Legal Aspects of Citizen Science in Video Games · 2020-07-27 · Legal Aspects of Citizen Science in Video Games Page 4 Swiss start-up Massively Multiplayer Online Science (MMOS)
Post on 31-Jul-2020
0 Views
Preview:
Transcript
Legal Aspects of Citizen Science in Video Games
Sebastian Schwiddessen
Legal Aspects of Citizen Science in Video Games Page 2
Contents I. Introduction......................................................................3
1. The idea behind citizen science ..........................................3
2. The next level: Implementing citizen science into
traditional video games or adding competitive elements........3
3. How citizen science is implemented into traditional video
games ...............................................................................3
4. Results ..............................................................................4
5. Set up of typical multi -party citizen science projects..............4
II. Data protection law ..........................................................5
1. Personal data subject to the citizen science project ..............6
a. Potential categories of personal data .............................6
aa. Category 1: General personal data of users .............6
bb. Category 2: Personal data of users collected
specifically in connection with the citizen science
project ...................................................................6
cc. Category 3: Personal data of third parties
collected specifically in connection with the citizen
science project.......................................................6
dd. Category 4: Personal data of third parties
collected and provided by the researcher for the
citizen science project ............................................6 b. Not all data is personal data (especially proteins) ...........6
2. Controller or processor? - Assessment of the role of the
parties involved in the citizen science project .......................7
a. The researcher ............................................................7 b. The service provider.....................................................7 c. The video game company.............................................8 d. Other group entities and service providers .....................8 e. The citizen scientists (players/users) .............................8
3. Legality of the processing ...................................................9
a. Requirement of a legal basis.........................................9 b. Exemption for processors .............................................9 c. The GDPR scientific research privilege........................10 d. Assessment of available legal bases ...........................10
aa. Regular personal data ..........................................10
(1) Consent (Art. 6 (1) sentence 1 lit. a GDPR)......10 (a) Freely given .............................................10
(aa)The issue of bundled and conditional
consent ............................................. 10 (bb)Other outcome where the citizen science
project is seamlessly implemented into the game? ......................................... 11
(cc) Specifics with regard to the researcher 11 (b) Specific ...................................................11 (c) Informed ..................................................12
(aa)Identity of the controller ...................... 12 (bb)Purpose............................................. 12 (cc) Personal data .................................... 12 (dd)Risks of third country data transfers..... 12 (ee)Timing of obtaining consent ................ 12 (ff) Unambiguous indication of wishes....... 12
(2) Performance of a contract exemption (Art. 6
(1) sentence 1 lit. b GDPR)............................. 13
(3) Public interest (Art. 6 (1) sentence 1 lit. e
GDPR) .......................................................... 13
(4) Legitimate interest (Art. 6 (1) sentence 1 lit. f
GDPR) .......................................................... 13
bb. Special categories of personal data....................... 13
(1) Explicit Consent (Art. 9 (2) lit. a GDPR) ........... 14
(2) Substantial public interest (Art. 9 (2) l it. g
GDPR) .......................................................... 14
(3) Public interest in the area of public health
(Art. 9 (2) lit. i GDPR) ..................................... 14
(4) Scientific or historical research purposes (Art.
9 (2) lit. j GDPR) ............................................ 15
4. Data transfers within multi-party video game citizen
science projects............................................................... 15
a. Data transfers within the EU/EEA................................ 16
aa. Controller-to-controller.......................................... 16
bb. Controller-to-processor......................................... 16 b. Data transfers outside the EU/EEA ............................. 17
aa. Step 1 ................................................................. 17
bb. Step 2 ................................................................. 17
(1) Adequacy decision......................................... 17
(2) Appropriate safeguards .................................. 17
(3) Derogations for specific situations, in
particular consent .......................................... 17
cc. Examples ............................................................ 18
5. Requirements and benefits of the GDPR scientific
research privilege ............................................................ 19
a. Scientific research within the meaning of the GDPR ..... 20 b. Appropriate safeguards .............................................. 20 c. Benefits of the scientific research privilege .................. 20
aa. Exemption from the principle of purpose limitation
for further processing ........................................... 20
bb. Exemption from the principle of storage limitation... 21
cc. Exemption from Art. 14 GDPR information
obligations........................................................... 21
dd. Exemption from the right to erasure (Art. 17
GDPR) ................................................................ 21
ee. Exemption from the right to object (Art. 21 GDPR) . 21
ff. Exemption from the right to access, rectification,
restriction and object, pursuant to Art. 15, 16, 18
and 21 GDPR on the basis of EU member state
law...................................................................... 21
gg. Exemption for special categories of personal data.. 21
hh. Broad consent ..................................................... 22
i i . Application of legitimate interest exemption is
more likely........................................................... 22
III. Copyright law (high-level comments) ............................ 22
Legal Aspects of Citizen Science in Video Games Page 3
For some time now, start-ups, health care and tech companies have been experimenting with smaller video games to have people
around the world help with categorizing or analyzing big data sets that typically take months or even years to analyze. The idea is that
if everybody invests only a few minutes, the work could be done in days or weeks instead of years. A player who participates has to
solve a few simple matchmaking or categorization tasks and can thereby help in research related to cancer, Alzheimer's disease,
and the categorization of human genomes or proteins.
Citizen sciences in video games have of late been getting more attention from well-known backers from the games industry, such
as CCP with Eve Online and Gearbox with Borderlands. Some video game companies have also started to leverage their huge
player base by asking players to carry out smaller tasks to improve the company’s own technology, which is essentially the same
concept as citizen science. Furthermore, new start-ups are emerging, which help connect video games with traditional citizen
science projects. As a result, some projects have not only made it to the front page of The Wall Street Journal but also to some of the
most successful citizen science projects overall. With that in mind, it is not surprising that the EU recently decided to fund, to the tune
of EUR 1 mill ion, the idea of connecting video games with actual science under the Horizon 2020 research and innovation
programme.
Headlines were also made when several tech companies, including
Nvidia, recently called on PC gamers to help fight COVID-19 by donating unused graphical processing power to Folding@home, a
distributed computing project based at the Washington University in St. Louis School of Medicine, which performs molecular
dynamics simulations of protein dynamics.
The following article describes the phenomenon of citizen science around the video games industry and addresses some of the most
striking data protection law aspects, mainly from the perspective of the EU General Data Protection Regulation (GDPR). The GDPR
remains one of the most practically relevant data protection regimes due to the significant sanctions it administers, and
because it also applies to the processing of personal data of persons within the EU/EEA even if the relevant company is
established abroad but offers goods or services to persons within the EU/EEA. Since video games are often played by players across
the globe, the territorial scope of the GDPR catches most video game companies as video games are typically also played by
players in the EU/EEA. At the end, the article also briefly touches
on copyright questions.
I. Introduction
1. The idea behind citizen science
Citizen science is scientific research conducted, in whole or in part, by amateur or nonprofessional scientists. Citizen
scientists can take over simple tasks, such as taking the temperature at a certain location and transferring the data to
the researcher, or categorizing/analyzing large data sets with regard to certain patterns (e.g., genomes/proteins). Even
though many data sets only require simple pattern analysis, they are often too large to be processed by the researcher
alone. In some cases, the required work can amount up to several hundred years of work time. However, if only a small
portion of the world’s population voluntarily participated in the effort with very little time investment, the work could often be
done in a few days or even hours.
Other forms of citizen science do not even require the player
to become active at all. When players were asked to donate unused graphical processing power to help fight COVID-19,
all they had to do was install a small tool on their PC, which allowed remote access to their GPU and connected the
GPUs of thousands of players around the world to one giant cloud network that analyzed the homologous structure of the
SARS-CoV spike protein to identify therapeutic antibody
targets.
2. The next level: Implementing citizen science into traditional
video games or adding competitive elements
Despite the advantages from a social, scientific and economical perspective, many traditional citizen science
projects struggle with high drop-out rates and decreasing motivation. While citizens are often motivated at the
beginning by the sole purpose of doing something good, their interest fades over time, in particular with long or indefinitely
running projects. For many, the work is simply too repetitive, out-of-context and yields no reward. This is why game
developers, start-ups and some larger tech and health care companies have started to experiment with developing
smaller casual video games (e.g., puzzlers) to make the work
more motivating and fun for the participants.
Recent projects even went a step further with the idea of
connecting traditional and hugely successful AAA video games with citizen science (e.g., Eve Online). This way,
three basic motivation factors are modified: (1) the citizen science project is fully integrated in the world and story of a
video game with the players sometimes not even knowing that the game content they are currently playing (e.g., a side
quest) is part of a science project; (2) the players receive an incentive for their participation, typically in form of an in-
game reward (e.g., in-game currency, a character skin or weapon); and (3) the task and amount of work is l imited right
from the start (e.g., by having the players analyze only 250 data sets to receive the relevant in-game reward instead of
an indefinite number).
Under this concept, video game companies can help
researchers such as universities or science projects with valuable input or can even take over scientific work for
companies in exchange for remuneration. Some video game companies also have adapted the concept by leveraging the
potential workforce of their player base to improve their own technology, such as by having mobile players take and
transfer pictures of public places, which can subsequently be used to build virtual environments or improve AR
mechanisms.
Successful projects l ike Folding@Home, which use hardware resources voluntarily donated by citizen scientists
(e.g., to fight COVID-19 and other diseases) also apply additional motivational elements. Participants are awarded
points and receive credits for the performance of their system. Users can register their contributions under a team. All points
are combined and therefore allows teams to compete amongst each other, a chal lenge appreciated by hardware
enthusiasts such as PC overclockers.
3. How citizen science is implemented into traditional video
games
Considering that citizen scientists are nonprofessionals and
because it must be expected that a certain number of players will not take the task seriously enough or might even willfully
produce false data, the question that comes to everybody’s mind is: Does it really work? Two citizen science projects that
were both implemented into the hugely popular sci -fi game Eve Online clearly show that the answer to the question is
“yes.” In a joint effort between the Human Protein Atlas, the
Legal Aspects of Citizen Science in Video Games Page 4
Swiss start-up Massively Multiplayer Online Science (MMOS) and Eve Online developer CCP, a first citizen science project
was implemented into Eve Online, which required players to conduct research by the in-game organization Sisters of Eve
to discover the origin of the Drifter race. The latter had been introduced in the game’s lore a few years before. Called
Project Discovery, the project asks players to categorize proteins according to specific criteria. Players first have to go
through a short tutorial that has them categorize some examples with varying degrees of difficulty. Afterwards, the
player has to categorize unknown pictures. To determine the precision of the player, training pictures that serve as a
benchmark are regularly implemented into the flow. If the benchmark turns out to be non-satisfactory, the player will
only be provided with training pictures for the rest of the game. The same treatment is applied to so-called trolls. Later, a
second citizen science project was launched, which asked players to analyze patterns to identify real exoplanets in the
virtual Eve Online universe.
4. Results
Project Discovery exceeded all expectations. At the beginning, the organizers were hoping for 40,000
classifications each day, with 100,000 being regarded as a maximum positive peak result. However, after Project
Discovery went online, 900,000 classifications per day were
reached immediately, later evening out at 100,000 classifications per day. After only six weeks, the Eve Online
player base had generated the equivalent of 163 working
years in protein classifications.
The second project that had players analyze patterns to
identify real exoplanets in the virtual Eve Online universe was even more successful. With 13.2 mill ion classifications
submitted during the first week alone, the project resulted in one of the most successful citizen science projects of all time
in terms of user activity.
Even more successful was the call to PC gamers to donate
unused GPU resources of idle PCs to fight COVID-19. Before such call, the Folding@home project was already one of the
world’s fastest computing systems, with a speed of approximately 98.7 petaFLOPS as of early March 2020.
