[GDPR] Automatic player record removal?

Question

question

jyrkivesterinen asked Apr 30, '18

[GDPR] Automatic player record removal?

Hi,

there is this recent blog post about preparing for GDPR. One part of it is the DeleteMasterPlayer API to delete records of a player.

However, as far as I understand, GDPR also requires that data about the users can only be retained as long as necessary, not infinitely. We are planning to automatically delete players from our own database after they haven't signed in for three months. Calling DeleteMasterPlayer for every player would be quite cumbersome, and especially given that it sends an email, it would result in hundreds of thousands of emails. That would be of huge inconvenience to everyone.

Do you have plans to automatically delete player records after long inactivity?

Player Data

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2018-05-01T01:49:47Z

brendan answered May 1, '18

I'm not aware of a requirement that states a specific period of retention (though I know you must state your retention period). I'll bring this up with our security team, but can you provide a specific reference that details that requirement? I'm not seeing it here: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679. As always, your best bet is to get feedback from your own legal counsel. If you want to enable deletion of player accounts that have not been active for a certain time period, it would be simple enough to create a Scheduled Task that checks for and deletes those accounts, and have it run on a daily basis. If the emails are a concern, it should be trivial to create a mail processing rule that automatically files them in a folder you can ignore, or even deletes them.

3

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

jyrkivesterinen commented · May 07, 2018 at 09:48 PM

Hi, and sorry for the late response. I was in vacation for nearly the entire last week.

Here is the reference, from (39) (emphasis mine):

"In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review."

Thanks for your suggestions, we'll consider them.

0 ·

brendan jyrkivesterinen commented · May 08, 2018 at 12:03 AM

Thanks - I had reviewed that section, but since it's non-specific, I was undecided on how to interpret it in the context of games. If a player wants to come back and re-play a game after not playing it for a few months (or longer), that might be a legitimate use case. But your point is well made. I'd suggest adding a feature request for a setting for your games in the Game Manager that specifies an automatic non-activity account deletion time.

0 ·

jyrkivesterinen brendan commented · May 08, 2018 at 06:51 AM

Thanks, I filed a feature request.

0 ·

question