Is nickname on an android app consider as personal Information for GDPR policy

Question

I am currently developing a puzzle game where the player initially has the option to enter a "NIckname" of his choice ( might also be his name - its up to him what to enter) so that his time score ( app is based on the best win times) can appear on a World Leaderboard of the top 10 times performed of the users played the game.

My question: is the nickname held on my database considered as personal Data since it can be anything and also a user might enter a name that might point to other people (since anyone can choose anything)? If nickname is not consider by itself something that direct or indirect points to a specific person then i will go for it otherwise i may choose for each player a random ID.

My database data will be permanent ( not ephemeral) because i need to track down the best achieved times and display only the top 10.

Also the player will have the option to skip this step ( so no nickname for him ) and also if a nickname has been chosen the player will the option to delete his profile.

thank you

Answer 1

Yes such a username would be personal data. It is information that relates to an identifiable person. In this context,a person isn't identifiable only if you can infer their real-world identity, but already if you can single out one person's records. Thus, your random IDs and any linked information would be personal data as well.

Just because something is personal data doesn't mean that processing it is illegal. It just means you need a legal basis. That could be necessity for performing a contract with the data subject (like saving game progress), a legitimate interest, or consent. Taking into account GDPR principles like "data protection by design and by default", it could be sensible to hide a players stats from the leaderboard until they give consent. On the other hand, you may have a legitimate interest to provide leaderboard data for ranking/comparison, especially if the leaderboard entries are pseudonymized. In any case, it should be clear to the users which information is visible to others.

Answer 2

Why wouldn't it be?

Nicknames are used to possibly identify people, very akin to IP addresses with a time code or a user UUID. As such, there is no way that this could not be PII.