However, after several tech companies such as Nvidia and Intel called upon PC owners to donate their GPU power in
the midst of the corona virus crisis, it was announced on April 13, 2020 that Folding@Home now has approx. 2.4
exaFLOPS of compute power, making it faster than the 500
fastest super computers combined.
5. Set up of typical multi-party citizen science projects
The idea of connecting citizen science projects with video games is sti l l quite recent , and it is sti l l difficult to classify a certain set up as standard. From a legal perspective, citizen scientists donating computing power to a researcher is relatively simple. The researcher
provides a client software that users must install on their PC or other device. The researcher might also engage a third-party cloud service
provider where data is stored and processed. Such a scenario could be illustrated as follows:
Researcher
(e.g., university / pharma cooperation)
Client software agreement
Computing power donator
(e.g., PC user)
Se
rvic
e a
gre
em
ent
Service provider
(e.g., cloud service)
Legal Aspects of Citizen Science in Video Games Page 5
Scenarios in which a company or researcher directly develops a video game that includes a citizen science project look similar:
However, the setup of citizen science projects that are directly implemented into a traditional AAA video game (e.g ., Eve Online as described above) is significantly more complex. Here, the typical setup can involve a researcher (e.g. , a university, science lab, pharma
company), a service provider that provides expertise on implementation strategies and/or IT interfaces, and lastly the video game company. The video game company can be part of a group of companies located in different jurisdictions and maintain service providers such as
cloud servers from where the video game is operated. The relationships between the different participants could be illustrate d as follows:
II. Data protection law
Considering the number of parties and individuals involved in citizen science projects and the fact that any citizen science
project is almost inevitably a multijurisdictional project, the first area of law that comes into mind when assessing citizen
science from a legal perspective is data protection law. The
Citizen science game developer
Software agreement
Players
(citizen scientists)
Se
rvic
e a
gre
em
ent
Service provider
(e.g., cloud service)
Researcher (e.g., university /
pharma cooperation)
Service provider
(provides expertise,
organization and IT services)
Other group entities
(e.g., parental company)
Service agreement or
cooperation
Video game
company
Se
rvic
e
ag
ree
me
nt o
r
co
op
era
tion
Several service providers
(e.g., cloud service provider)
Se
rvic
e
ag
ree
me
nt
Players
(citizen scientists)
Legal Aspects of Citizen Science in Video Games Page 6
following sections describe some data protection law aspects
that come up when this area of law is assessed.
1. Personal data subject to the citizen science project
a. Potential categories of personal data
Depending on the specific setup of the citizen science project,
four different categories of personal data could (but do not
have to) be involved:
aa. Category 1: General personal data of users
This group concerns personal data of users that is, for instance, used for the purpose of providing the video game
but that is also needed for the citizen science project. Examples are user ID, IP address, name and email address.
Since such data will be processed for an additional purpose, amending existing privacy policies, processing agreements
and other data protection documents might be required. Data category 1 only concerns those cases where the citizen
science project is integrated into a video game and not for citizen science projects that, for instance, leverage unused
processing power of players (such as Folding@Home). The difference is that in the case of the latter, the processing
purpose with regard to general personal data only l ies in executing the citizen science project, whereas with regard to
a video game the data is used for different purposes while at the same time (i) providing the video game; and (ii) executing
the citizen science project.
bb. Category 2: Personal data of users collected specifically in
connection with the citizen science project
This category involves personal data of users collected specifically in connection with the citizen science project.
Thus, this category will typically concern personal data that is either directly required for the project (e.g., location data
for a project where a video game player has to report certain observations at different locations), or where the users
themselves are the subject of the project (e.g., a questioning) or that is collected incidentally (e.g., IP addresses or meta
data included in an image or other fi le created and
transferred by the user).
With regard to projects that do not involve a video game but only the use of unused player CPU/GPU resources (like
Folding@Home), this data category might also involve name, email and IP address and other basic data collected in the
course of install ing/registering the client software on the
user’s PC.
cc. Category 3: Personal data of third parties collected
specifically in connection with the citizen science project
This category involves personal data of third parties collected
specifically in connection with the citizen science project. Like the preceding category, this could involve either
personal data directly required for the project (e.g., the name of third parties in a public questioning conducted by the user)
or that is collected incidentally (e.g., bystanders on pictures of public places taken and uploaded by the user in the course
of the citizen science project).
dd. Category 4: Personal data of third parties collected and
provided by the researcher for the citizen science project
This category involves personal data of third parties that has been collected by the researcher (e.g., a university or private
company) prior to the citizen science project and which is
now provided to be analyzed/processed by the citizen scientists. An example would be a university providing
already collected personal data to a video game company to be implemented into a video game and subsequently
analyzed by the players in the course of the citizen science project. Cases where personal data is provided to be
analyzed/processed by unused CPU/GPU power of the player also belong in this category. Examples would be huge
data lists, some forms of genetic data, or pictures of public
places with bystanders.
b. Not all data is personal data (especially proteins)
Of course, not all data provided by the researcher constitutes personal data subject to applicable data protection laws. For
instance, where the players are required to analyze astronomic data involving planets and space phenomena
(see actual example in the introductory section), the respective data will typically not constitute personal data.
Nevertheless, this category often requires closer legal analysis. Some data might constitute personal data under
one data protection regime but not under another.
The approach under the US HIPAA Privacy Rule provides that health information is de-identified if a qualified expert determines that the risk is very
small that the information could be used, alone or in combination with other reasonably
available information, by an anticipated recipient to identify an individual who is a subject of the
information (45 C.F.R § 164.514 (b)(1)(i)).
Under the GDPR "personal data" means information relating to an identified or identifiable
natural person. A person is considered to be identifiable when such person can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier, or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person
(Art. 4 (1) GDPR). According to EU data protection authorities, in order to determine
whether a person is identifiable, account should be taken of all the means likely reasonably to be
used either by the controller or by any other
person to identify the said person.
The US approach seems less strict compared to the GDPR as: (1) a “very small” risk does not necessarily mean that the
identification cannot be “reasonably expected” from a GDPR perspective; and (2) it only concerns identification by an
“anticipated recipient,” whereas under the GDPR any party
must be considered.
In particular with regard to genetic data or proteins, the
requirement of identifiability will depend on the means likely reasonably to be used by anyone to identify the person. If,
for instance, the researcher sti l l has the technical means to identify the data subject with reasonable effort based on the
genetic data, such data must be considered personal data at least form a GDPR perspective. Moreover, the personal data
in question here would not only constitute “normal” personal data but a special category of personal data that may only be
processed under very strict conditions (Art. 9 GDPR).
A large number of video game citi zen science projects
(including those to fight COVID-19) focus on the analysis of protein patterns and other genetic data. However, a single
Legal Aspects of Citizen Science in Video Games Page 7
protein will typically not constitute personal data from a GDPR perspective as it will be almost impossible to l ink it to
a certain individual. The case might be different where a combination of proteins is analyzed, which is very rare and
can therefore be connected to an individual person. The same applies to DNA. A single DNA sequence typically does
not constitute personal data from a GDPR perspective since this sequence can occur within mill ions of humans. Longer
sequence chains, however, can often be connected to an individual and therefore constitute personal data subject to
the GDPR.
2. Controller or processor? - Assessment of the role of the
parties involved in the citizen science project
Another key question with regard to any citizen science
project is the role the different parties involved in the project take from a data protection law perspective. This question
requires a case-by-case analysis considering the various potentially applicable data protection law regimes and the
fact that every citizen science project involves a different setup and different responsibil ities of the involved parties
with regard to the processed personal data. Under many data protection law regimes, the key differentiation is whether the
relevant party takes the role of a controller or processor (though the term might vary under different data protection
laws). Depending on this classi fication, the legal requirements that must be complied with by each party can
significantly vary. The following section discusses the classification of some of the parties outlined above in the
setup section and charts from a GDPR perspective:
a. The researcher
The role of the researcher will most l ikely become relevant
with regard to personal data categories 2 to 4 (see above 1). Since data category 1 (general player data) is mainly
processed for the mere purpose of operating the video game (e.g., name, IP and e-mail address), the data will typically be
controlled by the video gaming company with the researcher neither having access to such data nor being able to
determine the purposes and the means of the processing (to the extent it does not also fall under category 2). The fact that
data category 1 is automatically needed for the citizen science project (which is integrated into the video game)
does not change anything as it is sti l l the video gaming company that controls this data. An exemption applies of
course where the video game is (also) developed/operated by the researcher itself. With regard to citizen science
projects that do not involve a video game but only provide unused GPU/CPU power, data category 1 is irrelevant (see
above already).
With regard to data categories 2 to 4, the researcher will most l ikely have to be regarded as a controller. "Controller" means
the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the
purposes and means of the processing of personal data (Art. 4 (7) GDPR). The researcher determines the scientific and/or
economic purpose of the processing in the course of the citizen science project and will naturally also be involved in
the determination of the means of the processing as the latter is key to the success of the project. The fact that a video
game company might collect the data (e.g. data category 2 and 3) and therefore likely has a say in the means of the
processing as well does not change the controller role of the researcher. Where two or more controllers jointly determine
the purposes and means of processing, they shall be joint controllers (Art. 26 sentence 1 GDPR). Whether and to which
extent the researcher itself actually processes the personal
data at first is not relevant for its status as controller, as long as the researcher is also responsible for the decision-making
with regard to the purposes and means of the processing.
b. The service provider
More difficult is the categorization of the service provider
(where applicable), which typically provides :(1) expertise and advice on the implementation of the citizen science
project in the video game; (2) organizational services; and (3) infrastructure, in particular IT services (API, SDK and other
interfaces, cloud platforms and access portals) to both the
researcher and the video gaming company.
Like the researcher, the role of the service provider will most
l ikely only become relevant with regard to personal data categories 2 to 4 (see above). With regard to category 1
(general player data), the data should be controlled only by the video gaming company, with the service provider having
no access to such data (as long as it does not also fall under category 2). Again, an exemption applies if the researcher is
(also) responsible for developing/operating the video game.
Based on practical experience, service providers often prefer
to be regarded as processors, with the argument that they only assist in somebody else’s project. However, for
differentiation between controller and processor, preferences and even the contractual framework and terms and
descriptions therein are not primarily decisive. The classification of the service provider depends instead on a
case-by-case analysis considering the specific setup of the citizen science project and the activities executed by the
service provider.
A "processor" means a natural or legal person, public authority, agency or other body that processes personal data
on behalf of the controller (Art. 4 (8) GDPR). Processors may not use the received data for their own purposes and must
strictly follow the instructions of the controller. The processor is not “lord of the data” but only an “extended arm” of the
controller. A processor has no decision-making authority with regard to the purpose and the means of the data processing.
A processor cannot follow own interests that go beyond the actual services provided with regard to the processed
personal data. Consequently, whoever determines the purposes and means of the processing does not take the
subordinate role of a processor. The same applies if the purpose and means of the processing are determined
together with the controller (joint controllership). A controller retains exclusive control over the purpose for which the data
is processed at any stage of the project. In contrast, the processor typically only has the freedom to take minor
decisions, such as technical decisions (e.g., which operational system is used). Furthermore, processors
typically have no need to retain the personal data after the processing activity has been terminated. Most importantly,
processors do not determine the personal data that is collected and the manner in which the processing will be
carried out.
Having said that, with regard to the provided i nfrastructural
IT services, the service provider will most l ikely have the role of a mere processor. The provision of IT services, such as
software-as-a-service and cloud services without content-related data access, is a typical activity of a processor. Such
activity ends once the service contract is terminated and the
processor does not retain any of the personal data collected.
