There are two relevant bodies of EU law to consider here.
- The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly.
- The ePrivacy directive is also relevant, and covers how you may access and store information on the user's device. Directives are not directly applicable law. Instead every member state translates the directive into national law. In the UK, ePrivacy is implemented by PECR.
Is the data you collect personal data in the sense of the GDPR?
Yes: that hashed unique device ID or a system-provided advertising ID likely is personal data, and any linked data would then be personal data as well. This is going to be the case in particular if you store user accounts on your server and can connect these bug reports to a user. Consider also whether the game save could include personal data, and whether the video clip could be analyzed to identify the data subject.
Does this mean collecting this information in bug reports is forbidden?
No, the GDPR doesn't forbid or allow anything outright. Instead, you should go through the compliance process. In a nutshell:
- determine the purpose of this processing, e.g. “fixing bugs”
- find an Art 6 legal basis for this purpose, e.g. “Art 6(1)(f) legitimate interest” or “Art 6(1)(a) consent”
- if the legal basis is legitimate interest, you must balance that interest against the data subject's interests
- determine whether your compliance requirements include creating/updating your Records of Processing, or whether you have to write a Data Protection Impact Assessment
- implement the processing in a manner that respects GDPR principles such as Transparency and Data Minimization
- if the legal basis is legitimate interest you must implement an opt-out solution
- if the legal basis is consent, you must request consent first in a manner that satisfies the Art 7 conditions for consent – and allow consent to be revoked easily
- prepare to satisfy data subject rights:
- information requirements per Art 13, usually done in the privacy policy
- right to access, rectification, erasure, and data portability
- right to object (opt-out) and to restrict processing
- be aware of your general requirements a data controller to process this data securely, e.g. use HTTPS connections to transmit bug reports, take steps to protect your own accounts (e.g. 2FA), and ensure you have a suitable contract with any data processors that act on your behalf, e.g. cloud providers or contractors
I would question whether your bug reports really need to include a device ID. That isn't forbidden, it just complicates compliance a bit.
And what about ePrivacy?
The ePrivacy directive is known for its cookie consent requirements. But these consent requirements apply when accessing any information on the user's device, or when applying equivalent fingerprinting techniques. Your game save is not an issue because it is necessary for the game. But that device ID and other system information is more difficult.
So what to do?
Compliance isn't trivial, but certainly possible. You will likely process the bug reports under your legitimate interest, but might still have to collect consent for accessing a system ID due to ePrivacy.
Such a screen might look like this:
Oh no, the game crashed! Do you want to send a bug report to the developers? Your bug report will be protected as per our privacy policy (link).
Your bug report will contain the following information: …
Yes, collect system information and send bug report
No, do not send bug report
You could make an argument that a bug report can be sent in any case, and that you just need ePrivacy consent to collect useful system information. For example:
Oh no, the game crashed! When sending a bug report to developers, do you want to include extra system information (link to details) that helps fixing the problem? In any case, your bug report will be protected as per our privacy policy (link).
Your bug report will contain the following information: …
Yes, send bug report with extra system information
No, send anonymous report
