0

If I have a game or some other online service I host in which:

  • It is forbidden for a subscriber to hold more than one account, OR
  • Even if it is not forbidden, to detect one person on multiple accounts for abuse prevention (such as enforcing a ban from the service)

does the GDPR prevent me from using any of the following data for the express and singular purpose of accomplishing this goal?

  • IP Address
  • Email address
  • Password hash
  • Payment info (hashed, not raw)
  • Screen resolution
  • Video card model and driver version (via regular graphics API)
  • Running process list (as used by anticheat)
  • Hardware hash
  • Typing/clicking cadence
  • Friends lists
  • Other on-service behavior (menus accessed, access patterns, etc)

I'm aware of a paper (Greidanus, 2017) that covers the legality of using various methods of client side cheat detection software that uses some of this data, but as the purpose would be different in this case, I assume the conclusion may not necessarily be the same.

1

does the GDPR prevent me from using any of the following data for the express and singular purpose of accomplishing this goal?

No.

These are all personal data as defined by the GDPR, but the GDPR as such does not ban processing of any specific type of personal data or any specific purpose for processing.

All the GDPR does is to require from the controller to ensure lawfulness of processing (GDPR Article 6).

So you need to assure that your processing of this personal data is lawful.

In your particular case, I think the legal ground for lawful processing should be Article 6 (1)f. This article say that it is OK to process personal data if:

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

To maintain duplicate accounts on a game or some other online service is by no means "interests or fundamental rights and freedoms of the data subject" – so you don't have to worry about that condition overriding the interest you are pursuing by processing this personal data (abuse prevention).

Is abuse prevention a "legitimate interest" you as a controller and operator of the website are allowed to pursue? I will say that the answer to this is clearly: "Yes".

So the legal ground for processing in cases where the controller collects personal data to prevent abuse is Article 6 (1)f.

  • But you can't make access to the service conditional on the opt-in.. wouldn't a hypothetical abuser just sign up and say "no, I do not consent to you processing my information for anti-abuse purposes" – Mikey T.K. May 18 '18 at 19:00
  • @MikeyT.K. Good point. Changing my answer from recommending Article 6 (1)a to Article 6 (1)f. as legal ground for lawful processing in cases like yours. – Free Radical May 19 '18 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.