GDPR/user data deletion: any way to remove user's crash reports?

Hello--

We've been making our app compliant with GDPR, including allowing users to request or delete their analytics data via DataPrivacy.FetchPrivacyUrl.

When we tested user data deletion we noticed that we still see old crash reports with that account's userid. Is this a hole in our GDPR compliance? And is there a way to delete crash reports from a given userid, either manually through a filter or automatically when the analytics data is deleted?

Thank you!

 

Can you provide a screenshot? Where are you seeing the crash reports? How is the UserID in a crash report connected to personal user information? You mention account, does each game player in your game have an account in your system? I suspect that is what you are referring to

 

Hello, Jeff--

Thank you for writing back so quickly. Right now the custom data in our crash reports does not have anything to identify users, though obviously we could include personal data if we chose. But I could imagine a user expecting crash reports to be deleted when they submit a request to delete all of the data we have collected for them.

The userid I'm referring to is just the one Unity provides:

It sounds like there's no automated system for deleting these, then?

Thanks!

 

Can you send me a direct message with the URL that you are referring to? I will check with the correct team here.

 

Unfortunately there isn't a way to selectively delete certain crash reports, only all of them. The reports aren't publicly viewable or searchable, you need to be logged in to view them. So you would be the only person with access. Are you storing their UserID somewhere in your system where you could do a lookup? If you have further privacy concerns, I would recommend that you reach out to gdpr@unity3d.com

 

Hi Jeff--

Thanks for looking into this. I'll pass this along to our team.

 

I confirmed with the legal team here. We looked into the details of this report and no personal information is contained in the report itself. Upon user opt out/ deletion the UserID is no longer considered PII as all other information is deleted. At that point it becomes a random string of numbers that doesn’t trace back to the individual