YouTuber, JillBearUp, Shows Why Strong Privacy Laws Are Important

A Youtuber by the name of JillBearUp is offering an excellent demonstration on the power of having good privacy laws.

One of the things I sometimes get asked about is why I keep pushing the idea that privacy reform is badly needed in Canada. My answer is often simply showcasing the very vivid reasons by using Europe’s General Data Protection Regulation (GDPR) as a great example as to why having strong privacy laws are so critically important to a functioning democracy.

Indeed, the GDPR became law clear back in 2018. The ideas behind it can be quite simple at times. For one, users should be given the opportunity to give consent on when tracking cookies can be used on them, properly store people’s personal information using certain standards of protection, and if hackers do manage to break into your large database, notify authorities of this so that users can be alerted to the breach (many companies have a habit of otherwise hiding such incidences and letting the users suffer the consequences). Basic common sense, really.

European digital rights organization, at the time, hailed the moment this became law as ushering a new era for respect to privacy as the then new law provided a brand new golden standard for privacy laws in which the world could follow. In the months that followed, it became readily apparent just how badly Europeans needed these laws. In the first year, regulators racked up 160,000 security incidences. As a result, the immediate first problem was that the law was far too successful. It left regulators to scramble to hire enough staff just to keep up with all the security breaches and incidences.

As time went on, the benefits of the law were quite obvious. For one, companies were reworking their systems so that they can be compliant with the law and, as a result, actually respected users privacy. For another, it resulted in the flow of hundreds of millions of euro’s as the continent finally started laying down the law on companies that took a more, how shall we say, Laissez-faire attitude towards people’s personal privacy. Ultimately, it was a win win for a lot of people.

While the GDPR kept proving to be an overwhelming success, North America, namely Canada, has yet to really come to terms with this idea that privacy laws are even needed – despite the overwhelming obvious nature of how ridiculously outdated our current laws are which basically involves issuing strongly worded letters and calling it a day. The government can’t issue fines of any kind, but, instead, issue a public scolding and telling businesses that made particularly egregious privacy violations to “don’t do that again”. That’s not an exaggeration, it’s really that bad here in Canada.

While the examples of why the GDPR is so wildly successful are numerous, I recently stumbled onto an interesting down to earth case that highlights just how great European’s have it when it comes to having such laws at their disposal. JillBearUp, a YouTuber, apparently decided one day after getting randomly demonetized to look to alternative platforms to continue producing content elsewhere. Among the platforms she looked at was Twitch. After creating an account, her YouTube channel suddenly was re-instated as a monetized channel. So, she forgot about her dormant account until recently. You can check out her full explanation here.

For those who don’t want to sit through a YouTube short, the general gist of this is that she received a notification saying that she had been permanently banned from Twitch for apparent fraud in purchases our payouts. This, of course, is rather surprising considering the account was dormant the entire time and that she hasn’t logged into her account at all. There was no payment information on the account to actually commit said alleged fraud. The e-mail account wasn’t involved in a data breach as far as she could tell and Twitch hasn’t been involved in a data breach either. At any rate, she was permanently banned from the platform unless she appealed her ban.

She then did the obvious thing and get in contact with Twitch to try and figure out how this fraud even took place. So, she appealed the decision and tried to explain her situation. Two days later, Twitch responded to the appeal saying that after “careful and extensive review”, including her account history (to which there is none), Twitch said that her claims were “unsubstantiated” and that there are no appeals for this kind of behaviour. As a result, Twitch said, that was the last communication regarding this subject.

For North American’s, this is generally where the story would end. They were banned for no reason and no one at Twitch was likely going to even bother looking into how the suspension took place (as was probably the case here). The thing is, because JillBearUp leaves in a country under the GDPR, she still has options in this scenario. So, in response to all of this, and in a separate video, she submitted a Subject Access Request to find out what data Twitch actually had on her in the first place. This is only an option available to users who live in countries with strong data privacy regulations – to which she just so happens to be situated in one such country.

For those who think that there is nothing to be gained here and that such a request would probably be ignored, um, no. Such a request is legally binding and Twitch would be legally obliged to hand that information over or face extremely steep fines. Apparently, within 5 hours of submitting the request, JillBearUp’s Twitch account was mysteriously unbanned. This allowed her to download a copy of data Twitch had on her. At the very least, she was able to start looking in to why the heck she was banned in the first place.

So, she started pouring over the information she was able to obtain. The information she got was information that she provided when she signed up and 9 folders and a metadata file. The folders contained little more than empty CSV files which is, well, unsurprising considering the account was never really used. Other than that, it contained a log of the pageviews she got and login history which, again, showed nothing.

Of course, this doesn’t answer why she was suspended which actually meant that the Subject Access Request was not actually fulfilled. Under the law, Twitch has to hand over everything they had on her and the reasoning behind the ban was not within those files. An email copy of everything still has to be submitted and Twitch has one month to fulfill that obligation. So, she urged followers who live in GDPR countries who went through a similar experience to submit similar requests so that Twitch is legally obliged to explain the reasoning behind their respective bans. This so Twitch can fuck around and find out.

I think it goes without saying that this is an excellent demonstration of the power of having strong privacy laws in place in your country. Had JillBearUp been living in a non-GDPR country, the permanent suspension would have continued and she would have absolutely no recourse whatsoever. The entire second part of this story would never have taken place. Because she lives in a GDPR nation, she did have recourse for her situation. If Twitch does, in fact, ignore this request after one month, then she can contact her local Information Commissioner’s Office (ICO) so that they can proceed to deal with the situation and issue fines against Twitch as they see fit.

So, if looking at all the lovely numbers for fines and all the positive things that such laws can do for citizens are all things that make your eyes glaze over, then maybe this story should, well, tell the story as to why having strong privacy laws is so great. Again, this isn’t to say that GDPR is perfect by any means, but going without is substantially worse. It’s why that when I’m going through all of these political platforms here in Canada and seeing few parties even giving this subject the time of day, I get rather upset. I have plenty of reasons to be upset as do every other Canadian who thinks that their own personal privacy online should actually, you know, mean something. After all, all Canadian’s can do is look at the European’s with very understandably jealousy and envy.

Drew Wilson on Mastodon, Twitter and Facebook.