gdpr data-protection
Online player nicks: personal data under GDPR?
<p>We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). These servers are open to join (no login system of any kind), and neither IP addresses nor anything else other than game events are logged.</p>
<p>We would like to publish tables of player performance statistics. Can we just do it, on the basis that player nicks are not personal data because they do not relate to identified natural persons? Although a random online <em>nom de guerre</em> can not on its own identify anyone, I can think of some scenarios where this could not be true:</p>
<ul>
<li>Somebody in the community may know who somebody else is, e.g. they might be friends, knowing each other after years playing---although that's information nobody on the basis of just the player nicks could retrieve.</li>
<li>Some players might have used the same nick on different platforms (e.g. an internet forum), so they could be temptatively identified on that basis (provided some other information were visible in those other platforms)</li>
</ul>
<p>Even if the threshold for potential identifiability were as low as to consider nicks on their own as personal data, could we proceed on the basis of lawful processing for &quot;legitimate interests&quot;? Those would be those of this gaming community, by making available attractive (hopefully) information related to the game and their enjoyment. In my view this would not trump on any fundamental user rights that would have to weighted against those interests, nor would we be doing something particularly unexpected from players of a game where competition is the norm (e.g. the game itself shows player statistics after each match).</p>

<p>Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance:</p>
<blockquote>
<p>[…] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
<p>— GDPR Art 4(1)</p>
</blockquote>
<p>However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance.</p>
<p>You've correctly understood that you will need a legal basis to process this data, and that <em>legitimate interest</em> could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour.</p>
<p>However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply.</p>
<p>As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.</p>
