Online player nicks: personal data under GDPR? We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). These servers are open to join (no login system of any kind), and neither IP addresses nor anything else other than game events are logged. We would like to publish tables of player performance statistics. Can we just do it, on the basis that player nicks are not personal data because they do not relate to identified natural persons? Although a random online nom de guerre can not on its own identify anyone, I can think of some scenarios where this could not be true: Somebody in the community may know who somebody else is, e.g. they might be friends, knowing each other after years playing---although that's information nobody on the basis of just the player nicks could retrieve. Some players might have used the same nick on different platforms (e.g. an internet forum), so they could be temptatively identified on that basis (provided some other information were visible in those other platforms) Even if the threshold for potential identifiability were as low as to consider nicks on their own as personal data, could we proceed on the basis of lawful processing for &quot;legitimate interests&quot;? Those would be those of this gaming community, by making available attractive (hopefully) information related to the game and their enjoyment. In my view this would not trump on any fundamental user rights that would have to weighted against those interests, nor would we be doing something particularly unexpected from players of a game where competition is the norm (e.g. the game itself shows player statistics after each match).
Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; — GDPR Art 4(1) However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance. You've correctly understood that you will need a legal basis to process this data, and that legitimate interest could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour. However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply. As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.
It's complicated You still own your own posts First off, you own everything that you originally created. Posting it on Stack Exchange doesn't affect your rights to your own content. Incorporating suggestions If you copy any of the text from posts that were created by others, you must comply with the CC BY-SA license. The exact version will depend on when the content was posted, and can be viewed by clicking the &quot;Share&quot; link or viewing the post's timeline via the clock icon on the left. Currently, new posts are licensed under CC BY-SA 4.0, which requires you to (basically) provide attribution with the creator's name, a link back to the content, and an indication of whether changes were made. A more detailed description of the exact requirements is here. You would also be required to license the work that you incorporated it into under the same license. However, game mechanics aren't copyrightable. If you merely used mechanics suggested in the posts without actually using the actual creative expression (for instance, names or description text) from the posts, you would not be required to provide any attribution or use any particular license, because you didn't use any copyrightable material from the post. A thank-you would still be nice All that said, it's still a nice thing to do to provide some sort of informal thanks to those who provided valuable assistance, even when you're not legally required to do so.
There is not necessarily a contradiction. Information that they may keep may be: Account information Subscriber information Information on breaches of the Terms of Service or Agreement So yes, they might certainly not keep any logs &ndash; although that claim is doubtful, since they almost certainly keep at least error-level logs of their services &ndash; but that doesn't mean that they have no information to disclose to law enforcement. It's also questionable what "logs" refers to &ndash; would aggregate statistics be considered a log, by law? Would your last known IP address be considered a log, provided they don't keep any other history?
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
Corrections to your statements or quotations Your quotation "To fall within the remit of the GDPR, the processing has to be part of an "enterprise" (...)" is not from the GDPR, and is an erroneous statement. Also, the threshold of 250 employees you refer to, is only relevant with regards to the record-keeping obligations of Article 30. GDPR provisions relevant to your question The GDPR applies to individuals or students in accordance with the material scope of the GDPR, which is treated in Article 2 (2) c) where GDPR states that "This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;" The Recital 18 of the GDPR gives some insight as to what would be a purely personal or household activity as follows: (18) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities. Interpretation To my knowledge, there are no specific guidelines regarding this matter to date from WP29. Those may be adopted in the future, or some requirements may already exist in local laws in one of the EU countries or from documentation available from local data protection authorities. If you are based in the EU, you could check this with your local data protection authority. There is, however, case law from the European Court of Justice as pointed out by Free Radical, interpreting the scope of the "personal use exception" in Directive 95/46/EC (which provisions are similar to the GDPR in this matter). If your hobby is not limited to your personal circle (yourself and the persons in your household), and thus if you plan to share the results of your data collection and processing with third parties (possibly teachers, other fellow students, or anybody else if you publish the results of your work) resulting from your "hobby" activity, you certainly would not fall in this exception to the scope. Case C-101/01 is an example of publication on the Internet made by an individual claiming to use its "freedom of expression to create internet pages in the course of a non-profit-making or leisure activity". The court clarified that: exception must (...) be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people Another, less optimistic interpretation from the examples given by the GDPR recitals, could derive from the spirit in which purely personal or household activity are to be understood. These examples actually refer to limited amounts of data and which are related to the individual itself (his own address book, his social networking activity, etc.), and creating limited risks relevant to the person herself and its contacts. In this view, there is a risk that a "hobby" in which you collect data about thousands of persons unrelated to you, could be considered as not being really purely personal. Actually, an interpretation of case law C-212/13 from the European Court of Justice also mentioned by Free Radical could support this reasoning. In this case, a video recording of people was stored from cameras installed by an individual on his family home for its own security purposes, but the cameras were also monitoring a public space. The court ruled that: To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity (...) Extending this reasoning to your question, a "hobby" consisting of collecting "huge list of names, emails, zipcodes" unrelated to you could be regarded as "directed outwards from the private setting (...)". Conclusion As a hobbyist, or a student, if you can work on fake computer generated data and achieve the same results in your personal learning purposes you should definitely consider doing so.
No GDPR applies to people (not just citizens) who are in the EU. It has no applicability if both parties are not in the EU.
I suspect that US voting records would fall under Article 2(2)(a): Article 2 Material Scope ... This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; I doubt it would be possible to argue successfully that a foreign election is anything other than &quot;an activity which falls outside the scope of Union law.&quot; Even the territorial scope could be questioned. This is set forth in the next article, on &quot;territorial scope,&quot; the second item of which says: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. It is probably arguable whether processing absentee ballots from EU residents constitutes &quot;offering services to data subjects in the Union,&quot; but in this case it's likely to be more difficult to resolve that question than to determine whether the activity falls outside the scope of Union law.
First of all, a password is not personal data. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; From GDPR Article 4 (https://gdpr-info.eu) As for password hashes, what do you mean by requesting a copy of yours? You can produce it if you knew the hashing algorithm of the website. By the way, websites should be using good hashing algorithms, such as bcrypt or scrypt, not MD5 or SHA1.