BESF_Faq.png

The answer to your questions about personal data in the gaming sector.

According to Article 4(1) [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj), “personal data” means any information relating to an identified or identifiable natural person (“data subject”). Personal data could be, for example, a person’s name, an identification number, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

What is the right of access to personal data?

Article 15 GDPR grants data subjects a right of access. The right of access consists of three components. Data subjects have the right to receive from the relevant controller (being the entity who decides on the purposes and means of the processing):  

(i) confirmation of whether or not personal data are processed;
(ii) access to such personal data; and
(iii) specific information about the processing itself (including the purpose of the data processing, the categories of personal data and recipients, and duration of the processing).  

Pursuant to Article 15 GDPR, the controller must also provide a copy of the personal data undergoing processing.  

The right of access is designed to put data subjects in control over their personal, by enabling them “to be aware of, and verify, the lawfulness of the processing”. The right of access therefore aims to provide data subjects with sufficient, transparent, and easily accessible information about the processing of their personal data so that they can be aware of and verify the lawfulness of the processing and the accuracy of the personal data.  

Access requests need to be handled without undue delay. In principle this means within one month of receipt of the request.

There are numerous reasons why gamers would want to exercise their data subject rights. A player might be interested in general about which personal data a game publisher holds about him or her.  

More likely, a player would want to exercise his/her right of access following a ban or another account restriction imposed by the publisher. Next to hours of playing for making progress, players often spend large amounts of money on in-game purchases. When a ban hits, it hits hard. A player could ask a publisher to get more information about the ban by exercising his/her right of access.  

A very concrete example of a reason why a gamer wanted to exercise her access rights followed from suspected fraudulent access to her account by a third party. In this particular case, the player’s account had been hacked in the past. After this incident – which was acknowledged as a hack by the publisher – the player changed her login credentials (e-mail address), but after a while, she noticed again an anomaly with her account, and she wanted to ensure herself that no one else still had access to the account. She first asked the publisher to confirm that the new e-mail address would be required for login verification, even if the account was still running on a device that was previously used to log in. The publisher confirmed this process. Then she asked which devices were currently linked to her account. Since this request was not answered, she tried to exercise her right of access, by asking the publisher for the login – and more specifically time, location and device – information relating to her account.

Why do gamers exercise their access right in a gaming context?

It seems that it is not evident to exercise one’s right of access in a gaming context. Even though game publishers process large amounts of personal data of often minors, game publishers often lack the in-house expertise (or capacity) to get to the bottom of the data protection “stuff”. Given the rights-oriented approach that many data protection authorities uphold to prioritize investigations, game publishers are strongly encouraged to develop and implement more consistent data subject rights protocols and procedures.  

A few tips for publishers:  
1. Make sure that when an access request comes in, it gets recognized as such;
2. Make sure that the request gets to the right people in your organization;
3. Do not ignore access requests (even if you don’t need to grant access);
4. Follow-up on access requests within a reasonable timeframe, and in principle within one month of receipt;
5. Do not reject an access request entirely because granting a part of it would have a negative impact on you or others;
6. Make sure to respond to every request and be capable of doing what you promised.

What should I do as a publisher when an access request comes in?

On January 18, 2022, the EDPB published ["EDPB Guidelines on data subject rights – Right of access" ](https://edpb.europa.eu/system/files/2022-01/edpb_guidelines_012022_right-of-access_0.pdf)on the right of data subjects to have access to their personal data under the GDPR. This guidance is used below to help game publishers to develop a game plan to meet the GDPR standards for access rights.  

Game publishers need to be “proactively ready” to handle access requests and to assess each request individually. When handling an access request, they should consider at least the following questions:  

**1. Does the request concern personal data ?**

The scope of the request can only cover personal data (including pseudonymized data), information on the processing itself and on data subject rights. Requests about other issues, including general information about the publisher, are not considered as an access request under Article 15 GDPR.  

The right of access also needs to be distinguished from similar rights with other objectives, for example the right of access to public documents, which aims at guaranteeing transparency in public authorities’ decision-making and good administrative practice.  

**2. Who is the individual requesting access?**

An access request should either concern the personal data of: (a) the requesting person; or (b) the person authorizing the request. The game publisher needs to be able to identify the data subject making the request, and confirm the identity of that person in case of doubt.  

This implies that anonymous requests cannot be considered as valid access requests under Article 15 GDPR. However, this does not imply that publishers can ask for more information about the individual than that they already have. When an individual requests information about his/her account, the publisher needs to verify whether the individual is the same person as the one owning the account, but this does not mean that the publisher needs to (or even can) ask for a government-issued ID or something similar, as typically, a player’s account is not linked to the player’s real-life ID.  

The GDPR does not impose requirements regarding the methods for determining the identity of data subjects requesting access. In case of reasonable doubt, the publisher can ask for additional information to confirm the identity of the data subject, but the request must be proportionate to the type of personal data processed, the damage that could occur, etc. in order to avoid excessive data collection. Again, a publisher should not ask for more information than the information already known to them.  

If identification is not possible based on the information included in the access request, the publisher must inform the data subject, and is entitled to refuse the request unless the data subject provides the additional information that is needed to allow identification.  

**3. Does the request fall within the scope of Article 15 GDPR?**

The GDPR does not include formal requirements for data subjects requesting access to their personal data. Game publishers should provide appropriate and user-friendly communication channels that are easy to use. However, data subjects are not required to use these channels in order to submit their request.  

It is not necessary for data subjects to give any reasons for their access request: it is not up to the controller to assess whether exercising the right of access will actually be helpful to the data subject who has submitted a request. The publisher should process the request unless it is clear that the request is made under rules other than data protection rules.  

This means that, for players to make a valid request, it is sufficient to indicate that they wish to obtain access to the personal data concerning them, that they are exercising their right of access, or that they wish to know the information concerning them that the publisher processes. It is advisable to be lenient towards persons exercising their right of access, because they may not be familiar with the intricacies of the GDPR, in particular when the request is submitted by minors – which constitute, at least for some games, the majority of the player base. In case of doubt, it is recommended to ask the player making the request to specify the subject matter of the request.  

**4. Are there more specific provisions that regulate the access request?**

Players are not required to specify whether they are requesting access to their personal data on the basis of the GDPR, or on the basis of some other (national or sectoral) legislation. However, if they do specify that the request is based on any sectoral or national legislation providing a right to access to certain categories of data, the publisher needs to handle the request accordingly, and this may require a separate response from the response in relation to the right of access under Article 15 GDPR.  

**5. Does the request refer to all or only parts of the data processed about the data subject?**

When a request comes in, the game publisher needs to assess whether the request refers to all or only parts of the personal data processed about the individual, and respond accordingly.  

Unless explicitly stated otherwise, publishers need to understand access requests as referring to all personal data concerning the data subject (or their account). When the publisher processes a large amount of personal data about the player, the publisher can ask the player to specify his/her request.


What can I do as a publisher to be proactively ready to handle access requests?

As there are many reasons for players to request access to their personal data, publishers have numerous reasons for rejecting such requests. The most common argument is that granting access would imply giving up company trade secrets. While this might be an argument where the access request follows an account restriction and the publisher wants to avoid releasing too much information about e.g. the anti-cheat software they use, this is not a valid argument, for example, where the player asks for information about time, location and device-type used for logging in. Moreover, even if there would actually exist a risk for the publisher’s trade secrets or other interests, this does not mean that a publisher may reject the access request altogether.  

The right of access is legally subject to the limitations that result from Article 15(4) GDPR (which protects the rights and freedoms of others) and Article 12(5) GDPR (which governs “manifestly unfounded or excessive” requests).  

But, there might be further restrictions to the right of access contained in EU or in EU Member State laws, in accordance with Article 23 GDPR that is also relevant for game publishers.  

**1. Rights and freedoms of others**

Article 15(4) GDPR states that the right to obtain a copy of personal data shall not adversely affect the rights and freedoms of others. Thus, granting access to personal data cannot have a negative impact on the rights and freedoms of others.  

Phrases like that are always highly interpretable and always trigger discussions. It needs to be stressed that a game publisher cannot rely on such considerations to justify the refusal of the request altogether, but only to justify leaving out or rendering illegible those parts of the personal data that may negatively affect the rights and freedoms of others. This means that the publisher cannot reject the request entirely based on the trade secrets argument. Even if the trade secrets argument would be a valid argument, the publisher can only leave out some of the information insofar as disclosing that information would have a negative impact on the publisher or on others. Consequently, a publisher is not bound to reveal any part of the technical operating of any anti-cheat software even where this information would be linked to the personal data of the player making the request, as long as this technical information can be regarded as trade secrets

**2. Manifestly unfounded or excessive requests**

Another limitation of the right of access follows from Article 12(5) GDPR, by which game publishers are allowed to reject or charge a reasonable fee for requests that they consider to be “manifestly unfounded or excessive”.  

A request is “manifestly unfounded” if the requirements of Article 15 GDPR are objectively, clearly and obviously not met. A request should not be considered manifestly unfounded (i) because the data subject has previously submitted requests which were manifestly unfounded or excessive; or (ii) if the request includes, what the EDPB refers to as, “unobjective or improper language”. For example, a new request coming from a player that in the past has requested access to his/her personal data only for harassing a community manager employed by the game publisher, cannot be rejected as such, just because of the earlier transgression.  

Whether a request is “excessive” or not will depend on the specific circumstances of the request. Excessiveness is typically linked to the repetitiveness of subsequent requests, and whether the data subject is making requests at reasonable intervals. Game publishers could consider, for example – in the light of the reasonable expectations of the data subject – how often the personal data is altered, the nature of the personal data, the purposes of the processing, and whether the subsequent requests concern the same type of information or processing activities or different ones.  

Note that these concepts must be interpreted narrowly, as the principles of transparency and cost-free data subject rights should not be undermined.

The right of access to personal data in the gaming sector

What is the right of access to personal data?

What is the right of access to personal data?

Why do gamers exercise their access right in a gaming context?

What should I do as a publisher when an access request comes in?

What can I do as a publisher to be proactively ready to handle access requests?

When can I as a publisher reject an access request?

Made possible by the players of