However, this does not automatically mean that the service
provider takes the role as a processor with regard to the
Legal Aspects of Citizen Science in Video Games Page 8
provided advisory and organizational services. A processor can at the same time be a controller of the same personal
data if it processes such data for different purposes. Thus, the service provider might process some personal data as a
processor for the controller’s purposes and only upon its instruction, but also process that same personal data for its
own separate purposes. This would in particular be the case if the service provider by organizing, advising and assisting
the project, determines which personal data should be collected for the project, how it will best be collected, where
it is transferred to, how the data will be analyzed and thereby processed, and who has access to the data. Even if the
service provider carries out all these activities to assist the researcher’s science project, the service provider would still
be a (joint) controller from a GDPR perspective. Assigning the technical/professional execution of a project – even partly
– to somebody else is a typical controller activity for the executing part. Thus, where the researcher would assign the
details of the implementation of the citizen science project into the video game (partly) to the service provider and is
only/mainly interested in the produced data to study it later, the service provider would be a controller. This would apply
even more if the service provider obtains a right to retain some of the personal data for its own purposes, such as to
improve its services for future projects.
c. The video game company
The role of the video game company will typically become
relevant for all four personal data categories outlined above (see above 1). With regard to category 1 (general player
data), the video game company is the controller as it determines the purpose and means of how such data is
processed to operate the video game and with it the citizen science project. However, the video game company will likely
also be a controller with regard to the other data categories 1 to 3 even though it might in the end only provide a service
for the researcher by assisting the latter with its citizen science project. The video game company is the operator of
the video game into which the citizen science project is integrated. It has creative control over the integration, which
naturally involves decisions on how the personal data is collected (data category 2 and 3) and/or processed (data
category 4). Again, assigning the technical/professional execution of a project (in this case the creative integration of
the citizen science project into the game) to somebody else is a typical controller activity for the executing party. The
video game company also determines the purposes of the processing as it has an interest in an engaging experience
for its players and therefore also uses the personal data for
its own purposes.
d. Other group entities and service providers
Like all companies, video game companies or researchers often maintain other group entities (parental company,
subsidiaries, affi l iates) and engage service providers for various services (e.g., cloud service providers to host the
game or to process the data analyzed by donated CPU/GPU power). The role of these entities depends on a case-by-case
analysis and cannot be conclusively assessed in this article as every setup will l ikely be different. While service providers
such as cloud services typically constitute only processors or sub-processors, the role of other group entities is more
difficult to determine. However, even in cases where the citizen science project is primarily handled by a
subsidiary/affi liate within the group of companies, the parent company may stil l take the role of a (joint) controller. For
instance, a video game parent company would be a joint controller if it – together with its subsidiary – is responsible
for the creative control and/or the decision-making process on the implementation of the citizen science project into a
video game and consequently on how the relevant data is
collected/processed.
There are, however, cases where the parent company only
provides certain processing services for its subsidiaries. A common example is payroll services for employees of the
subsidiaries. The processing of employee personal data by the parent company for the purposes of payroll is a typical
processing activity that often takes place solely upon the instruction of the subsidiary that remains the employer of the
local employees. For this reason, many subsidiaries enter into processing agreements and international data transfer
agreements with their parent companies. With regard to a citizen science project, however, a similar categorization of
the parent company as a mere processor would require that the parent company have no influence on the
implementation/development of the video game citizen science project but only processes the personal data upon
the instructions of its subsidiary, such as an intermediary that commissioned the cloud services provider where the video
game is operated (which would make the cloud service
provider a sub-processor of the subsidiary).
e. The citizen scientists (players/users)
The role of the citizen scientists (players/users) will only become relevant in case of personal data category 3 and 4
(see above II.1.a.cc. and dd., that is, where the users are either required to collect new personal data in the course of
the citizen science project or to analyze personal data that has been provided by the researcher). If every individual
player would have to comply with all requirements under the GDPR, many citizen science projects would be difficult to
realize. However, according to Art. 2 (2) l it. c, the GDPR does not apply to the processing of personal data by a natural
person in the course of a purely personal or household activity. Personal activities refer to activities that serve the
purpose of self-expression, self-development or the exercise of personal freedoms during one's free time or in one's
private space. While the citizen science project might have a commercial or other interest-driven background that justifies
the application of data protection laws with regard to the companies/researchers behind it, the players of a video
game are sti l l exercising a simple hobby. This applies regardless of whether or not the players are aware that their
activity is part of a citizen science project (the latter in case of a seamless integration of the project into a video game).
Even the willful or idealistically motivated participation in a citizen science project that is integrated in a hobby such as
a video game can arguably be regarded as an activity of self-development or the exercise of personal freedom in one's
free time or private space. The same applies of course to people who donate their unused CPU/GPU power to projects
l ike Folding@Home to fight COVID-19 and other diseases. Thus, based on the so-called household exemption, it can be
argued that players, for instance, do not require a legal basis for the processing of personal data (see next section in this
regard) or have to maintain processing registers. This also applies with regard to data that is transferred from the player
to the video game company (data category 3). Players do not have to meet the GDPR requirements for data transfers if
they only pursue a hobby, similar to users of a social networks who post personal data on their profile (e.g. , a
picture with bystanders), which also results in the transfer of such data. Needless to say, however, the data recipient (e.g.,
the video gaming company and the researcher) must comply with the GDPR with regard to the data transferred to them
and therefore require a legal basis to process such data. This
Legal Aspects of Citizen Science in Video Games Page 9
interpretation is supported by recital 18 sentence 2 and 3,
which state the following:
Personal or household activities could include
correspondence and the holding of addresses, or social networking and online activity
undertaken within the context of such activities. However, this Regulation applies to controllers
or processors which provide the means for processing personal data for such personal or
household activities.
As mentioned above, the fact that players might not have to
comply with the GDPR does not release the other stakeholders involved in the project from their obligation to
do so. Having said that, some of the obligations that apply to the other parties can also extend to the players. This applies
in particular to data category 4, which is transferred to the players in the course of the project to be analyzed/processed
by them. While the player activities might fall under the household exemption, the preceding data transfer of data
category 4 from the video game company and/or the researcher to the players does not. In this scenario, players
likely take the role of a processor, which would require the conclusion of a data processing agreement and the
implementation of certain technical and organizational security measures on the side of the player to protect the
transferred data. Naturally, this might deter a large number of players to participate in the project. The only option to
completely avoid this consequence would be to fully anonymize the transferred data prior to the transfer, which
would render the GDPR inapplicable. However, some projects and data might not allow full anonymization. In this
scenario, the only remaining (realistic) option would be to directly implement the data processing agreement into the
video game and have it accepted by the players, the same way the player must accept the terms of service of the game.
The required technical and organizational security measures to protect the transferred data could be directly implemented
into the video game.
3. Legality of the processing
After having determined the role of the different entities, the legality of the various processing operations should be
assessed. Due to their multi jurisdictional setup, citizen science projects typically require looking at different
applicable data protection regimes. From a GDPR
perspective, the following aspects are relevant:
a. Requirement of a legal basis
From a GDPR perspective, the processing of personal data is generally prohibited unless a legal basis applies. This goes
for both the processing of normal personal data (Art. 6 (1) sentence 1 GDPR) as well as the more sensitive special
categories of personal data (Art. 9 (1) GDRP). Further legal bases can be found in national data protection laws and
sector-specific laws. For the determination of the legal basis, it must be differentiated between the various parties and the
categories of personal data involved in the citizen science
project.
It is important to determine the legal basis before the
commencement of the citizen science project. According to the prevailing opinion amongst EU data protection authorities
“the application of one of these six bases must be established prior to the processing activity and in relation to
a specific purpose” (EDPB Guidelines 05/2020 on consent under regulation 2016/679, p. 25). This can be derived from
the requirement that data subjects must be informed about the applicable legal bases and the purpose for which their
data is processed prior to the processing (Art. 13/14 (1) l it. c GDPR). Consequently, the legal bases cannot be swapped
afterwards. The European Data Protection Board (EDPB) has summarized this requirement with respect to the legal
basis of consent as follows:
It is important to note here that if a controller chooses to rely on consent for any part of the
processing, they must be prepared to respect that choice and stop that part of the processing
if an individual withdraws consent. Sending out the message that data will be processed on the
basis of consent, while actually some other lawful basis is relied on, would be
fundamentally unfair to individuals.
In other words, the controller cannot swap from
consent to other lawful bases. For example, it is not allowed to retrospectively util ise the
legitimate interest basis in order to justify processing, where problems have been
encountered with the validity of consent. Because of the requirement to disclose the
lawful basis which the controller is relying upon at the time of collection of personal data,
controllers must have decided in advance of
collection what the applicable lawful basis is.
(EDPB Guidelines 05/2020 on consent under
regulation 2016/679, p. 25)
Furthermore, it should be noted that each processing activity
requires a legal basis. For instance, the collection of the personal data, its analysis, the data transfer to the other
parties of the citizen science project, and the processing/analysis by these parties, are each different
processing operations, which all require a legal basis to be justified. This also means that where one processing
operation might be justified by a legal basis, another processing operation may not necessarily also be justified.
For example, the collection and analysis of the data might be justified on the basis of the legitimate or public interest
exemption. However, this does not necessarily mean that the data transfer to a third country is also justified by this
exemption. The same applies to consent. Obtaining consent from data subjects to process their data in the course of the
citizen science project does not mean that the data can be transferred to the other parties of the citizen science project,
unless the consent was specifically tailored in this regard.
b. Exemption for processors
An exemption from the requirement of a legal basis applies
to mere processors (Art. 28 GDPR). As an example, the service provider can be named, which takes the role of a
mere processor with regard to the provision of infrastructural software and cloud services that are used by the other
parties of the citizen science project (see the scenarios outlined under I.5). Since a processor processes personal
data only on behalf of the controller and upon the instructions of the controller, the relevant processing operations are no
processing operations of the processor itself but of the controller which alone determines the purposes and means.
Thus, the controller must be able to rely on the legal basis for its processing operation. The processor, on the other hand,
must only comply with processor-specific requirements (e.g., conclusion of a processing agreement and the
Legal Aspects of Citizen Science in Video Games Page 10
implementation of technical and organizational security
measures).
c. The GDPR scientific research privilege
The GDPR includes a so-called scientific research privilege set out in Art. 89 (1) GDPR. While this does not immediately
become evident from the wording of the provision, the basic mechanism is as follows: in exchange for implementing
certain safeguards, scientific researchers enjoy a variety of privileges in the form of reduced or less strict requirements
(for a full l ist, see II.5 below). The scientific research privilege is often the first thing that comes to mind when it is about
determining the legality of processing operations conducted for research purposes. However, the scientific research
privilege does not release the controller from the obligation that the processing must have legal basis. In other words,
even if the data processing is privileged in accordance with Art. 89 GDPR, it must sti l l be legal under the general
principles of Art. 6 and 9 GDPR, which means that the processing must be justified by an applicable legal basis.
Furthermore, the scientific research privilege does not apply to research that only follows commercial purposes, such as
improving the exclusive market, sales and competitive position. While the scientific research privilege generally also
applies to private companies, the term "research for scientific purposes" only refers to scientific research that primarily
serves the purpose of acquiring knowledge for the general public. This will in many cases apply to universities and
science institutions but not, for instance, pharma companies that develop new drugs to improve their market position. The
scientific research privilege will be addressed further below (under II.5) and is only referenced in this section where it has
implications.
d. Assessment of available legal bases
For the determination of the legal basis, one must again
differentiate between the various parties and the categories of personal data involved in the citizen science project. The
following legal bases are most relevant to discuss in terms of
citizen science projects:
aa. Regular personal data
(1) Consent (Art. 6 (1) sentence 1 lit. a GDPR)
With regard to classic scientific research involving personal data, consent is one of the most important legal bases.
