UK - Does a foreign, non-EU company&#39;s ToS Override GDPR
<p>MiHoyo is a Chinese company that has recently produced the hugely popular online game, Genshin Impact. However, terrible online security has led to thousands of user details, emails, phone numbers, and the accounts themselves being hacked and leaked.</p>
<p>Firstly, MiHoyo states in their ToS that the user is responsibly for their account security.
<a href="https://genshin.mihoyo.com/en/company/terms" rel="nofollow noreferrer">https://genshin.mihoyo.com/en/company/terms</a></p>
<blockquote>
<p>You shall be responsible for keeping your Account secure and confidential (including but not limited to usernames, passwords or other related account information). Also, you acknowledge that you shall be responsible for any and all behaviors performed and identified on or through your Account, whether or not authorized by you.</p>
</blockquote>
<p>But at the same time, it is MiHoyo's fault for allowing the security vulnerability to exist. Therefore, is it possible to file a GDPR complaint? Or does the ToS override this?</p>

<p>It is not clear that the cited ToS provision in any way contradicts or attempts to override the GDPR, or any other law. A hypothetical ToS provision that said that use of the site constituted consent for all cookies, or one that limited requests to review personal info held by the site to once per year per account would pretty clearly be contrary to actual provisions of the GDPR. In an EU court, the GDPR and iuts local implementing law would prevail, in a court from elsewhere, say a US court, the decision would not be so clear cut.</p>

gdpr data-protection china