In brief: The General Data Protection Regulation (GDPR) was designed to help protect the personal information of EU citizens, giving them more control over their data and how companies use it. But it’s also been used for an unexpected purpose: allowing a FIFA player to discover he’d spent at least $10,000 on the game over two years.

UK resident Michael, who didn’t want to reveal his second name, told Eurogamer he made the request on the day GDPR came into effect in Europe—May 25. He said this was motivated by the ongoing loot box controversy and a belief in momentum—the idea that FIFA cheats by creating “dynamic moments” that help the losing team or make things harder for the team that is winning.

"I was intrigued to see if any of the data related to any of these topics," Michael said.

30 days later, Michael received two 100-page long PDF files from EA that included his FIFA engagement data, stats, player transfers, and real-world money expenditure (in the form of FIFA points) on Ultimate Team card packs. While the many hundreds of hours he’d been playing game over the last two years probably didn’t come as a surprise, the $10,000+ Michael spent on it was a shock. “Gobsmacked,” as he put it.

"Special events such as Black Friday, TOTY, FUT Birthday, TOTS, Futties, etc, I would have thrown in thousands upon thousands of FIFA Points without even a second thought,” he said. Eurogamer noted that the actual amount spent on FIFA games is likely to be closer to $16,000 over the two years.

Michael said that since he and his fiancé have a high disposable income, that amount wouldn’t have caused a financial strain on the pair. But he says this should be a warning to those who might become addicted to loot boxes and can’t afford to sustain their habit.

As for Michael, he’s promised to try and cut back on his spending for FIFA 19. "If anything, the data EA has provided me has made me realize that FIFA Points are just not worth it and $10,000 will be better spent over the next two years."

You can find out more about Michael’s GDPR release on Reddit and Imgur.