Nevertheless, it should be noted in advance that the controller, and in particular the video game company, should
only rely on consent if no other legal basis is available as consent has several disadvantages, such as the possibility
to withdraw consent and its lack of flexibility. Controllers often consider consent to be the easiest way to get a project done,
especially if that means avoiding the implementation of technical and organizational security measures such as data
anonymization and pseudonymization. However, that is a false impression as the requirements for consent under the
GDPR are very strict and can easily result in an invalidly obtained consent or reduced immersion of the video game
(e.g., consent pop-up window during gameplay). Thus, if possible, the controller should always try to rely on other
legal bases and not consider avoiding the implementation of technical and organizational measures as the better option.
It’s not.
Nevertheless, depending on the project, there will be cases
where consent is the only remaining option. Where the controller relies on consent, all conditions for valid consent
under the GDPR must be met. Consent is defined as “any freely given, specific, informed and unambiguous indication
of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies
agreement to the processing of personal data relating to him or her” (Art. 4 (11) GDPR). Depending on the different parties
involved in a video game citizen science project, several of
these conditions require a closer look.
(a) Freely given
The "freely given" condition might, in particular, play a role with regard to the video gaming company and personal data
of its players. However, the researcher should also carefully
assess this requirement.
(a) The issue of bundled and conditional consent
Pursuant to Art. 7 (4) GDPR, when assessing whether consent is freely given, “utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the
processing of personal data that is not necessary for the performance of that contract.” According to the EDPB,
bundling consent with acceptance of terms or conditions, or tying the provision of a contract or a service to a request for
consent to process personal data that are not necessary for the performance of that contract or service is considered
“highly undesirable” (EDPB Guidelines 05/2020 on consent under regulation 2016/679, p. 10). Moreover, if consent is
(generally) bundled up as a non-negotiable part of the terms and conditions, it is presumed not to have been freely given
(EDPB Guidelines 05/2020 on consent under regulation 2016/679, p. 7, also see recital 43 sentence 2 part 2 GDPR).
Thus, the video game company should generally not ask players to consent to the terms of service of the video game
and at the same time to the processing of any personal data if that means that the player can otherwise not receive the
service. This would likely render the consent invalid.
The same standards apply to cases where the data subject is required to provide consent for processing purposes,
which are not necessary for the provision of a specific service and go beyond the delivery of the core service (EDPB
Guidelines 05/2020 on consent under regulation 2016/679, p. 8). “Consent is presumed not to be freely given if it does
not allow separate consent to be given to different personal data processing operations despite it being appropriate in the
individual case” (recital 43 sentence 2 part 1 GDPR). Thus, even by separately obtained consent, the video game
company should not try to obtain player consent for the processing of personal data for the purpose of the provision
of the video game (data category 1) and at the same time for the processing of that same data for the additional purposes
of the citizen science project. The same applies to obtaining bundled consent for the processing of personal data required
for the purpose of the provision of the video game (data category 1) and at the same time for the processing of
additional personal data that is only required for the purposes of the citizen science project (data category 2). Lastly, this
also applies to simultaneously obtaining consent for the transfer of any personal data to the other parties of the citizen
science project and the subsequent processing of the transferred data by them if these parties also process the
data for other purposes.
Legal Aspects of Citizen Science in Video Games Page 11
(b) Other outcome where the citizen science project is
seamlessly implemented into the game?
An interesting question results from the fact that at least in
cases where the citizen science project is fully integrated into the video game, it becomes a seamless part of the
experience (see Project Discovery scenario in the introductory section above). Thus, the data that is processed
for the citizen science project is technically also processed for the purpose of providing the video game service. This
applies to both: (i) player data that is requi red for the provision of the video game but which is now also processed
for the citizen science project (data category 1); and (i i) additional player data that is only required for the citizen
science project (data category 2). In the case of the latter, data category 2 in a way “transforms” to data category 1
through the seamless integration of the citizen science project into the video game, as such data is now technically
also required for the provision of the video game. It could therefore be argued that the processing only follows one
purpose and that consent obtained for the processing of data category 1 and 2 for a video game citizen science project
does not constitute a bundled/conditional and therefore potentially ineffective consent. However, given the often
over-careful stance many data protection authorities take, there is a risk that some data protection authorities would still
argue that the same processing activity follows two different
purposes in this case and each must be justified separately.
Either way, it is not recommended to rely on consent for the processing of personal player data for purposes of the
provision of the video game (leaving the integrated citizen science part of it aside). The processing of personal data for
providing the game (not necessarily the citizen science part of it) can already be justified on the basis of other legal
justifications, namely the performance of a contract exemption (Art. 6 (1) sentence 1 lit. b GDPR) or legitimate
interests (Art. 6 (2) sentence 2 li t. f GDPR). Consent, on the other hand, should (if at all) only be obtained for any
processing activity that goes beyond the delivery of the core service (i.e., for the citizen science part of the game, unless
of course one follows the approach discussed above that the video game and the citizen science part of it “merge” to one
processing purpose). However, if consent is used, it should only be obtained separately and not via the game’s terms of
service (see above).
(c) Specifics with regard to the researcher
For the researcher, the situation is slightly different. Where
the researcher obtains consent to process the personal data for a specific scientific purpose and the citizen science
project is only one part of the science project, consent for the processing of the citizen science project should be obtained
separately (e.g., by two different signatures or other affirmative actions). However, where the researcher collects
personal data only for the purpose of the citizen science project carried out by several parties, a one-size-fits-all
solution in the sense of “consent to citizen science project” (which of course needs to meet all other requirements)
should be acceptable. Since all processing activities are connected and serve the purpose of carrying out the citizen
science project, obtaining separate consent for each processing operation would not make sense as the entire
citizen science project would not be realizable without the data subject consenting to all required processing operations.
This is in l ine with Recital 43 sentence 2 part 1 GDPR, which states that “consent is presumed not to be freely given if it
does not allow separate consent to be given to different personal data processing operations despite it being
appropriate in the individual case .” An exemption applies, however, where one of the parties intends to process the
data also for other purposes than for the citizen science project. An example could be the intention of the service
provider (see scenarios outlined above) to process the data to improve its services for future projects. For this purpose,
separate consent must be obtained (unless of course the processing operation can be based on a different legal basis
such as legitimate interests, which should be assessed
separately).
(b) Specific
Consent of the data subject must be given in relation to “one or more specific” purposes (Art. 6 (1) sentence 1 lit. a GDPR).
The need for specific consent in combination with the notion of purpose limitation in Article 5 (1) l it. b GDPR works as a
safeguard against the gradual widening or blurring of purposes for which data is processed, after a data subject
has agreed to the initial collection of the data (EDPB Guidelines 05/2020 on consent under regulation 2016/679,
p. 14). Thus, if data is processed on the basis of consent that was obtained for a specific processing purpose, the data
cannot be later processed for another purpose. Again, an example would be the intention of the service provider (see
scenarios outlined above) to process the data to improve its services for future projects. This purpose is not covered by
consent to process data for the purpose of the citizen science project. Thus, this purpose requires a separate consent
(again, unless of course the processing operation can be based on a different legal basis, such as legitimate interests,
which should be assessed separately).
An exemption to the requirement of specific consent (i.e.,
purpose limitation) applies for consent that is obtained for the processing of personal data for scientific research purposes.
Recital 33 GDPR states the following:
It is often not possible to fully identify the purpose of personal data processing for
scientific research purposes at the time of data collection. Therefore, data subjects should be
allowed to give their consent to certain areas of scientific research when in keeping with
recognised ethical standards for scientific research. Data subjects should have the
opportunity to give their consent only to certain areas of research or parts of research projects
to the extent allowed by the intended purpose.
This so called “broad consent” exemption allows the
controller to obtain consent for certain “areas of research or parts of research projects” instead of for specific purposes
and without the necessity to obtain a new consent for each data use for other scientific research purposes. In other
words, on the basis of “broad consent,” the collected personal data can be used beyond the specific purposes of
the current research project.
“Broad consent” is a manifestation of the scientific research privilege implemented into the GDPR (see above already).
However, this again means that the controller can only rely on “broad consent” where the processing serves scientific
research purposes within the meaning of the GDPR, which requires research in the general public interest. While this
does not exclude private companies from the privilege, it excludes research purposes for purely commercial purposes
(see above). However, where the researcher is a public institution such as a university or similar organization, the
chances are good that it can leverage the exemption of
Legal Aspects of Citizen Science in Video Games Page 12
“broad consent.” It should also be kept in mind that profiting from the GDPR scientific research privilege also requires
implementing certain “appropriate safeguards” (Art. 89 (1) sentence 1 GDPR). Though it could be argued that this does
not apply to the “broad consent” exemption as the latter is only mentioned in the recitals of the GDPR but not the
legislative text, the understanding of “scientific research” under the GDPR is uniform and is based on the idea that the
controller can benefit from certain privileges in exchange for
implementing “appropriate safeguards.”
(c) Informed
The consent needs to be informed. According to the Article 29 Working Group, at least the following information is
required for obtaining valid informed consent (EDPB Guidelines 05/2020 on consent under regulation 2016/679,
p. 15):
the controller’s identity,
the purpose of each of the processing operations for which consent is sought,
what (type of) data will be collected and used,
the existence of the right to withdraw consent,
[…]
on the possible risks of data transfers due to absence
of an adequacy decision and of appropriate
safeguards as described in Article 46.
(aa) Identity of the controller
The most l ikely parties to the video game citizen science project that will be responsible for obtaining consent are the
researcher (for data category 4 as described above) and the video game company (for data category 2 and 3 as described
above). These parties need to inform about their identity in any case. If the consent sought is to be relied upon by
multiple (joint) controllers or if the data is to be transferred to or processed by other controllers who wish to rely on the
original consent, these organizations should all be named (EDPB Guidelines 05/2020 on consent under regulation
2016/679, p. 16). Thus, with regard to informing about the controller’s identity for consent for a video game citizen
science project, which of the other participating parties also constitute controllers now becomes relevant. At least in the
scenarios primarily assessed in this article, this applies to most of the participating parties that should all be named in the consent form. Processors do not need to be named.
However, it should be noted that in order to comply with Art. 13 and 14 GDPR (transparency requirements typically
implemented into a privacy policy) the category of recipients should at least be named, which also involves the categories
of processors.
(bb) Purpose
The informing controller must carefully differentiate between
the different processing purposes the various parties of the citizen science project might process the data for. Again, the
best example might be the service provider (see scenarios above), which could also have an interest in processing the
data to improve its services for future projects. This is a different purpose than the processing for the execution of the
citizen science project and therefore needs to be named
separately along with all other additional purposes one of the parties might process the data for. Having said that, the
option of “broad consent” for scientific research purposes in the general public interest should be mentioned here again,
which allows some flexibility with respect to the purpose, provided the requirements of the scientific research privilege
are met (see above and below for more details).
(cc) Personal data
All (types of) personal data that are processed for the citizen
science project need to be named. This includes data that is also processed, for instance, for the provision of the video
game (data category 1 as described above).
(dd) Risks of third country data transfers
This requirement applies only if the controller relies on
consent for international data transfers to third countries. It will therefore be addressed in the data transfer section below
(see II.4).
