Timeline for How does GDPR affect game data and how it is processed?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 30, 2020 at 8:04 | comment | added | amon | @Trish Consent is far from the only legal basis, and rarely plays a role – I'm not sure why you bring it up here. You can freely claim legitimate interest as long as you perform a balancing test between the interest and the data subjects rights and freedoms, and as long as no other legal basis is prescribed by law. But this ultimately depends on OP's reason for making these heatmaps. Or are you concerned that OP's scraping of this data could violate non-GDPR rights, e.g. terms of service of an API provider? | |
| Aug 29, 2020 at 22:34 | comment | added | Trish | OP that that it is a third party that makes the heat map by mining the game data. A third party by definition can't have consent from the data owner or the processor, so they'd need legitimate interest... and I just don't see how they might get that. | |
| Aug 29, 2020 at 21:37 | comment | added | Matthew | @Trish I'm afraid I don't understand the comment? My last sentence is probably clumsily worded - I imagine OP is not specifically publishing it to a third-party, they could just be making it available to anyone through an API, for example. Furthermore, we don't know the basis of the processing in this question - it could be based on consent, or it could be legitimate interest. | |
| Aug 28, 2020 at 22:00 | comment | added | Trish | I don't see how a third party can have a valid interest in using the data from the controller that has consent. Consent is not transferable. | |
| Aug 28, 2020 at 18:57 | comment | added | Shuri2060 | I have edited the question to clarify. The point data is paired with the usernames. | |
| Aug 28, 2020 at 14:28 | comment | added | amon | I agree that a sufficiently coarse, randomly selected heatmap in isolation wouldn't be personal data. But the heatmap of a particular player would be that player's personal data. If the heatmap is not publicly connected to an identity, it might still be personal data if OP can make that connection (an example of pseudonymisation). Nevertheless, the act of creating the heatmap might still be processing of personal data and would have to comply with the GDPR, in particular Art 14. But there might be a decent argument that this falls under a legitimate interest. | |
| Aug 28, 2020 at 14:17 | history | answered | Matthew | CC BY-SA 4.0 |