internet gdpr online
Collecting statistics from online gaming and GDPR obligations
<p>I am looking to to build an interface within a sandbox pc game environment that will allow for the collection of tabletop wargaming game stats in addition to player online ID(steam name).</p>
<p>This data will be collated and made available for public viewing for the purpose of drawing comparisons over time.</p>
<p>I plan to hold the data for an extended period and build an ongoing data set.</p>
<p>I plan to make ID's and accompanying game stats public in relation to tournament/competitive play and anonymize the game data collected from casual games.</p>
<p>Would the above fall within the scope of GDPR?</p>

<h2>Yes</h2>
<p>If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.)</p>
<p>Under <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">GDPR Article 6</a> the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service.</p>
<p>Under <a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">GDPR Article 13</a> a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing  (which the DC must define), who will receive the data, the data retention period, and various rights of the DS.</p>
<p>Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests.</p>
<p>Other GDPR provisions may well apply in addition to these, but that is enough to show that such  service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU  or the related market area.</p>
