gdpr data-protection online data
How does GDPR affect game data and how it is processed?
<p>A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'.</p>
<p>An unaffiliated 3rd party processes that data (in particular, it accumulates statistics on point change) to generate 'heatmaps' of player activity which can help deduce player online times (which has a direct impact on game strategy) and publishes it on their website. For players with high activity, this may lead to sleep pattern/time zone deduction.</p>
<p>Does GDPR affect the publication of game data like player points?</p>

<p>Sleep pattern and timezone deduction are arguably not &quot;personal data&quot; within the meaning of the GDPR. Personal data is defined in <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Article 4</a> as:</p>
<blockquote>
<p>any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>
<p>So, if the published data is <em>solely</em> activity that could theoretically create a heatmap of activity and determine someone's timezone and <em>does not</em> include any other data (e.g. their online tag/identifier, etc.) then publishing just the activity data would not seem to involve any GDPR personal data obligations.</p>
<p>However, if the published data can be correlated with other identifiers or other data that can directly or indirectly identify a specific person, then you have a duty as the controller to take appropriate steps to safeguard the privacy of that person. That may include limiting the data you publish to third-party processors in such cases.</p>
