Is nickname on an android app consider as personal Information for GDPR policy I am currently developing a puzzle game where the player initially has the option to enter a &quot;NIckname&quot; of his choice ( might also be his name - its up to him what to enter) so that his time score ( app is based on the best win times) can appear on a World Leaderboard of the top 10 times performed of the users played the game. My question: is the nickname held on my database considered as personal Data since it can be anything and also a user might enter a name that might point to other people (since anyone can choose anything)? If nickname is not consider by itself something that direct or indirect points to a specific person then i will go for it otherwise i may choose for each player a random ID. My database data will be permanent ( not ephemeral) because i need to track down the best achieved times and display only the top 10. Also the player will have the option to skip this step ( so no nickname for him ) and also if a nickname has been chosen the player will the option to delete his profile. thank you
Yes such a username would be personal data. It is information that relates to an identifiable person. In this context,a person isn't identifiable only if you can infer their real-world identity, but already if you can single out one person's records. Thus, your random IDs and any linked information would be personal data as well. Just because something is personal data doesn't mean that processing it is illegal. It just means you need a legal basis. That could be necessity for performing a contract with the data subject (like saving game progress), a legitimate interest, or consent. Taking into account GDPR principles like &quot;data protection by design and by default&quot;, it could be sensible to hide a players stats from the leaderboard until they give consent. On the other hand, you may have a legitimate interest to provide leaderboard data for ranking/comparison, especially if the leaderboard entries are pseudonymized. In any case, it should be clear to the users which information is visible to others.
When you make a request based on the GDPR, Art. 12(6) GDPR applies. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID: Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID. Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required. You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.
The university has a legal obligation to collect certain data from attendees, including employees an visitors. It has decided to keep these records in digital form, and offers a smartphone app as a convenience. The university has outsourced the data processing activity to a third party. This is perfectly legal under the GDPR, if that third party is contractually bound to only process the data as instructed, and not for their own purposes. Whereas the university acts as a data controller (Verantwortlicher), the third party would be a data processor (Auftragsverarbeiter). I have some doubts though whether an app or a website is indeed the solution that offers the best data protection, especially taking into account the GDPR's data minimization principle. Requiring updates when entering or leaving any room is potentially excessive. Given the sensitivity of the data, the university should have performed a data protection impact assessment to weigh the consequences of this measure. At least for employees, the measure would likely have to be approved by the union (Personalrat) as well.
GDPR recital 64 says: The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. The GDPR does not specify exactly what methods of verification are &quot;reasonable&quot;. GDPR Article 11 paragraph 2 provides: Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. This is amplified by Recital 57 which says: If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. GDPR Article 12 paragraph 6 provides: Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. All of the above seems to indicate that the Data Controller must follow reasonable practices, but is not required to guarantee a positive response to a Data Subject who cannot supply reasonable evidence of identity. Moreover the Controller is required to reliably ascertain the identity of the Subject before providing information or acting on a request. Incidentally, good security practice is that the site does not retain the actual password. instead it hashes the password with a good cryptographically secure hash function, and stores the hash. This means that the site cannot reliably determine if a password is unique among all passwords saved by the site, and searches among passwords are not normally done, and would not be reasonable. A site using an email address as the User Identifier would normally enforce at the time an account is created that the email is unique among all emails registered on the site. A user who cannot provide the email would typically be rejected as not able to be identified, unless the site retains additional ID info not listed in the question. I think such a practice would be considered to be reasonable in the current state of technology.
There are a few different grounds under which PII can be handled. Perhaps the most discussed at the moment of GDRP introduction is consent, because of the wave of consent-seeking. But there are a number of other grounds. "Necessary for contract execution" is a trivial one, to deliver a pizza you'll need an address. The relevant ground for sanctions lists is also pretty obvious in hindsight, you may process PII in order to comply with legal obligations. Note that this is still an integral part of the GDPR, not an exception to the GDPR. That means you need to apply all the basic GDPR rules. You need to explicitly store where you got the PII from, for which purpose, and you need to document how you're using it. Note that this might be hard - why do you need to store this data? Why can't you just check the list as the moment it's relevant? The GDPR for a large part depends on you justifying your actions, not just in hindsight but already up front.
