8

Many amateur chess players store the notations of their games in electronic format (like pgn) so that they can later reference the game for analytical and historical reasons. Information in this file typically include the name and rating of the opponent, the date and location of the game, the moves played and the result.

These files are typically only used in private, but they can be stored on public servers and shared with others (it is not unusual for someone to email a pgn of a game to someone else for the purpose of further analysis).

Is doing this without approval from the opponent a possible violation of GDPR?

Note: I am aware of How does GDPR affect sports statistics? but the answers there seem to indicate that because professional athletes are to some extend public figures, they give up a fair amount of rights to protection of personal information. My question is about amateur chess players, not professionals.

Improve this question

1 Answer 1

Reset to default
15

By itself, a chess position is not personal data. Personal data is “any information relating to an … identifiable natural person”. Since the file in question includes the name of the opponent, it is clearly personal data about the opponent.

If the files are used for “purely personal or household purposes”, the GDPR won't apply per Art 2(2)(c).

If the files are shared more widely – especially if the files are published – then GDPR becomes relevant. The person/entity who is data controller has to consider GDPR compliance. Data controller is whoever determines the purposes and means of processing of personal data (the “why” and “how”).

The first question would be under which legal basis this personal data about another person can be shared. The GDPR offers multiple legal basis, notably “legitimate interests” and “consent”.

  • Consent is always an option, but must be freely given (entirely voluntary).

  • Legitimate interests can serve as a legal basis after a balancing test between your interests and the data subject's rights and interests. This balancing test also depends on the reasonable expectations of the data subject, which in turn depends on the more general context. For example, in a chess community where such sharing is completely normal there would likely be a legitimate interest for you to share games as well, if the games occurred in the context of this community. But if you play a game with a friend who is not part of this community, the friend cannot reasonably expect that their name and associated personal data would be shared.

The second question would be how you would satisfy further GDPR compliance obligation, in particular the Art 13/Art 14 right to information. When collecting personal data, it is necessary to provide certain information such as your identity, what processing is being carried out, and how the data subject can invoke their GDPR rights (a privacy notice or privacy policy). This might be difficult or awkward to do.

Practical solutions to these problems:

  • If you want to share a game but aren't sure that the opponent is OK with this, remove identifying aspects such as names. For example, you could crop a screenshot, or describe the game in textual notation without listing the opponent's name.
  • Play the game via a chess website that publishes the game. This way, the website is the data controller, and you and the opponent are the data subjects. This avoids having to act as the data controller yourself. This might work for private interactions, but not e.g. if you run a chess club and require members to play via that website – you might still be in a data controller role then and have full compliance obligations.
Improve this answer
8
  • Chess game data sheets are some 150 entries long, and contain besides the plays usually game date, location, and players, which is used for tourney play - the only identifiable info on them is the players' and location line, which can be anonymized. The rest? not PID
    – Trish
    Commented Oct 5, 2021 at 11:26
  • 1
    @Trish In some cases, the game data may be identifiable in of itself, for example if the moves are typical of a particular player. But in general, yes, removing name + location should be sufficient to anonymize the data. Anonymization is also a processing activity, but there's probably an overriding legitimate interest here.
    – amon
    Commented Oct 5, 2021 at 11:29
  • 1
    @Trish: Well, if you're talking about a serious tournament (and not random chess.com matchups), the move 2. Ke2 basically narrows it down to either Nakamura or Carlsen. But I agree that there are few other examples.
    – Kevin
    Commented Oct 5, 2021 at 19:11
  • 1
    @Trish "there is literally no single game allowed position that has never occurred at least a dozen times by different players before." I don't think this is true. On Agadmator's youtube channel, he frequently points out when games reach brand new positions, occasionally before move 18.
    – Ryan_L
    Commented Oct 6, 2021 at 2:47
  • 1
    @DmitryGrigoryev Fixed! I had misread “PGN” in the question as “PNG”, the image format. But it's actually a textual notation which is perfect here, if the player names ([White "..."], [Black "..."]) are blanked.
    – amon
    Commented Oct 6, 2021 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .