We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). These servers are open to join (no login system of any kind), and neither IP addresses nor anything else other than game events are logged.
We would like to publish tables of player performance statistics. Can we just do it, on the basis that player nicks are not personal data because they do not relate to identified natural persons? Although a random online nom de guerre can not on its own identify anyone, I can think of some scenarios where this could not be true:
- Somebody in the community may know who somebody else is, e.g. they might be friends, knowing each other after years playing---although that's information nobody on the basis of just the player nicks could retrieve.
- Some players might have used the same nick on different platforms (e.g. an internet forum), so they could be temptatively identified on that basis (provided some other information were visible in those other platforms)
Even if the threshold for potential identifiability were as low as to consider nicks on their own as personal data, could we proceed on the basis of lawful processing for "legitimate interests"? Those would be those of this gaming community, by making available attractive (hopefully) information related to the game and their enjoyment. In my view this would not trump on any fundamental user rights that would have to weighted against those interests, nor would we be doing something particularly unexpected from players of a game where competition is the norm (e.g. the game itself shows player statistics after each match).