GDPR: Detecting duplicate accounts in online services with customer data
<p>If I have a game or some other online service I host in which:</p>

<ul>
<li>It is forbidden for a subscriber to hold more than one account, OR</li>
<li>Even if it is not forbidden, to detect one person on multiple accounts for abuse prevention (such as enforcing a ban from the service)</li>
</ul>

<p>does the GDPR prevent me from using any of the following data <em>for the express and singular purpose</em> of accomplishing this goal?</p>

<ul>
<li>IP Address</li>
<li>Email address </li>
<li>Password hash</li>
<li>Payment info (hashed, not raw)</li>
<li>Screen resolution</li>
<li>Video card model and driver version (via regular graphics API)</li>
<li>Running process list (as used by anticheat)</li>
<li>Hardware hash</li>
<li>Typing/clicking cadence</li>
<li>Friends lists</li>
<li>Other on-service behavior (menus accessed, access patterns, etc)</li>
</ul>

<p>I'm aware of a <a href="http://arno.uvt.nl/show.cgi?fid=142935" rel="nofollow noreferrer">paper (Greidanus, 2017)</a> that covers the legality of using various methods of client side cheat detection software that uses some of this data, but as the purpose would be different in this case, I assume the conclusion may not necessarily be the same.</p>

<blockquote>
  <p>does the GDPR prevent me from using any of the following data for the express and singular purpose of accomplishing this goal?</p>
</blockquote>

<p>No.</p>

<p>These are all personal data as defined by the GDPR, but the GDPR as such does not ban processing of any specific <em>type</em> of personal data or any specific <em>purpose</em> for processing.</p>

<p>All the GDPR does is to require from the controller to ensure <em>lawfulness of processing</em> (GDPR <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a>).</p>

<p>So you need to assure that your processing of this personal data is lawful.</p>

<p>In your particular case, I think the legal ground for lawful processing should be Article 6 (1)f. This article say that it is OK to process personal data if: </p>

<blockquote>
  <p>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>

<p>To maintain duplicate accounts on a game or some other online service is by no means "interests or fundamental rights and freedoms of the data subject" &ndash; so you don't have to worry about that condition overriding the interest <em>you</em> are pursuing by processing this personal data (abuse prevention).</p>

<p>Is abuse prevention a "legitimate interest" you as a controller and operator of the website are allowed to pursue?  I will say that the answer to this is clearly: "Yes".</p>

<p>So the legal ground for processing in cases where the controller collects personal data to prevent abuse is Article 6 (1)f.</p>

united-states privacy gdpr