UltraSmooth wrote:
The above suggestion is as per the EU standard guidelines regarding privacy policies.
GDPR/DPA guidelines state that you have the right to contact the data controller (myself) to have data sent to you and/or removed. It does in no way state that this should be an automated process that the user can initiate.
It is made clear in our
privacy policy that data subject requests as per GDPR/DPA are to be sent to
[email protected] and we have a timeframe to acknowledge/respond and act.
Staff require access to member/player IP addresses in order to enforce bans, detect multi-accounting, and more. It is necessary for their role. This meets the standards of GDPR/DPA for why we collect and store such data, and whom has access to it.
Unfortunately, we can't vet staff in reality - this is an online gaming community, and pretending this is a formal business is just silly. That doesn't mean we don't take security and privacy seriously, it just means there are limitations to the measures we can take to protect sensitive data such as IP addreses. If a rogue member of staff leaks IP addresses and we had no inclination that they would do such a thing, what more would one expect us to do? If management are somehow involved with hiring/keeping on staff they know to be unfit for purpose, that is something that should be highlighted to myself with detailed evidence so that action can be taken. I cannot take action on random suspicions without evidence to back it up.
I'm afraid that once an IP address is leaked, it cannot be undone. Of course the accused member of staff (if they are even identified) will surely be dismissed and blacklisted from rejoining the staff team. However, please remember where we are, this is the internet, and someone can fake an identity extremely easily and rejoin staff with a new identity. If you have a magical suggestion for how to prevent this, I'm all ears, as would all other online communities be.
One part of GDPR/DPA states that the request to delete one's data is not always guaranteed to be accepted. If data is to be kept for a valid reason, it can be refused to be deleted. In the case of MCNR keeping someone's IP address on record, this may be used to identify rule-breaking, or enforce bans. In a situation where such a request would be denied, the data subject would need to contact the ICO or other relevant government body to start an appeal or legal process, but I'm confident we'd be found on the right side of the legislation to keep the data for valid purposes.
Lastly, an IP address on its own is not personally identifyable information. If it is linked with other data, such as someone's name, address, phone number etc. then yes someone could be identified from an IP address, but most people's online aliases have no relation to their real identity and as such someone cannot be personally identified by an IP address alone. Plus, multiple people could share a single IP address, so it is not specific to an individual. Imagine an Internet Cafe with 100 users - the IP address cannot be used to personally identify one of those 100 users.
Feel free to educate me if I have missed or misunderstood anything, however I am quite confident I know the basics of GDPR/DPA and what MCNR does is in line with it.
In future, don't throw around GDPR like it's a magic buzzword that will make MCNR fall to its knees and do what you want. You'll just get educated.
