1

I'm creating a game that collects data in two ways: Unity Analytics for usage stats, and bug reports that sends me a report of an issue along with several files to help me diagnose the issue. However, GDPR is becoming a rather confusing problem for me.

The data collected with my bug reporter is:

  • A hashed unique device ID
  • A game save file
  • System specs
  • Settings configuration
  • A short in game video recording (only shows the game window - not the users desktop)

None of this is personally identifiable (I'm pretty sure) - I don't collect IPs, names, emails, gamer tags etc. As such, do I need permission from the user to collect this data? Would I still be GDPR compliant?

3

There are two relevant bodies of EU law to consider here.

  • The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly.
  • The ePrivacy directive is also relevant, and covers how you may access and store information on the user's device. Directives are not directly applicable law. Instead every member state translates the directive into national law. In the UK, ePrivacy is implemented by PECR.

Is the data you collect personal data in the sense of the GDPR?

Yes: that hashed unique device ID or a system-provided advertising ID likely is personal data, and any linked data would then be personal data as well. This is going to be the case in particular if you store user accounts on your server and can connect these bug reports to a user. Consider also whether the game save could include personal data, and whether the video clip could be analyzed to identify the data subject.

Does this mean collecting this information in bug reports is forbidden?

No, the GDPR doesn't forbid or allow anything outright. Instead, you should go through the compliance process. In a nutshell:

  • determine the purpose of this processing, e.g. “fixing bugs”
  • find an Art 6 legal basis for this purpose, e.g. “Art 6(1)(f) legitimate interest” or “Art 6(1)(a) consent”
  • if the legal basis is legitimate interest, you must balance that interest against the data subject's interests
  • determine whether your compliance requirements include creating/updating your Records of Processing, or whether you have to write a Data Protection Impact Assessment
  • implement the processing in a manner that respects GDPR principles such as Transparency and Data Minimization
  • if the legal basis is legitimate interest you must implement an opt-out solution
  • if the legal basis is consent, you must request consent first in a manner that satisfies the Art 7 conditions for consent – and allow consent to be revoked easily
  • prepare to satisfy data subject rights:
    • information requirements per Art 13, usually done in the privacy policy
    • right to access, rectification, erasure, and data portability
    • right to object (opt-out) and to restrict processing
  • be aware of your general requirements a data controller to process this data securely, e.g. use HTTPS connections to transmit bug reports, take steps to protect your own accounts (e.g. 2FA), and ensure you have a suitable contract with any data processors that act on your behalf, e.g. cloud providers or contractors

I would question whether your bug reports really need to include a device ID. That isn't forbidden, it just complicates compliance a bit.

And what about ePrivacy?

The ePrivacy directive is known for its cookie consent requirements. But these consent requirements apply when accessing any information on the user's device, or when applying equivalent fingerprinting techniques. Your game save is not an issue because it is necessary for the game. But that device ID and other system information is more difficult.

So what to do?

Compliance isn't trivial, but certainly possible. You will likely process the bug reports under your legitimate interest, but might still have to collect consent for accessing a system ID due to ePrivacy.

Such a screen might look like this:

Oh no, the game crashed! Do you want to send a bug report to the developers? Your bug report will be protected as per our privacy policy (link).

Your bug report will contain the following information: …

Yes, collect system information and send bug report

No, do not send bug report

You could make an argument that a bug report can be sent in any case, and that you just need ePrivacy consent to collect useful system information. For example:

Oh no, the game crashed! When sending a bug report to developers, do you want to include extra system information (link to details) that helps fixing the problem? In any case, your bug report will be protected as per our privacy policy (link).

Your bug report will contain the following information: …

Yes, send bug report with extra system information

No, send anonymous report

  • Thank you for the response - very thorough. My bug reporter works by uploading the report to my Trello board so I can see it pop up in my todo list in real time. The device ID is used in a blacklist in case a user decides to abuse the bug reporting system - if they spam/post inappropriate content, I add their device ID to the blacklist and the system will no longer upload their reports. As such, if a user were to request their personal data be deleted, the blacklist would be useless. The only link between a bug report and a user is that hashed ID. Does that change anything? – mr-matt Jul 18 at 6:50
  • Also, the video recording is definitely not PII, there are no gamer tags shown or customisable characters - it's just a car. – mr-matt Jul 18 at 6:50
  • "that hashed unique device ID or a system-provided advertising ID likely is personal data"- why? Can mr-matt directly or indirectly identify a natural person with it? – Lag Jul 18 at 8:07
  • You mentioned several times about a privacy policy. I've never seen a game with a privacy policy - they seem to be only used in websites? Would an EULA be more appropriate? For example, if I distribute my game through Steam, I can require the user agree to an EULA before the game will install. – mr-matt Jul 18 at 8:14
  • @mr-matt It seems you have a legitimate interest to use that ID. Then, the right to erasure only applies if your interest does not outweigh their deletion request, but that could be the case here. If you are sure that nothing in the video is (indirectly) identifiable, then it's not personal data and is not regulated by GDPR. Many games do have a privacy policy, although it may be made available as part of an EULA. The GDPR doesn't mandate a document name, only which information you must provide. The complete absence of a privacy policy would likely be noncompliant. – amon Jul 18 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.