(ee) Timing of obtaining consent
Consent must be obtained prior to the commencement of the
processing activity. With regard to video game citizen science projects that are fully integrated into an AAA video
game, the question of whether obtaining consent when the video game is installed is sufficient or if consent must be
obtained when the player’s progress in the game reaches the fully integrated citizen science part (e.g., a certain side quest)
can be raised. The clear disadvantage with obtaining consent when the player arrives at the citizen science part of the video
game would be that a consent window that pops up during gameplay will harm the player’s immersion into the video
game. In a way this defeats the intention of seamlessly integrating citizen science in a video game without the
players even noticing that they participate in a science project. While the answer to this question will in the end
depend on the video game and the specific project, general principles under the GDPR imply that consent will often have
to be obtained when the player arrives at the citizen science part of the game. This applies in particular to video-games-
as-a-service, which provide an endless experience and where it can take hundreds of hours ti l l a player reaches the
citizen science project. In these cases, the player will not be able to identify when exactly the processing of their personal
data for the purposes of the video game commences. Moreover, players might have forgotten that they gave
consent for this purpose months or years ago. It therefore seems likely that an EU data protection authority would
consider this a breach of the “informed” requirement as well as the requirement that personal data shall be processed
“fairly and in a transparent manner” (Art. 5 (1) l it. a GDPR). This example shows again that consent should only be the
last resort for the controller to legitimize the processing of personal data in a video game citizen science project.
Implementing technical and organizational measures or “adequate safeguards” in order to be able to rely on other
legal bases such as legitimate interests should in any case
be preferred where possible.
(ff) Unambiguous indication of wishes
Consent requires a statement from the data subject or a clear affirmative act, which means that it must always be given
through an active motion or declaration. The use of pre -ticked opt-in boxes, such as when the video game is installed,
is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service,
Legal Aspects of Citizen Science in Video Games Page 13
cannot be regarded as an active indication of choice (EDPB Guidelines 05/2020 on consent under regulation 2016/679,
p. 18).
Obtaining consent via terms and conditions is also not an option even if actively accepted by the data subject. The
EDPB provides the following explanation in this regard:
A controller must also beware that consent
cannot be obtained through the same motion as agreeing to a contract or accepting general
terms and conditions of a service. Blanket acceptance of general terms and conditions
cannot be seen as a clear affirmative action to consent to the use of personal data. The GDPR
does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an
intervention from the data subject to prevent
agreement (for example ‘opt-out boxes’)
(2) Performance of a contract exemption (Art. 6 (1) sentence 1
lit. b GDPR)
At least with regard to the video game company and cases
where the citizen science project is seamlessly integrated into the video game, the performance of a contract
exemption can also be considered with regard to data category 1 and 2. This approach is based on the argument
that where the citizen science project becomes a seamless part of the video game or even constitutes the entire game,
the processing of data categories 1 and 2 (as described above) for the purpose of executing the citizen science
project automatically becomes a processing activity for the provision of the video game (which is the citizen science
project). See the explanations above under the headline “Other outcome where the citizen science project is
seamlessly implemented into the game?” which apply
accordingly (sec. II.3.d.aa.(1)(a)(bb)).
(3) Public interest (Art. 6 (1) sentence 1 lit. e GDPR)
In case the controller is a public body (e.g., a university), it is worth investigating whether the data processing for the
citizen science project can be based on the exemption of Art. 6 (1) sentence 1 lit. e GPDR, which allows the processing of
personal data if it is “necessary for the performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller.” Art. 6 sentence 1 lit. e GDPR by itself is not an independent legal basis for the
processing (Recital 45 GDPR). Instead, the processing additionally requires a specific legal basis laid down by the
EU or the EU member state law to which the controller is subject. The relevant legal basis must meet the requirements
of Art. 6 (3) GDPR. Whether such a legal basis exists must be assessed on a case-by-case basis and depends on the
applicable EU member state law. In Germany, for instance, several university laws on the state level include general
provisions that research is one of the primary tasks of universities. Several processing operations that are
conducted for research purposes can be based on these laws in conjunction with the GDPR public interest exemption.
An exemption might, however, apply in cases of particular severe and invasive processing operations that pose greater
risks (e.g., processing operations that would also require a data privacy impact assessment). Such processing
operations might require a legal basis that is more specific and risk-adequate (e.g., consent tailored to the particular
purpose).
(4) Legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR)
The legitimate interest exemption is typically the most practically relevant legal basis. It allows the processing
where it “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except
where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which
require protection of personal data, in particular where the data subject is a child.” Because the legitimate interest
exemption requires weighing of interests, its applicability naturally depends on the individual case and requires taking
into account all relevant factors of the citizen science project, such as the categories and amount of personal data involved,
the importance of the research, the implemented technical and organizational security measures, the data subjects
involved, etc.
The legitimate interest exemption’s main advantage is its
flexibility as the controller has the chance to shift the outcome of the process of weighing of interest in its favor by
implementing additional technical and organizational security measures such as anonymization, pseudonymization, strict
need-to-know requirements, strong IT protection measures, and several other measures depending on the specific case.
However, the applicability of the legitimate interest exemption to one party of the citizen science project does not
necessarily mean that it automatically applies to the processing activities of the other parties as well. For instance,
where the researcher implements certain technical and organizational measures to be able to rely on legitimate
interests to justify its processing activi ties, the same legal basis might not apply for the processing of the data by one
of the other parties which did not implement the same or similar measures. The same applies for the processing for
different purposes. Where one of the parties processes the data for multiple purposes, each processing activity for the
individual purposes must independently be justified. For instance, the service provider might be able to rely on
legitimate interests with regard to its processing activities to conduct organizational and advice services for the other
parties in order to carry out the citizen science project. However, this does not automatically mean that the
legitimate interest exemption also justifies the processing of the same data for the purpose of improving the service
provider’s services for future projects. Thus, the applicability of the legitimate interest exemption needs to be closely
analyzed for each party and each individual purpose.
In cases where the citizen science project meets the requirements of the GDPR scientific research privilege (i.e.,
the research is considered as scientific research within the meaning of the GDPR and the controller has implemented
the measures required by Art. 89 GDPR; see below for details), it is often argued that the requirements of the
legitimate interest exemption willy typically also be met and related data processing operations are therefore justified.
This provides another incentive for the controller to
implement the measures required by Art. 89 GDPR.
bb. Special categories of personal data
If the citizen science project involves special categories of personal data, the requirements for the processing to be
justified are significantly higher. Special categories of personal data are defined by the GDPR as: racial or ethnic
origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the
purpose of uniquely identifying a natural person, data
Legal Aspects of Citizen Science in Video Games Page 14
concerning health, or data concerning a natural person’s sex
l i fe or sexual orientation.
In practice, citizen science projects involving special
categories of personal data will in almost all cases have to be built on consent by the data subject. Next in l ine would be
the scientific research exemption (Art. 9 (2) l it. j GDPR) which, however, requires that the additional conditions of the GDPR
scientific research privilege are met, that is, that the citizen science project is carried out primarily to acquire knowledge
for the general public and excludes commercial purposes. Nevertheless, many citizen science projects in the video
games landscape concern the fight against diseases (with COVID-19 only being the most prominent example). This
makes it worthwhile to also look at other legal bases, such as the substantial public interest and the public interest in the
area of public health exemption.
(1) Explicit Consent (Art. 9 (2) l it. a GDPR)
For the processing of special categories of personal data,
regular consent is not sufficient. Instead, explicit consent must be obtained. Explicit consent first requires that all
conditions of a regular consent as outlined above are met. In addition, the consent given by the data subject must be
“explicit.” Since regular consent already requires a “statement or clear affirmative action ,” explicit consent
requires an even higher standard. The term explicit refers to the way consent is expressed by the data subject. It means
that the data subject must give an express statement of consent (EDPB Guidelines 05/2020 on consent under
regulation 2016/679, p. 20).
Obtaining explicit consent is not bound to formal
requirements. Thus, theoretically explicit consent can also be obtained orally. However, as with regular consent, this is not
recommended due to the controller’s obligation to be able to
demonstrate that the data subject gave consent.
The EDPB discusses the following options to obtain explicit
consent:
written statement, ideally signed by the data subject
fi l l ing in an electronic form
an email sent by the data subject (clearly stating “I consent” or a similar unambiguous declaration)
an upload of a scanned document carrying the signature of the data subject
electronic signature
telephone conversation, provided that the information about the choice is fair, intell igible and clear, and it asks for a specific confirmation from the data subject
(e.g., pressing a button or providing oral confirmation)
explicit consent screen on a website that contains "Yes" and "No" check boxes, provided that the text
clearly indicates the consent, for instance, “I hereby consent to the processing of my data.”
two-stage verification by, for example, sending an email to the data subject to which the data subject must
respond with “I agree”; afterwards, the data subject receives a verification link that must be clicked or an
SMS message with a verification code.
(2) Substantial public interest (Art. 9 (2) l it. g GDPR)
In particular, where the controller is a public body (e.g., a university), the data processing for the citizen science project
can also be based on the exemption of Art. 9 (2) l it. g GDPR, which allows the processing of special categories of personal
data if it is “necessary for reasons of substantial public interest, on the basis of Union or Member State law which
shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for
suitable and specific measures to safeguard the fundamental
rights and the interests of the data subject.”
Unlike the regular public interest exemption provided in Art. 6 (1) sentence 1 lit. e GDPR (see above), Art. 9 (2) l it. g
GDPR requires a substantial public interest. Once again, Art. 9 (2) l it. g GDPR is not a legal basis by itself but instead
serves as an opening clause that allows relevant EU member states and EU laws to be passed. The processing can
subsequently be based on these laws. Whether such a legal basis exists must be analyzed on a case-by-case basis and
depends on the relevant applicable EU member state law, the personal data that is processed, and the purposes for
which it is processed. Germany, for instance, has passed Sec. 22 (1) No. 1 lit. d Federal Data Protection Act (FDPA)
on the basis of Art. 9 (2) l it. g GDPR, which allows the processing of special categories of personal data if the
processing is urgently necessary for reasons of substantial public interests and as far as the interests of the controller in
the data processing outweigh the interests of the data subject. In addition, certain technical and organizational security
measures must be implemented, which are simi lar or identical to those that must be implemented in order to
benefit from the GDPR scientific research privilege (see list
with examples below under II.5.b).
The legislative materials of the German provision explicitly
mention that the fight against pandemics falls under this exemption. Projects l ike Folding@Home to fight COVID-19
(see introductory section) would therefore have a good chance to be based on the substantial public interest
exemption, given the severe consequences of the global
pandemic with regard to both human life and the economy.
(3) Public interest in the area of public health (Art. 9 (2) l it. i
GDPR)
Art. 9 (2) l it. i GDPR allows the processing if it is “necessary
for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health
or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the
basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and
freedoms of the data subject, in particular professional
secrecy.”
Once again, Art. 9 (2) l it. i GDPR itself is not a legal basis but instead allows the adoption of EU or EU member state law
on which basis the processing can subsequently take place. Whether such a legal basis exists depends on the individual
case and the applicable EU member state law. In Germany, for instance, the provision has been implemented into
national law with identical requirements (Sec. 22 (1) No. 1 lit. c FDPA). While the requirements that must be met are very
high, COVID-19 and similar diseases typically constitute a “serious cross-border threat to health.” Thus, any serious
effort to combat such diseases has a good chance of being able to rely on the exemption. However, in order to comply
with the requirement that the implementing law must provide
Legal Aspects of Citizen Science in Video Games Page 15
“specific measures to safeguard the rights and freedoms of the data subject,” the German provision also requires the
implementation of certain technical and organizational security measures. These are largely identical to those
measures that must be implemented to benefit from the
GDPR scientific research privilege (see the list below, II.5.b.).
In addition, the exemption explicitly mentions “in particular
professional secrecy” as a required security measure that must be implemented by the relevant national law provision.
The German provision therefore references sector-specific professional and criminal law secrecy obligations. Since
video game companies wi ll typically not be subject to professional secrecy (such as medical practitioners), this
might render the provision inapplicable for them. However, the wording is not clear with regard to the question of whether
the data cannot be transferred to other parties that are not subject to professional secrecy. Stil l, relying on the provision
if the controller is not subject to any professional secrecy obligations is a risk-based approach. To mitigate the risk,
contractual secrecy obligations should be implemented.
