not that I have something to hide. I just have nothing I want you to see."

You seem to fail to grasp that for those of us who "overreact" it's the principle of the thing that matters, not some misinterpreted life-shattering consequences we fear in this particular instance. And that's because privacy everywhere is being eroded by one "unimportant" instance after another.

I am (mostly) knowledgeable about this subject. One of the things about the GDPR that is little understood by people who haven't been freaking out about it (or cheering it) for the last two years, is how broadly it defines "personal data".

If a bit of data can be used to identify an individual in any way (or to distinguish between individuals) - even if only through the use of other data sets, then that's personal data.

I don't know if you're aware of this, but back in 2006 netflix released an "anonymized" dataset of movie ratings, as part of a contest for building a better recommendation engine. Researchers were able to "de-anonymize" a scarily large amount of the users in that dataset by combining it with publicly available imdb data. The broad definition in the GDPR is particularly tailored to protect against that type of data-leakage.

No it's not. GOG even makes it clear what "Personal Information" entails and "activity" and your "active friends" do not personally identify you. I think a lot of people are misinterpreting what GDPR is actually saying. It's seems to me it's more geared to protecting actual information that can identify you, so actual personal information.

GOG doesn't get to define that under the GDPR.
They do. See my reply directly above.

Okay so let's take a look at what you posted:

They keyword here is "IF". So unless you can prove that by using "activity" and "active friends" you can identify any random GOG user that you have never met, then you will be hard pressed to prove that this information can be classified as "personal information" or "personal data" (and I very much doubt you will be able to do that).

I mean if the standard is "anyone can claim certain data is personal" then that is really bad. I mean we don't "own" our accounts so at what point did it become "personal data" vs "data owned by GOG". Even uploading an avatar gives GOG limited rights to it. I would assume to file a complaint or for an entity take action under GDPR you would actually have to prove said company violated personal information and that the information can help identify said users.

Well, you can already hide games. I presume these games will also be hidden from your public profile.

This isn't a very practical example. Being friends with x, y, z does not guarantee or even prove that are both the same user on GOG and social media alpha when using different (user)names. Furthermore the social network alpha would also have to display friends by default. It is also a very extreme case example, that probably is not a real world applicable to any accounts on GOG.

And as I said above one does not own their GOG account (they may own certain data provided to GOG like an email address) so at what point does it become "personal data" and not "GOG's data"?

And besides that apparently GDPR will be enforced on a country by country basis from what I am reading. So country A may use a more broad reading of the law than country B. There seems to be a lot of disagreement of how well the law can even be enforced.

And Poland, where GOG resides, has already expressed possibly enforcing the law differently then how it is written and even possibly giving exemptions to certain things: https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spark-outrage/

And as Taro94 said "I'm skeptical about the idea of GOG not being aware of what is and what is not allowed to be displayed without explicit user's consent". GOG has many lawyers and a legal department for this very reason.

Worst case scenario, GOG could just use geolocation data to set the profile default as private for EU users and public for NA users, etc. That should make them compliant.

My only gripes is with the default settings. It should be fully private and people then can open up as far as they want.

You severely underestimate just how realistic this is, and how significant (thus trustworthy) the results of attempting to match such interpersonal networks.

That would indeed be an acceptable solution (modulo EU-citizens who happened to be out of the region, but who'd still enjoy GDPR protection).

An excellent observation. I could not agree more.

You fail to see because you do not apparently understand how far past are we in terms of technological capacity for identifying individual users with seemingly innocuous data (also, hardware/software fingerprinting methods).

I do. I argued against the way GOG's modification of Privacy Policy was phrased long before it came into effect, with the usual result. Not least because of quite a few people with the "but GOG would never do anything wrong with your data anyway" mentality.

It's not about capacity. It's about legal protection of the very foundation of modern society (the very reason most Western countries protect privacy of individual voters).

Ultimately, I don't exactly think it's right for GOG to take my money only to tell me "lulz, SOL, git lost, scrub" down the line. Maybe my age is showing, but I'm neither used to nor am willing to accept the idea of one-way contract with any corporation.

You sold me goods under specific conditions, you can at least make some damn effort to maintain such conditions when the changes have nothing to do with your primary business.

And, by the by, on the subject of privacy. That recent FB login implementation?

https://techcrunch.com/2018/04/18/login-with-facebook-data-hijacked-by-javascript-trackers/

The more potential points of failure you introduce to your web site, the more likely it is to be affected by a breach. And Facebook is a huge and juicy target.

I really hope the Polish government gets shut down hard on this by the EU.

This is such a retarded idea I don't even know where to begin. Somebody must have paid well for the potatopoliticians in their pockets.

I'd like to have some of that EU privacy too, thank you very much, even if our government is famously the best money (that I don't have enough of) can buy :P

Edit: Also, the guy who people should have been listening to for years but it's not profitable:

http://nymag.com/selectall/2018/04/richard-stallman-rms-on-privacy-data-and-free-software.html

https://www.reddit.com/r/StallmanWasRight/

Oh I understand the possiblity of doing so, I just don't see how pratical it is with what data we are talking about in this specific case but maybe it's because it's not something I place of high importance on personally.

I'm also probably biased because I do web development and I can see the benifts of having profiles public vs private and why profiles being public is typically the rule not the exception. If I was making some kind of profile system for a web site I would also set the default setting to public, otherwise the feature would be a waste of development time because it probably won't be adopted large scale.

A little dated but still true today:
https://www.uie.com/brainsparks/2011/09/14/do-users-change-their-settings/

GOG is really no different than any other company that sells a service or goods online in this regard. Until somebody takes them to court over it or laws catch up to 2018 it probably won't change.

Poland has already shown they are more than willing to fight the EU on stuff, so who knows.

And what would stop you from changing some settings so you can have said privacy in this case in regards to GOG if they did decide to use geolocation to have different defaults based on location?

Thank you. This is exactly why I totally understand GOG's decision to make the profiles public by default.

I think the only reasonable middle-ground would be the suggested pop-up window on first login forcing the user to choose their privacy settings.

If the settings defult to full privact, the feature would be close to useless. If it defaults to publicity, people will complain.

This seems like the only reasonable option.

What I dont't get is why are some people sort of arguing AGAINST privacy?

Because we live in a fucked up dystopia where lack of privacy is becoming the norm and insisting on retaining it an aberration.