[Bosnia and Herzegovina] Subject Access Request refusal by data controller

Let me just start by saying that my country's data protection law is closely modeled after the GDPR (basically mirrored since we're trying to become a member state of the EU), meaning I have the legal right to request a copy of my personal information from data controllers like the specific company I'm making the request from, even if their company is not in my country.

A bit of context on the issue, I asked for the billing address used on two older orders because I remember there was an AVS mismatch at the time. It took me days to figure out with much trial and error, but I forgot what I did to make it work, all I remember is that the address didn't match my bank statement. My now ex bank couldn't help, so they referred me back to the company because the AVS is on their side, so I made a Subject Access Request for a copy of the billing address, provided the 4 last digits of the card, and my ID.

For about 20 days, they kept treating it as a normal billing issue and ignored the actual request. I kept repeating that I wasn't asking them to fix a payment, I just wanted a copy of the address they already have stored. Only after I mentioned the 30 day deadline and said I would escalate it to my data protection authority if it continued to be ignored until then did they finally address it... by saying they couldn’t give me the information.

When I asked for additional information on why they couldn't, they said it was for security reasons, which I told them was too vague and that the law requires them to cite a specific legal exemption... which they responded by repeated the same answer. I then asked a simpler question, which was just to confirm the last four digits of the card used on those two orders - I provided them the last 4 digits of both cards I owned at the time and only asked to verify whether it was one or the other, thinking 'they request this data when handling billing issues, surely they can just verify whether I remember something wrong, maybe I didn't even use this card to begin with?'

And as a response I got:

"Be advised that we cannot disclose your information to you. As the legit owner of your account, you should be the one who is responsible to remember all correct information.

Thank you for your understanding. "

At this point I asked them to confirm whether this is their company's final decision, and said they can close the ticket if it is, and once they did it would be escalated to my data protection authority as a formal complaint for them to review.

Extra details of note, I also messaged their company's privacy email - and it opened a ticket for the same support. I asked support whether I'm on the right channel and to refer me how to get in contact with their DPO if I was using the wrong channel but they ignored that request entirely. The team they did send this to was an 'engineering' team, and I've never had any confirnation on what team is handling the requests or any detailed information I asked.

So, since my country's laws are basically a mirroring of the GDPR, I want to know everyone opinion on how I handled this situation and how said company's support handled my request?

For reference, this is our data protection law: https://azlp.ba/propisi/default.aspx?id=4546

I reference articles 6, 14, and 17 since they are of key relevance.

reddit.com
u/Xeryxoz — 2 days ago
▲ 9 r/imvu

IMVU customer support doesn’t seem to understand what a Subject Access Request is.

Let me just start by saying that my country's data protection law is closely modeled after the GDPR, meaning I have the legal right to request a copy of my personal information from data controllers like IMVU even if their company is not in my country.

A bit of context on the issue, I asked for the billing address used on two older orders because I remember there was an AVS mismatch at the time. It took me days to figure out with much trial and error, but I forgot what I did to make it work, all I remember is that the address didn't match my bank statement. My now ex bank couldn't help, so they referred me back to IMVU because the AVS is on their side, so I made a Subject Access Request for a copy of the billing address, provided the 4 last digits of the card, and my ID.

For about 20 days, they kept treating it as a normal billing issue and ignored the actual request. I kept repeating that I wasn't asking them to fix a payment, I just wanted a copy of the address they already have stored. Only after I mentioned the 30 day deadline and said I would escalate it to my data protection authority if it continued to be ignored did they finally address it... by saying they couldn’t give me the information.

When I asked for additional information on why they couldn't, they said it was for security reasons, which I told them was too vague and that the law requires them to cite a specific legal exemption... which they responded by repeated the same answer. I then asked a simpler question, which was just to confirm the last four digits of the card used on those two orders - I provided them the last 4 digits of both cards I owned at the time and only asked to verify whether it was one or the other, thinking 'they request this data when handling billing issues, surely they can just verify whether I remember something wrong, maybe I didn't even use this card to begin with?'

And this image you are currently seeing is the reply I got...

At this point I asked them to confirm whether this is IMVU's final decision, and said they can close the ticket if it is. If they stand by this response, I intend on sending the whole conversation to my data protection authority as a formal complaint for them to review.

What does everyone else think - since my country's laws are basically a mirroring of the GDPR, how has IMVU's support handled my request?

u/Xeryxoz — 2 days ago

I figured out a way to upgrade our DSS Eagle Storm, hear me out!

  • Eagle Storm should be able to call in every Eagle stratagem helldivers have at their disposal.
  • Once an Eagle Storm is in effect, markers will designate strike zones and gives players time before they hit.
  • Helldivers will have 3 seconds before an initial Strafing Run, Smoke Strike, or Gas Strike (if added).
  • After the initial strike, helldivers will have 2-4 seconds for a Cluster Bomb or Napalm Airstrike (which will be coming right after the opening strike).
  • If a player designates a Heavy/Tank enemy during or before the warning window for the initial strike, the Cluster Bomb / Napalm Airstrike will be substituted for an Eagle Airstrike, 110mm Rocket Pods, or a 500kg Bomb on the designated target

By expanding the Eagle Storm capabilities and creating a window where the Helldiver can react to an incoming strike, as well as expanding the opening arsenal to not only use Strafing runs, Helldivers will potentially have a lower mortality rate from Eagle-2's involvement!

u/Xeryxoz — 2 months ago
▲ 1.4k r/Gamerbro_Advos+2 crossposts

#StopPayingGames

This is self explanatory; to all who do not support the idea of player ownership, there shall be no further funding, regardless of their game's quality. #StopPayingGames until they #StopKillingGames by not buying any new or existing products that you do not already own. You can do this regardless of your country; play what you already have access to, and buy nothing else until there are proper legislations against this malpractice - and that also includes applying them to stores like Steam.

Disclaimer: Nintendo and Epic Games have not exactly voiced an opposition, and hold positive values from what conversations have pointed in the comments, so take their placement on this list with a grain of salt.

To answer everyone's constant question of 'Why is XYZ on this list' it's because these companies are implicated as opposition to SKG's proposals (VGE or ESA lobbying).

u/GBAMFSSpox — 2 months ago
▲ 7 r/manga

[Accomplishment of the Duke's Daughter] - Anybody still remember this?

u/Xeryxoz — 2 months ago