(4) Scientific or historical research purposes (Art. 9 (2) l it. j
GDPR)
After consent, the exemption for scientific or historical research purpose seems to be the most practical relevant
legal basis with regard to special categories of personal data processed in the course of citizen science projects in video
games. It allows the processing of special categories of personal data if it is “necessary for archiving purposes in the
public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR
based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the
right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the
interests of the data subject.”
Again, Art. 9 (2) l it. j GDPR itself is not a legal basis but
instead allows the adoption of EU or EU member state law on which basis the processing can subsequently take place.
Whether such a legal basis exists must be analyzed on a case-by-case basis and depends on the relevant applicable
EU member state law, the personal data that is processed,
and the purposes for which it is processed.
Art. 9 (2) l it. j GDPR is another manifestation of the scientific
research privilege under the GDPR (see above already under II.3.c and below under II.5). Relying on the exemption
therefore requires in exchange the implementation of further safeguards in accordance with Art. 89 (1) GDPR (see a list
with examples below, II.5.b). Furthermore, the scientific research privilege applies only to research that is carried out
to acquire knowledge in the general public interest. Commercial interests are not covered by the privilege to a
large extent (see below II.5.a.). Nevertheless, where the researcher is an EU university or similar research
organization, the research can typically be considered as being carried out to acquire knowledge in the general public
interest. Thus, in this case at least, the researcher might be able to rely on the exemption even if the other parties
involved in the citizen science project (i.e., the service provider and the video game company) might not and must
instead rely on other legal bases. That being said, private organizations are not generally excluded from relying on Art.
9 (2) l it. j GDPR in connection with the relevant EU or EU member state law, provided their activities constitute
scientific research within the meaning of the GDPR (i.e., serve the purposes of acquiring knowledge in the general
public interest) and where they have implemented the
additional requirements of Art. 89 (1) GDPR.
Germany is one of the countries that has already adopted several laws on the basis of Art. 9 (2) l it. j GDPR. Most
notably, Sec. 27 (1) FDPA allows the processing of special categories of personal data “without consent for scientific or
historical research purposes or statistical purposes, if such processing is necessary for these purposes and the interests
of the controller in processing substantially outweigh those of the data subject in not processing the data.” Sec. 22 (2)
FDPA lists a number of safeguards that must be implemented by the controller in accordance with
requirement to implement “appropriate safeguards” under Art. 89 (1) GDPR. Further legal bases implemented by the
German legislator are Sec. 75 (3) Social Act X (“SGB X”) for scientific research in the social sector and Sec. 14 (2a)
Transplantation Act (“TPG”) for organ and tissue transfers.
4. Data transfers within multi-party video game citizen science projects
Since video game citizen science projects are typically multi-party projects, they will naturally require the transfer of personal data from one of the involved parties to another. Furthermore, in many cases, the different parties will not be located in the same country but in
different countries. In this case, the requirements for international data transfers under applicable data protection law must be met and should be closely examined. From a GDPR perspective, it must be differentiated between data transfers to other EU/EEA member states
(respectively, countries that are deemed to provide for an adequate level of data protection by the EU Commission) and third countries. Furthermore, it must be differentiated between controller-to-controller (“C2C”) and controller-to-processor (“C2B”) transfers. The
underlying data transfers in a multi -party scenario can, for instance, be illustrated as follows:
Legal Aspects of Citizen Science in Video Games Page 16
a. Data transfers within the EU/EEA
aa. Controller-to-controller
A data transfer constitutes a processing activity l ike any other (e.g., collection, storing, analysis). Thus, any data transfer
from one party involved in the citizen science project to another must be justified by one of the legal bases set out in
Art. 6 and 9 GDPR. The explanations on appl icable legal bases for the processing of personal data within a video
game citizen science project can therefore be referenced at this point (see above, 3.). Aside from the requirement that the
data transfer must have legal basis, international data transfers within the EU/EEA do not face additional
requirements compared to other processing activities due to the fact that the GDPR establishes a uniform level of
protection within the EU/EEA.
It should be kept in mind, however, that the applicability of
the legal bases also depends on the purpose for which the data is processed. This applies to data transfers as well. For
instance, where the processing for the citizen science project is supposed to be based on legitimate interest, such legal
basis might be applicable for this specific purpose, including data transfers necessary for this purpose. If personal data,
however, is also transferred for another purpose, the legitimate interest exemption might no longer be applicable
or require the implementation of additional safeguards in order to shift the outcome of the process of weighing of
interests in favor of the controller (e.g., pseudonymization). As an example for such a different purpose, once again the
processing of the personal data by the service provider for
purposes of improving its services for future projects can be
named.
bb. Controller-to-processor
The transfer of personal data to a processor and the
processing by the processor can be based on the same legal basis on which the processing by the controller is based. No
additional legal basis is required for the transfer to the processor because the processing activity remains an
activity under the control of the relevant controller and is therefore deemed to be a processing operation by said
controller (e.g., the researcher and/or the video gaming company). Hence, only the controller and not the processor
is required to rely on a legal basis. This becomes relevant, for instance, with regard to the service provider who acts as
processor in terms of the provision of IT services for the implementation and analysis of the video game citizen
science project (see above, II.2.b). However, the processor has to enter into a processing agreement with the controller
(Art. 28 (3) GDPR) and must meet the other requirements applicable to processors (e.g., implementation of technical
and organizational security measures, Art. 28 (1), 32 GDPR). Where one party acts as both processor and controller (l ike
the service provider), it must enter into a processing agreement with regard to its processing activities and must
in addition be able to rely on a legal basis with regard to its
other activities conducted as a controller.
It should also be noted that where the processor engages a sub-processor (e.g., the video gaming company with regard
to potential group affil iates or service providers as il lustrated
Researcher
(e.g., university /
pharma cooperation)
Service provider (provides expertise,
organization and IT services)
C2C and C2P transfer of research data (data
category 4)
Video game
company (entity responsible
for project)
C2
C a
nd
/or C
2P
on
wa
rd tra
nsfe
r of
rese
arc
h d
ata
(da
ta
ca
teg
ory
4)
Other group entities (e.g.
parental company)
Service providers (e.g., cloud
service provider)
Players / citizen
scientists
C2
C a
nd
C2
P tra
nsfe
r
of p
laye
r an
d th
ird p
arty
d
ata
(da
ta c
ate
go
ry 3
an
d/o
r 4)
Legal Aspects of Citizen Science in Video Games Page 17
above), the concluded processing agreement will typically require the processor to establish the same level of data
protection at the sub-processor (Art. 28 (4) GDPR). This can, for instance, require the conclusion of a sub-processing
agreement.
b. Data transfers outside the EU/EEA
International data transfers to non-EU/EEA countries require
compliance with a two-step test.
aa. Step 1
Step 1 is identical to the requirements of data transfers within
the EU/EEA. Any data transfer is a separate processing activity and therefore requires a legal basis under the GDPR.
This applies to third country transfers as well. Thus, the controller must be able to rely on one of the legal bases set
out in Art. 6 and/or 9 GDPR. However, again no additional legal basis is required for data transfers to processors
located in a third country. Still, the requirement to conclude a processing agreement applies accordingly. The same
applies to the requirement that the processor must ensure the same level of data protection at potential sub-processors,
such as by concluding a sub-processing agreement.
bb. Step 2
A controller or processor who transfers data to a controller or
processor located in a third country must ensure that the level of protection of natural persons guaranteed by the
GDPR is not undermined (Art. 44 sentence 2 GDPR). The requirements in this regard are set out in Art. 44 et seq.
GDPR and are described in the following:
(1) Adequacy decision
The easiest way to ensure an adequate level of data
protection is a data transfer based on an adequacy decision by the European Commission (Art. 45 GDPR). Such a
transfer shall not require any specific authorization (Art. 45 (1) sentence 2 GDPR). The European Commission has so
far recognized Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man,
Japan, Jersey, New Zealand, Switzerland and Uruguay as
providing adequate protection.
(2) Appropriate safeguards
If no adequacy decision exists, the most common way to transfer personal data to a third country is based on
appropriate safeguards (Art. 46 GDPR). Art. 46 GDPR provides several options to implement appropriate
safeguards (Art. 46 (2) GDPR) with the by far most practicably relevant tool being standard data protection
clauses adopted by the EU Commission (Art 46 (2) l it. c GDPR - also called EU model clauses), followed by binding
corporate rules (Art. 46 (2) l it. b, Art. 47 GDPR).
Standard data protection clauses exist for C2C and C2P data transfers to third countries. Establishing an adequate level of
data protection through standard data protection clauses essentially means that the data importer contractually
accepts certain data protection standards, including the implementation of technical and organizational security
measures.
With regard to C2P transfers, the C2P model clauses are
typically supplemented by a couple of clauses to also meet
the requirements of a processing agreement under the
GDPR (Art. 28 (3) GDPR) and/or applicable local law.
Multinational companies often implement C2C and C2P
clauses by means of an all -in-one data transfer agreement that comprises all or several of the entities belonging to the
group of companies. In this case the C2C and C2P model clauses are integrated into one intragroup data transfer
agreement. Deviations to comply with applicable local data protection laws are implemented through a specific local law
amendments section. This section can also include countries that are not subject to the GDPR to implement a global data
protection setup through a single compliance vehicle.
Parties to the video game citizen science project that already
have implemented intragroup C2C and/or C2P model clauses need to consider that these agreements might have
to be amended to reflect additional personal data and processing purposes under the citizen science projects. In
some cases, however, the conclusion of a new data transfer agreement to cover the citizen science project may be the
more practical solution.
(3) Derogations for specific situations, in particular consent
In the absence of an adequacy decision or of appropriate
safeguards, international data transfers to third countries can also take place on one of the conditions set out in Art. 49
GDPR. With regard to a citizen science project, the most practically relevant exemption seems to be consent (Art. 49
(1) sentence 1 lit. a GDPR). Other exemptions (e.g., important reasons of public interest) will most l ikely only
apply in exceptional cases, with the fight against COVID-19 of course being something that could be considered. In
relation to the processing of player data by the video game company for the purposes of the citizen science project (data
categories 1 and 2), the performance of a contract exemption can also be considered, provided the citizen science project
is seemingly integrated into the video game or constitutes the entire game (see the explanations in this regard under
II.3.d.aa.(1)(a)(bb)).
In terms of consent, all requirements for regular consent must be met (see in detail above II.3.d.aa.(1)). This includes
prior information on the data controller’s identity, the purpose of the transfer, the type of data, the existence of the right to
withdraw consent, and the identity or the categories of recipients (EDPB Guidelines 02/2018 on derogations of
Article 49 under Regulation 2016/679, p. 7). In addition, the information provided to the data subjects should also specify
all data recipients or categories of recipients, all countries to which the personal data are being transferred to, that the
consent is the legal basis for the transfer, and that the third country to which the data will be transferred does not provide
for an adequate level of data protection based on a European Commission decision (EDPB Guidelines 02/2018 on
derogations of Article 49 under Regulation 2016/679, p. 8).
Since consent must be specific, it is sometimes impossible
to obtain the data subject’s prior consent for a future transfer at the time of the collection of the data, such as if the
occurrence and specific circumstances of a transfer are not known at the time consent is requested, the impact on the
data subject cannot be assessed (EDPB Guidelines 02/2018 on derogations of Article 49 under Regulation 2016/679, p.
7). The Working Party 29 provides the following example:
Legal Aspects of Citizen Science in Video Games Page 18
To cite an example, a company, when obtaining i ts customers’ data for a specific purpose,
cannot ask them to give their prior consent to the transfer of their data to a third country if that
transfer is not envisaged at the time of the
collection.
