A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'.
An unaffiliated 3rd party processes that data (in particular, it accumulates statistics on point change) to generate 'heatmaps' of player activity which can help deduce player online times (which has a direct impact on game strategy) and publishes it on their website. For players with high activity, this may lead to sleep pattern/time zone deduction.
Does GDPR affect the publication of game data like player points?