Privacy against publication of criminal convictions has been considered in the High Court in NT1 &amp; NT2 v Google LLC [2018] EWHC 799 (QB), if I may run the risk of posting a legal citation myself. But note that the claimaints there are anonymized, as often happens in criminal trials as well. In some cases, the court may give an injunction against disclosing names or details, and can hand down both a public and a private judgement, with the latter being a restricted document that does have the identifying details. So this question could only apply to mentions of criminal process where the accused is actually identified. (And I think just saying &quot;R v Smith&quot; is not enough - the posted or linked text would have to give some identifying detail about which Smith it is, the nature of the crime, etc.) I have no qualms at all about talking about NT1 and NT2. The claimants brought a case against Google for making available information about their long-spent convictions, including on GDPR grounds although it took place just before the implementation of GDPR in UK law. Dealing with that argument under the prior legislation, the judge found that of the various exemptions claimed by Google, the condition The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject. (found in the Data Protection Act 1998, Schedule 3, paragraph 5, implementing the Data Protection Directive that preceded GDPR) applied, because of a longstanding principle for criminal conduct. The idea is that (paragraph 111): A person who deliberately conducts himself in a criminal fashion runs the risk of apprehension, prosecution, trial, conviction, and sentence. Publicity for what happens at a trial is the ordinary consequence of the open justice principle [...] The same must be true of the details of the offending, and other information disclosed in open court, including information about himself which a criminal reveals at a trial or in the course of an application. The core principles are the same as the carve-out from defamation law for the fair and accurate reporting of criminal proceedings (paras 44-49). That &quot;made public&quot; condition can now be found in a slightly different context in the Data Protection Act 2018, Schedule 1, Part 3, paragraph 32, which mirrors Article 9(2)(e) of the GDPR for the purpose of Article 10: This condition is met if the processing relates to personal data which is manifestly made public by the data subject. Since this is virtually the same condition of European provenance, in the same context of surrounding rules, I think the precedent is a good guide. For courts themselves, law reports, and journalism or scholarship, there are other specific grounds to rely on. Individual Stack Exchange posters are surely covered under the general exemption for posting on social media in a private capacity, GDPR 2(2)(c) as interpreted through its Recital 18. For the site itself, as in the case of NT1 and NT2, there could well be a legal claim made about the inclusion of criminal conviction information in a posted answer. (In general, such a post, being free text, could contain all sorts of defamatory statements or other objectionable content.) The court would have to look at the competing interests and the level of harm. NT1 was not successful but NT2 was. The example scenario, where we are talking about a very brief mention of a criminal case, cited because it illustrates a legal point rather than because there's anything relevant about the person mentioned, is quite far from the grounds complained of by NT2. For NT2, there was a newspaper article in which he was &quot;quite inappropriately, portrayed as one of a rogues' gallery of serious criminals&quot; (para 188), eight years after the end of his sentence, and it was this that he wanted removed from search results. In particular, the academic exemption (para 13) seems strong, in the same way that it would be for a publisher of legal academic content. The test of &quot;substantial public interest&quot; does not apply, because this exemption comes through paragraph 36 in the case of criminal convictions; it's enough to show a reasonable belief that publication would be in the public interest. Google was not able to rely on the &quot;journalism&quot; version of this exemption (again, under the prior law) because they are a totally generic search engine for all kinds of data and purposes (para 100 of the 2018 judgement). The public interest test, and the accompanying &quot;legitimate interest&quot; for the data controller, do not seem too difficult in this example.
Making the game free makes very little if any difference to the position here. There are two kinds of IP issues that could possibly be involved: copyright and trademark. Note: both copyright and trademark are civil, not criminal issues (except in very limited circumstances which do not apply to the situation described in the question). You will not &quot;face charges&quot; but might possibly be sued. If you are asked to take down such a game and comply, this might end the matter, but if an IP holder claimed that damages had occurred before the game was taken down a suite might possibly still be brought against the developer. Copyright Names, like titles and other short phrases, cannot be protected by copyright. As long as no other text from anyone else, and no images are copied or imitated, copyright is not infringed. This means that there are no copyright issues. Game mechanics and rules cannot be copyrighted, although the words of game rules can be. Therefore, fair use which is a strictly US copyright legal concept, is not involved here. Neither is fair dealing, a somewhat similar legal concept from the UK and some commonwealth and European countries. Trademark Here is the main issue for this situation. The names of individual Pokémon characters are probably (almost surely) protected as trademarks. That means you cannot use them to identify your game, or any other product or service, and you cannot use them to advertise or market your game. This is true even if the &quot;selling price&quot; is $0. The use here does not seem to be nominative use, as you are not intending to refer to Pokémon or any of its variants. You are just reusing the names. As long as you make it very clear that your game is not made by, nor in any way authorized or endorsed by the makers of Pokémon, this is probably not trademark infringement. But if the makers of Pokémon become aware of your game, they might well send you a cease and desist letter, and they might file a trademark infringement suit. Even if you were to win such a suit, as I think you might well do, it might be costly to defend. Could you alter the names to ones you invent form yourself? That might save a lot of trouble and hassle. What is the value to you in reusing the well-known Pokémon names?
I know that I have to provide detailed information which data I save and how I use it. Yes, you should, if you are getting access to users' Dropbox accounts, which will contain all sorts of private data, copyrighted (and illegally copied copyrighted files), etc. You provide the detailed information to your users through a click-through Privacy Policy - TOS (Terms of Service) in your App, like any other App out there. Click wrap (Wikipedia) user agreements are legally binding in many jurisdictions. Even if you don't access files and information - such as personal information or files - you still need a clear TOS for your App, for both your users' and your own legal protection. But I am a poor student who don't want invest money into a lawyer to write me a privacy policy ... I do not plan to get paid for (this app)... Being a free or paid App doesn't make a difference when it comes to the TOS, if you need one, and if you need to pay for one to be drafted. But not investing money in a lawyer can be a critical mistake if your App will be distributed on the popular App directories like Google Play and iTunes and your TOS does not clearly and legally outline all possible usage and data polices. Lawyers have experience in covering all the bases. Is there any way I can do this privacy policy on my own? Sure, you can: https://www.google.com/search?q=privacy+policy+generator But you run considerable legal liability not having a TOS that correctly and legally addresses all users' privacy concerns and clearly outlines what you do to insure security. That's what lawyers are for. Is it possible to just create some “I save all your data“ policy which would of course be to much but it would include all data I save and so I would not miss anything in my policy? Sure, you can simply say I save all your data. But how can you be sure that you've haven't missed important policy details and scenarios that could result in legal action against you? Like how long do you save data? When will you delete it? How secure is it? Can the user ask for deletion? What happens if you get hacked? What about users in countries other than the US? Users under 18 years old? You must use arbitration for any disputes? And on and on. The considerable legal liability of using a non-professionally drafted TOS means you run the risk of getting sued. You have to decide if it is worth the risk.