Furthermore, the consent exemption for international data
transfers requires explicit consent. Thus, the same conditions with regard to consent for the processing of
special categories of data must be met (see above II.3.d.bb.(1)). Additionally, consent for the legitimization of
international data transfers to third countries requires information of the possible risks of such transfers for the data
subject due to the absence of an adequacy decision and appropriate safeguards. Such notice, which could be
standardized, should include, for example, information that in the third country there might not be a supervisory authority
and/or data processing principles, and/or data subject rights might not be provided for in the third country (EDPB
Guidelines 02/2018 on derogations of Article 49 under
Regulation 2016/679, p. 8).
As outlined above, consent should be the last option to legitimize the processing activities of the citizen science
project. This also applies to data transfers to third countries. The Article 29 Working Party has indicated that consent for
data transfers that occur periodically or on an ongoing basis is inappropriate (Working Paper 114, p. 11). Thus, even in
situations where consent might be used to legitimize the processing for the citizen science project (step 1), it should
only be used to legitimize the third country data transfer (step 2) in exceptional cases and where no other option is
available. However, with regard to data category 4, consent is l ikely the preferable option to legitimize the international
data transfer as otherwise players of the video game would have to agree to EU model clauses, which is not a realistic
option as it might deter too many potential participants.
cc. Examples
Scenario 1: The researcher is located in Switzerland,
the service provider is located in Switzerland, and the video game company is located in the EU/EEA, with
sub-processors in the EU/EEA and the USA. Players are located all over the world. All referenced data
categories (1-4) refer to the categories as described
above (II.1).
High level analysis:
o Data transfers from the researcher to the service provider (data category 4) will l ikely fall under
Swiss data protection law and must meet the relevant requirements (in practice this would
need to be analyzed more closely).
o Data transfers from the researcher to the video game company (data category 4) will l ikely fall
under Swiss data protection law and must meet the relevant requirements (in practice this would
need to be analyzed more closely).
o Data transfers from the video game company to the researcher (data category 1 to 3) constitute
a C2C international data transfer to a (non-EU/EEA) third country and must therefore meet
the two-step test. Thus, the transfer requires a legal basis under the GDPR (step 1) and must
meet the additional requirements for
international transfers to third countries (step 2). Step 1 could be based on legitimate interest or
consent (in case of the latter only provided the information requirements were met when the
consent was obtained). Step 2 is not an issue in this case as Switzerland is subject to an
adequacy decision of the EU Commission.
o Data transfers from the video game company to the service provider (data category 1 to 3) might
constitute both: (i) a C2C international data transfer to a (non-EU/EEA) third country (with
regard to advice and organization provided by the service provider); and (ii) a C2P international
data transfer to a (non-EU/EEA) third country (with regard to the provision of IT services by the
service prover). Both transfers must also meet the two-step test. The explanations outlined in
the last bullet point apply accordingly. However, the transfer additionally requires the conclusion
of a processing agreement with regard to the C2P transfer.
o Data transfers from the video game company to
sub-processors within the EU/EEA require a legal basis. However, the transfer can be based
on the same basis the processing for the citizen science project is based on, such as legitimate
interest or consent (provided information requirements were met). Additionally, the
conclusion of a processing agreement is required. Step 2 is not required as the GDPR
provides a uniform standard of protection within the EU/EEA.
o Data transfers from the video game company to
sub-processors in the USA constitute a C2P international data transfer to a third country and
must therefore meet the two-step test. Step 1 could be based on legitimate interest or consent
(provided information requirements were met). Step 2 could be solved through the US sub-
processor entering into C2P model clauses. Also, a processing agreement complying with the
requirements of Art. 28 (3) GDPR is required, which can be solved with supplements to the
C2P model clauses. The model clauses can be added to the processing agreement.
o Data transfers from the video game company to
the players (data category 4) constitute a C2P international data transfer to a third country and
must therefore also meet the two-step test. Step 1 could be based on legitimate interests or
consent (provided information requirements were met). Step 2 could theoretically also be
solved through the player entering into C2P model clauses, which could be integrated into
the video game. However, given that this will l ikely result in too many participants being
deterred, full anonymization of the data would be preferable to render the GDPR inapplicable as a
whole. Otherwise, consent obtained when data category 4 is collected is l ikely the best option to
meet the requirements of Step 2.
Scenario 2: The researcher is located in the EU/EEA, the service provider is located in Switzerland, the video game company who is primarily organizing the citizen
science project is located in Canada, with a parent
Legal Aspects of Citizen Science in Video Games Page 19
company in the USA. Players are located all over the world. All referenced data categories (1-4) refer to the
categories as described above (II.1).
High level analysis:
o Data transfers from the researcher to the service
provider (data category 4) might constitute both: (i) a C2C international data transfer to a (non-
EU/EEA) third country (with regard to advice and organization provided by the service provider);
and (ii) a C2P international data transfer to a (non-EU/EEA) third country (with regard to the
provision of IT services by the service provider). Both transfers must meet the two-step test. Thus,
the transfer requires a legal basis under the GDPR (step 1) and must meet the additional
requirements for international transfers to third countries (step 2). Step 1 could be based on
legitimate interest or consent (provided information requirements were met). Step 2 is
not an issue as Switzerland is subject to an adequacy decision of the EU Commission.
However, the transfer additionally requires the conclusion of a processing agreement with
regard to the C2P transfer.
o Data transfers from the researcher to the video game company (data category 4) constitute a
C2C international data transfer to a third country and must meet the two-step test. Step 1 could
be based on legitimate interest or consent (provided information requirements were met).
Step 2 is not an issue as Canada is also subject to an adequacy decision of the EU Commission.
o Despite the video game company not being
located in the EU/EAA, data transfers from the video game company to the researcher (data
category 1 to 3) are subject to the GDPR, provided player data from players within the
EU/EEA region are involved (Art. 3 (2) l it. a GDPR). The transfer constitutes a C2C data
transfer to the EU/EEA region. As such, it requires a legal basis under the GDPR. However,
the transfer can be based on the same basis the processing for the citizen science project is
based on, such as legitimate interest or consent (provided information requirements were met).
Step 2 is not required as the data is transferred to the EU/EEA area that provides a uniform
standard of data protection.
o Data transfers from the video game company to the service provider (data category 1 to 3) are
also subject to the GDPR, provided player data from players within the EU/EEA region are
involved (Art. 3 (2) l it. a GDPR). The transfer might constitute both: (i) a C2C international
data transfer to a (non-EU/EEA) third country (with regard to advice and organization provided
by the service provider); and (ii) a C2P international data transfer to a (non-EU/EEA)
third country (with regard to the provision of IT services by the service prover). Both transfers
must meet the two-step test. Step 1 could be based on legitimate interest or consent (in case
of the latter only provided the information requirements were met when the consent was
obtained). Step 2 is not an issue in this case as
Switzerland is subject to an adequacy decision of the EU Commission. However, the transfer
additionally requires the conclusion of a processing agreement with regard to the C2P
transfer.
o Data transfers from the video game company to its parent company within the USA are more
difficult to assess as they will strongly depend on the individual case. Depending on the scenario
and the data category, data could (from a GDPR perspective) be transferred by the US parent
company to the Canadian affiliate or vice versa. Player data (data category 1 and 2) from
persons located in the EU that is collected by the US entity and then transferred to the Canadian
affi l iate sti ll requires a legal basis (step 1) from a GDPR perspective due to the market place
principle set out in Art. 3 (2) l it. a GDPR. However, the transfer can likely be based on the
same legal basis on which the data was originally collected. Step 2 is not an issue as
Canada is subject to an EU Commission adequacy decision. Additionally, the data
transfer must be assessed from a US data
protection law perspective.
With regard to the Canadian entity it must be
closely assessed whether a data transfer to the US entity takes place at all and – if yes – whether
the GDPR applies in this case. For instance, it is unlikely that the Canadian affi l iate transfers
player data (data category 1 and 2) to the US parent company. The parent company will l ikely
collect and process such data by itself. With regard to data provided by the researcher (data
category 4) the data could – from a mere legal perspective – constitute a transfer from the
Canadian entity to the US entity as the Canadian entity is the primary organizer of the citizen
science project. However, with regard to this transfer the GDPR might not apply as the market
place principle set out in Art. 3 (2) l it. a GDPR does not apply since the processing activity is
not related to the offering of goods or services (this only applies to the provision of the video
game). Because Canada is subject to an EU Commission adequacy decision and data can be
transferred without further safeguards, GDPR requirements with regard to onward transfers will
also not result from other sources such as EU model clauses, which typically require that the
same level of data protection be established in case of any onward transfers. The outcome
might of course be different if the affi liate was located in a country that is not subject to an EU
Commission adequacy decision. In this case, an onward transfer agreement might have to be
concluded.
o As regards the players, see last example.
5. Requirements and benefits of the GDPR scientific research
privilege
As briefly outlined above, the GDPR includes a scientific research privilege that allows derogating from several GDPR
data protection rules, provided that: (i) the research constitutes scientific research within the meaning of the
GDPR; and (ii) the requirements of Art. 89 (1) GDPR are met,
Legal Aspects of Citizen Science in Video Games Page 20
which means the implementation of “appropriate safeguards.” Art. 89 (1) GDPR follows the purpose to balance the
fundamental right to freedom of research with the fundamental right to data protection. It does so by stipulating
that in the exchange for the implementation of certain “appropriate safeguards,” the researcher may enjoy different
privileges/derogations from applicable data protection rules (although this might not become apparent immediately from
reading the wording of Art. 89 (1) GDPR). Where the requirements of Art. 89 (1) GDPR are not met (i.e., adequate
safeguards are not implemented) the standard rules under the GDPR apply. Thus, conducting the research project is
sti l l possible without relying on the GDPR scientific research privilege. The only consequence is that the processing for the
purpose of the project does not benefit from the scientific
research privilege.
a. Scientific research within the meaning of the GDPR
To constitute scientific research within the meaning of the GDPR, research must serve general public interests. This
includes in particular that the research is independent and not subject to instructions. The interest in knowledge must be
the primary driver. This does not exclude privately financed research (see Recital 159 sentence 2 GDPR). However,
external influence on the knowledge process through instructions is excluded, so are mere economic or other
interests. Thus, scientific research that only serves the purpose to develop new products is excluded from the
scientific research privilege. As outlined above, this does not mean that the research project cannot take place at all. It only
means that the scientific research privilege is not applicable and the processing must be evaluated in l ight of the standard
rules under the GDPR.
However, the research project is not necessarily excluded from the GDPR scientific research privilege if it is privately
financed by a third party that has an interest in the research and sets out the parameters for the subject that shall be
researched, provided of course that the requirements of scientific research under the GDPR are met, that is, the then
conducted research takes place independently and without
influence on the outcome.
An example could be a corporation financing a research project of a university and setting out certain parameters that
it would like to have investigated (e.g., the temperature, location, study group). As long as the subsequent research
takes place independently and is in the general public interest, the GDPR scientific research privilege can still be
used even if the financing corporation later plans to use the findings of the (independent) study for the development of
new products. The purpose of the independency and public interest requirement is only to prevent interest-driven
research from benefitting from the GDPR research privilege (e.g., research that is supposed to show that smoking does
not cause health issues).
b. Appropriate safeguards
To benefit from the scientific research privilege under the
GDPR, the researcher must implement “appropriate safeguards” for the rights and freedoms of the data subject
(Art. 89 (1) sentence 1 GDPR). Those safeguards shall ensure that technical and organizational measures are in
place in order to ensure respect for the principle of data minimization (Art. 89 (1) sentence 2 GDPR). The measures
may include pseudonymization, provided the purpose can be fulfi l led in that manner (Art. 89 (1) sentence 3). As the term
“appropriate safeguards” implies, the requirement
establishes a flexible standard. Thus, the level and standard of the implemented safeguards must be determined in light
of the risks of the data processing. Aside from pseudonymization, other measures that could be
implemented are as follows:
data encryption (Art. 32 (1) l it. a GDPR)
the ability to ensure the ongoing confidentiality,
integrity, availability and resil ience of processing systems and services (Art. 32 (1) l it. b GDPR)
the ability to restore the availability and access to personal data in a timely manner in the event of a
physical or technical incident (Art. 32 (1) l it. c GDPR)
a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of
the processing (Art. 32 (1) l it. d GDPR)
organizational measures, for instance restrictions on access to personal data within the controller and by
processors
measures to ensure that it is subsequently possible to verify and establish whether and by whom personal data were input, altered or removed
measures to increase awareness of staff involved in processing operations
designation and inclusion of a data protection officer
specific rules of procedure to ensure compliance with applicable data protection law in the event of transfer
or processing for other purposes
c. Benefits of the scientific research privilege
Provided appropriate safeguards as outlined above have
been implemented based on the risk of the processing, the GDPR scientific research privilege allows for a number of
derogations from applicable data protection rules. However, some of the privileges require additional measures to be
implemented (aside from the general “appropriate safeguard” requirement) in order to benefit from them, or they stipulate
that certain measures are mandatory.
aa. Exemption from the principle of purpose limitation for further
processing
All personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner
that is incompatible with those purposes (principle of purpose limitation, Art. 5 (1) l it. a part 1 GDPR). A subsequent change
of the purpose is only allowed under the strict requirements of Art. 6 (4) GDPR (which also applies to special categories
of personal data, cf. Art. 6 (4) l it. c GDPR). However, with regard to archiving purposes in the public interest, scientific
or historical research purposes, or statistical purposes, the further processing shall not be considered to be incompatible
with the initial purpose (Art. 5 (1) l it. a part 2 GDPR). Thus, under the GDPR scientific research privilege, it is assumed
that the further processing for scientific purposes with regard to personal data that was initially collected for other purposes
is generally in l ine with the initial purpose.
Legal Aspects of Citizen Science in Video Games Page 21
bb. Exemption from the principle of storage limitation
All personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary
for the purposes for which the personal data is processed (principle of storage limitation, Art. 5 (1) l it. e part 1 GDPR).
However, personal data may be stored for longer periods insofar as the personal data will be processed solely for
archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in
accordance with Article 89 (1) GDPR, subject to implementation of the appropriate technical and
organizational measures in order to safeguard the rights and
freedoms of the data subject (Art. 5 (1) l it. e part 2 GDPR).
cc. Exemption from Art. 14 GDPR information obligations
Art. 14 (1) GDPR stipulates that where personal data have not been obtained from the data subject, the controller shall
provide the data subject with certain information. However, Art. 14 (5) l it. b sentence 1 GDPR includes an exemption in
case “the provision of such information proves impossible or would involve a disproportionate effort.” With regard to
scientific research purposes, it is assumed that the requirements of the exemption are met (Art. 14 (5) l it. b
sentence 1 part 2 GDPR). This exemption becomes relevant in particular where third parties collect personal data only
incidentally, such as where the player is asked to take photos in certain locations that might include bystanders or l icense
plates (see data category 3 as described above). However, the controller shall take appropriate measures to protect the
data subject’s rights and freedoms and legitimate interests, including making the information publicly available (Art. 14 (5)
l it. b sentence 2 GDPR). Thus, the controller is sti l l entitled to provide the information pursuant to Art. 14 (1) GDPR but
could, for instance, do so by adding the information to the
website of the video game.
dd. Exemption from the right to erasure (Art. 17 GDPR)
Pursuant to Art. 17 (1) GDPR, the data subject shall have the right to obtain from the controller the erasure of personal data
concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without
undue delay where certain criteria apply. However, Art. 17 (3) l it. d GDPR provides an exemption for archiving purposes in
the public interest, scientific or historical research purposes, or statistical purposes in so far as the right to erasure is l ikely
to render impossible or seriously impair the achievement of
the objectives of that processing.
ee. Exemption from the right to object (Art. 21 GDPR)
According to Art. 21 (1) GDPR, the data subject generally has the right to object, on grounds relating to his or her
particular situation, at any time to processing of personal data concerning him or her that is based either on public
interests (Art. 6 (1) sentence 1 lit. e GDPR) or legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR). However, with
regard to data processing for scientific or historical research purposes or statistical purposes, the right to object is not
included in the general rule of Art. 21 (1) GDPR but in Art. 21 (6) GDPR, which stipulates that the data subject, on grounds
relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or
her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. While the
specific right to object with regard to scientific or historical research purposes or statistical purposes requires the
controller to demonstrate that “the processing is necessary
for the performance of a task carried out for reasons of public interest,” it does not require to showcase that “compelling
legitimate grounds for the processing which override the interests, rights and freedoms of the data subject” exist, as it
is required by the general rule under Art. 21 (1) sentence 2 GDPR. Demonstrating that “the processing is necessary for
the performance of a task carried out for reasons of public interest” only requires a prima facie evidence because the
processing for scientific research is a privileged purpose under the GDPR. Thus, it can generally (but not necessarily
in any case) be assumed that the processing serves public purposes. However, this does not release the controller from
the obligation of being able to substantially demonstrate that
the processing takes place for scientific research.
Note that the GDPR includes another exemption from the
right to object on the basis of EU member state law. Such exemption goes beyond what is included in Art. 21 (6) GDPR
(see next section).
ff. Exemption from the right to access, rectifi cation, restriction
and object, pursuant to Art. 15, 16, 18 and 21 GDPR on the
basis of EU member state law
Art. 89 (2) GDPR provides that where personal data is
processed for scientific or historical research purposes or statistical purposes, EU or EU member state law may provide
for derogations from the right to access, rectification, restriction and object pursuant to Art. 15, 16, 18 and 21
GDPR. Thus, unlike other privileges granted under the GDPR scientific research privilege (e.g., exemption from the
right to erasure, see above), an exemption from the data subject rights included in Art. 15, 16, 18 and 21 GDPR does
not only require that: (i) the research constitutes scientific research within the meaning of the GDPR; and (i i)
appropriate safeguards are in place, but additionally that (iii) the relevant EU member state has made use of the
exemption provided in Art. 89 (2) GDPR and implemented a derogation from Art. 15, 16, 18 and 21 GDPR; and (iv) the
requirements of such national law exemption are met. Whether this is the case depends on the relevant EU
member state.
Germany, for instance, has made use of the Art. 89 (2)
exemption with Sec. 27 (2) FDPA, which provides that the rights of data subjects provided in Art. 15, 16, 18 and 21
GDPR shall be limited to the extent that these rights are likely to render impossible or seriously impair the achievement of
the research or statistical purposes, and such limits are necessary for the fulfi lment of the research or statistical
purposes. Further, the right of access according to Art. 15 GDPR shall not apply if the data are necessary for purposes
of scientific research and the provision of information would
involve disproportionate effort.
gg. Exemption for special categories of personal data
Art. 9 (2) l it. j GDPR provides that the prohibition to process special categories of personal data does not apply if the
processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or
statistical purposes in accordance with Article 89(1) GDPR based on EU or EU member state law, which shall be
proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific
measures to safeguard the fundamental rights and the interests of the data subject. Thus, similar to the exemption
from the data subject rights included in Art. 15, 16, 18 and 21 GDPR (see above), the exemption for the processing of
special categories of personal data does not only require that:
Legal Aspects of Citizen Science in Video Games Page 22
(i) the research constitutes scientific research within the meaning of the GDPR; and (i i) appropriate safeguards are in
place but additionally that (i i i) the processing must be “necessary” to achieve the relevant purpose ; (iv) the relevant
EU member state has made use of the exemption provided in Art. 9 l it. j (2) GDPR and implemented a legal basis for the
processing of special categories of personal data for scientific research (and other in-scope) purposes; and (v) the
requirements of such national law exemption are met.
Again, Germany is an example of an EU member state that has made use of the Art. 9 (2) lit. j GDPR exemption with Sec.
27 (1) FDPA, which provides that the processing of special categories of personal data shall be permitted without
consent, for scientific or historical research purposes or statistical purposes, if such processing is necessary for these
purposes and the interests of the controller in processing substantially outweigh those of the data subject in not
processing the data. Furthermore, the controller shall take appropriate and specific measures to safeguard the interests
of the data subject. Thus, the German law repeats most of the requirements that are already set out under the GDPR.
The only additional requirement is that “the interests of the controller in processing substantially outweigh those of the
data subject in not processing the data.”
hh. Broad consent
Although only mentioned in the recitals (33), the “broad
consent” exemption can be considered as another exemption under the GDPR scientific research privilege. "Broad
consent" allows the controller to obtain consent for certain “areas of research or parts of research projects” instead of
for specific purposes and without the necessity to obtain a new consent for each data use for other sci entific research
purposes. Thus, “broad consent” constitutes a derogation from the requirement that consent must be given for “one or
more specific purposes.” The “broad consent” exemption was already discussed in the consent section above (under
II.3.d.aa.(1)(b)).
ii. Application of legitimate interest exemption is more likely
The fact that the GDPR scientific research privilege applies
does not automatically mean that all processing activities conducted in l ine with the research project are justified. The
processing stil l requires a legal basis pursuant to Art. 6 and/or 9 GDPR. However, with regard to the legal basis of
legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR), the implementation of appropriate safeguards together with the
fact that scientific research in the general public interest is privileged under the GDPR provides a strong argument that
the processing can be based on such exemption.
III. Copyright law (high-lev el comments)
Questions related to copyright law arise in particular where citizen
scientists are asked to execute some form of creative activity. An example could be citizen scientists taking pictures with a mobile
camera all around the world with the picture subsequently being
used by the researcher or the video game company for the project.
With regard to copyright law, it must be differentiated between whether the work created by the citizen scientist will : (i) only be
used internally (e.g., to improve the video game companies’ AR mechanism); (i i) be commercially exploited by one of the parties to
the citizen science project; or (i i i) be made available for use by the general public (e.g., if the research carried out is conducted in the
general public interest, such as for the creation of a free publicly
accessible database for scientific purposes).
In the case of (i) and (ii), the relevant party that intends to use or exploit the work created by the citizen scientists should ensure that
it acquires sufficient rights from the citizen scientists to use/exploit the created works in all required ways and territories. In many
scenarios, it might be sufficient to add the required language to the terms and conditions of the video game. However, in some
jurisdictions (e.g., Germany) certain clauses can be considered as unenforceable in case they are regarded as being surprising for the
consumer. Whether this is the case depends on the individual circumstance. Stil l, a reasonable gamer might not expect that a
picture he or she takes within the course of a normal video game might later be commercially exploited. In such case, a more
prominent message might be required.
With regard to (i i i), the use of Creative Commons (CC) l icenses provides an adequate solution to obtain rights in order to enable
the general public the use of all created works. Using CC licenses is often referred to as bringing a work “into the public domain.”
However, this is legally not always correct as in some jurisdictions (e.g., Germany, France and Austria), copyright owners cannot
waive their copyright. In these jurisdictions, CC licenses typically have the copyright owner grant a far-reaching license (to the extent
allowed by local law). Different levels of CC licenses and for different jurisdictions exist. Which license is appropriate for the
relevant project should be analyzed depending on the individual
case and the involved territories.
Theatinerstrasse 23 Munich 80333 Germany
Sebastian Schwiddessen Senior Associate EMEA Key Contact Video Games Sebastian.Schwiddessen@bakermckenzie.com +49 89 5 52 38 119
top related