The fundamental root of the GDPR, a necessary requirement for it to apply is simply:
From the GDPR directly:
“‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
See Definitions, also from the GDPR:
Roblox has not provided the one missing element which is not surprising due to Roblox’s history with transparency (or lack of).
We as developers retain the right to maintain our Robux purchase logs and references as these are required for proper accounting and tax purposes. Simply put, the source of where Robux come from on a payout is equally as important as the payout itself and Roblox does not have the right to remove our tax data.
This makes how Roblox is handling their own handling of GDPR very relevant to us and IF due to lack of transparency they force us into a position that violated GDPR I will 100% guarantee you the end result will be them defending themselves in court and ultimately being liable.
You see IF Roblox deletes corresponding information then our data can no longer be deemed identifying as it was only ever identifying via proxy through Roblox if at all. We as developers do not handle identifying information ourselves. A datastore reference to a player ID that no longer exists and represents Nil is not personally identifying information if it cannot be linked to a tangible person.
Now if Roblox is exercising some right such as accounting to retain that information and somehow that is required in order to identify transactions in their system, that’s important to us.
However I will say I’m not going to operate on assumption. I’ve actually submitted a request for clarification to the GDPR myself as I have no faith that Roblox is even capable of properly legally translating this information and it’s requirements let alone if they would properly relay it to developers.
When I obtain clarification myself, I assure you I will share what I discover.
I have spent many years of my life working in data security as well as business law. I know exactly what I need to ask to get proper legal clarification and if it came to it I would subpoena missing legally required information from Roblox if I have to.
Most of us have learned through leaked information the kinds of data Roblox’s back end system keeps on people. What we haven’t learned is how Roblox handles the link between the player and the internal player ID.
Speculation beyond that is pointless and any claims that this information is known is nothing more than speculation.
The smart legal choice for Roblox would be to delete all information from the user account and only keep their financial records necessary for accounting.
IF that is what they are indeed doing, our information is not personally identifying.
IF through HTTP service a developer is collecting additional information, including certain analytics data, social media account information, etc. that is a whole different subject.
Datastore references to a Roblox ID however should not be identifying unless Roblox is doing something very wrong.
The way their business model operates, if they are legally retaining identifying information under any grounds that can link to that player ID they are also legally obligated to provide that information to us so that we ourselves can evaluate our legal position.
Thus far to my knowledge, this has not happened.
Edit: I would like to add that if you are collecting information through 3rd party sources such as http services you have more to worry about than Right-to-be-Forgotten requests. You need to ensure the data you are keeping and how it is being stored comply with GDPR as well. If you’re not prepared to do this then you have no business running a game that stores such information.
You’re not even protected if you are a minor nor are you through ignorance. Your parents or legal guardians would simply bare the burden of liability for violations.
On that note, Roblox really should have long since put out notifications towards such and should be clarifying Roblox’s terms of service and what is allowed through such services to reflect the current law.
Edit #2: Regardless of any of this, especially if required to maintain the integrity of a datastore system. The option to pseudonymize the player ID would also exist. Absolute worst case you could replace the player ID # with a fictitious alias that wouldn’t break the datastore.
I would also make sure player names are not stored, those could be identifying.
Some random progress within your game is not identifying.
The player ID # is most likely not, though I don’t think Roblox provides enough information to determine this in regards to how they handle their end, which is far more important than ours.
User names are too risky, people often re-use those and have that linked to other outlets.
(even though this is dicey and not necessarily a guarantee).
Something to note, even a person’s name, as given in the example in GDPR publications such as “John Smith” may not necessarily be considered identifying as there are may John Smiths out there.
The question exists in the “when combined with other information”. Could the fact that they play on Roblox be used? That’s a big? but not one I’d risk.
So “IF” player ID’s are even at question, which I sincerely doubt, pseudonymizing them would eliminate any threat or risk as there is no question at all that whatever remains could never be linked to a natural person.
So just replace all datastore references with 000000’s or something safe of that nature if you’re uncertain.
Last edit then I’m done:
Depending on how Roblox handles their end, which assuming since they seek to go public it’s fairly certain they are trying to become fully compliant themselves, then it’s entirely possible the ID reference could not be considered identifying information (as mentioned, I’m seeking legal clarification on this).
In the unique scenario of how our systems work in conjunction with Roblox’s, if we pseudonymize the ID and keep no record of what the original one was, no one, not even Roblox themselves would ever be able to link that information and therefore it could never in any way meet the requirements to be able to be used to identify a natural person.
You would “probably”, and I say probably because there’s some unknown factors, be safe even with a player ID but would 100% be safe pseudonymizing or deleting it.
That said, we are legally allowed to require Roblox to verify the identity within our limitations and us requiring Roblox to tell us the game in which said data is connected to, the player ID, and any relevant information we may need to ensure it’s removed properly.
By operating as a proxy link, Roblox has just as much requirement to provide us necessary information as the player is required to provide Roblox. I would suggest holding them to that any time you have any concerns.
Roblox, helpful update.