Does a community-made project using data from a games API need to adhere to GDPR?

Question

I am part of the team on a popular website that provides users with overviews of their statistics for a particular game.

Our data is gathered from a publicly available API and in order to provide our users with features like graphs of their performance over time we store a records of their statistics each time they are searched.

In order to uniquely identify each account the game developer gives each user a unique ID (appears to be UUID v4) and this unique ID is stored in our database alongside the statistical data. Other than this unique ID, and the players current in-game username (which can be changed by users every 30 days), no other personally identifiable information is provided in the public API.

The Terms of Service of the game developer explicitly state that by registering to their service - which you need to do before you can play this game - the user is agreeing that the owner of all content (including usernames etc) belongs to the game developer.

We do allow users to register to our website using their email address - we are already taking measures to allow users the "right to be forgotten" and to remove this email address from our records by deleting their account. Aside from our GDPR responsibilities for this, do we need to worry about any other GDPR implications?

Answer 1

First, there is a red herring in your question:

The Terms of Service of the game developer explicitly state that by registering to their service - which you need to do before you can play this game - the user is agreeing that the owner of all content (including usernames etc) belongs to the game developer.

Reassigning ownership of intellectual property, including user names, does not affect the privacy rights of the data subject. The right to erasure (Article 17) also applies to a username that is "owned" by a third party.

You does not say so, but I assume that your use of the data you retrive using the API is to keep track of the players performance over time, using the UUID as a persistent identifier, and to display this on your website along with the most recent in-game username as the public-facing identifier.

Your question can be rephrased as follows: Is the UUID and player username personal data as defined by the GDRP?

The GDRP (Article 4) says that personal data is information relating to

an identifiable natural person is one who can be identified, directly or indirectly

(my emphasis).

The answer, unfortunately, may depend on the environment this data is used in.

If it is usual, in the gaming community in question, to have knowledge about what natural person is associated with the in-game username – then this is personal data and you need to provide the means for the data subject to exercise the right to erasure.

If this is not the case, I would say it is less likely that this is personal data (if you want a more precise answer, hire a lawyer).

However, if you just want to minimize your legal liability under GDPR, the simplest and cheapest solution (asking a lawyer costs a lot more than getting answers here) is to implement some feature that comply with the right to erasure for this data (i.e. UUID and in-game username) as well