1

A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'.

An unaffiliated 3rd party processes that data (in particular, it accumulates statistics on point change) to generate 'heatmaps' of player activity which can help deduce player online times (which has a direct impact on game strategy) and publishes it on their website. For players with high activity, this may lead to sleep pattern/time zone deduction.

Does GDPR affect the publication of game data like player points?

Improve this question
3
  • One question per post please
    – Dale M ♦
    Commented Aug 27, 2020 at 21:45
  • Are all 4 not interrelated? I would not want to post the same introduction 4 times in separate threads
    – Shuri2060
    Commented Aug 27, 2020 at 22:11
  • Sure they are but everything on this site is about law so all questions are interrelated to some extent. The questions you asked were sufficiently distinct that they should be different questions. We don’t charge for questions - post as many as you like. You can wait for answers to come in here to inform your other questions. Or not.
    – Dale M ♦
    Commented Aug 27, 2020 at 23:56

1 Answer 1

Reset to default
2

Sleep pattern and timezone deduction are arguably not "personal data" within the meaning of the GDPR. Personal data is defined in Article 4 as:

any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

So, if the published data is solely activity that could theoretically create a heatmap of activity and determine someone's timezone and does not include any other data (e.g. their online tag/identifier, etc.) then publishing just the activity data would not seem to involve any GDPR personal data obligations.

However, if the published data can be correlated with other identifiers or other data that can directly or indirectly identify a specific person, then you have a duty as the controller to take appropriate steps to safeguard the privacy of that person. That may include limiting the data you publish to third-party processors in such cases.

Improve this answer
6
  • 1
    I agree that a sufficiently coarse, randomly selected heatmap in isolation wouldn't be personal data. But the heatmap of a particular player would be that player's personal data. If the heatmap is not publicly connected to an identity, it might still be personal data if OP can make that connection (an example of pseudonymisation). Nevertheless, the act of creating the heatmap might still be processing of personal data and would have to comply with the GDPR, in particular Art 14. But there might be a decent argument that this falls under a legitimate interest.
    – amon
    Commented Aug 28, 2020 at 14:28
  • I have edited the question to clarify. The point data is paired with the usernames.
    – Shuri2060
    Commented Aug 28, 2020 at 18:57
  • I don't see how a third party can have a valid interest in using the data from the controller that has consent. Consent is not transferable.
    – Trish
    Commented Aug 28, 2020 at 22:00
  • @Trish I'm afraid I don't understand the comment? My last sentence is probably clumsily worded - I imagine OP is not specifically publishing it to a third-party, they could just be making it available to anyone through an API, for example. Furthermore, we don't know the basis of the processing in this question - it could be based on consent, or it could be legitimate interest.
    – Matthew
    Commented Aug 29, 2020 at 21:37
  • OP that that it is a third party that makes the heat map by mining the game data. A third party by definition can't have consent from the data owner or the processor, so they'd need legitimate interest... and I just don't see how they might get that.
    – Trish
    Commented Aug 29, 2020 at 22:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .