Is storing records of chess games a violation of GDPR?
<p>Many amateur chess players store the notations of their games in electronic format (like <a href="https://en.wikipedia.org/wiki/Portable_Game_Notation" rel="noreferrer">pgn</a>) so that they can later reference the game for analytical and historical reasons. Information in this file typically include the name and rating of the opponent, the date and location of the game, the moves played and the result.</p>
<p>These files are typically only used in private, but they can be stored on public servers and shared with others (it is not unusual for someone to email a pgn of a game to someone else for the purpose of further analysis).</p>
<p>Is doing this without approval from the opponent a possible violation of GDPR?</p>
<p>Note: I am aware of <a href="https://law.stackexchange.com/questions/27753/how-does-gdpr-affect-sports-statistics">How does GDPR affect sports statistics?</a> but the answers there seem to indicate that because professional athletes are to some extend public figures, they give up a fair amount of rights to protection of personal information. My question is about amateur chess players, not professionals.</p>

<p>By itself, a chess position is not personal data. Personal data is “any information relating to an … identifiable natural person”. Since the file in question includes the name of the opponent, it is clearly personal data about the opponent.</p>
<p>If the files are used for “purely personal or household purposes”, the GDPR won't apply per Art 2(2)(c).</p>
<p>If the files are shared more widely – especially if the files are published – then GDPR becomes relevant. The person/entity who is data controller has to consider GDPR compliance. Data controller is whoever determines the purposes and means of processing of personal data (the “why” and “how”).</p>
<p>The first question would be under which legal basis this personal data about another person can be shared. The GDPR offers multiple legal basis, notably “legitimate interests” and “consent”.</p>
<ul>
<li><p>Consent is always an option, but must be freely given (entirely voluntary).</p>
</li>
<li><p>Legitimate interests can serve as a legal basis after a balancing test between your interests and the data subject's rights and interests. This balancing test also depends on the reasonable expectations of the data subject, which in turn depends on the more general context. For example, in a chess community where such sharing is completely normal there would likely be a legitimate interest for you to share games as well, if the games occurred in the context of this community. But if you play a game with a friend who is not part of this community, the friend cannot reasonably expect that their name and associated personal data would be shared.</p>
</li>
</ul>
<p>The second question would be how you would satisfy further GDPR compliance obligation, in particular the Art 13/Art 14 right to information. When collecting personal data, it is necessary to provide certain information such as your identity, what processing is being carried out, and how the data subject can invoke their GDPR rights (a <em>privacy notice</em> or <em>privacy policy</em>). This might be difficult or awkward to do.</p>
<p>Practical solutions to these problems:</p>
<ul>
<li>If you want to share a game but aren't sure that the opponent is OK with this, remove identifying aspects such as names. For example, you could crop a screenshot, or describe the game in textual notation without listing the opponent's name.</li>
<li>Play the game via a chess website that publishes the game. This way, the website is the data controller, and you and the opponent are the data subjects. This avoids having to act as the data controller yourself. This might work for private interactions, but not e.g. if you run a chess club and require members to play via that website – you might still be in a data controller role then and have full compliance obligations.</li>
</ul>

gdpr