GDPR : What are the implications for LMS systems ?

Discuss anything you like about chess related matters in this forum.
Roger de Coverly
Posts: 16578
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Wed Feb 21, 2018 11:28 am

Gerry_Jepps wrote:
Wed Feb 21, 2018 11:18 am
I don't expect the ECF office to fill in the missing data if the date of birth is absent (even if they know it, which they may very well not).
Apart from new players, FIDE and thus the ECF Office will know the date of birth. One of the possible consequences of the new legislation is that even where data such as date of birth is essential, it will need to be kept under lock and key. So if systems need to be amended not to ask for date of birth where it's already known, that's going to be one of the changes.

With the GPDR just being a UK implementation of an EU Directive, such consequences will apply to FIDE for all the EU states, unless the UK has chosen a uniquely stringent rule set.

Gerry_Jepps
Posts: 49
Joined: Thu Jun 26, 2008 4:45 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Gerry_Jepps » Wed Feb 21, 2018 11:49 am

Roger de Coverley wrote:
Apart from new players, FIDE and thus the ECF Office will know the date of birth.
Certainly true for English players, but do FIDE tell the ECF of the dates of birth of all non-English players?

The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
b) If so, is the ECF office willing and able in every case to fill in the missing data?

I believe the answers to a) and b) are "yes" and "no" respectively. In which case organisers need to know the dates of birth. However, if the answer to a) is "no" (or, much less likely, the answer to b) is "yes") can someone who knows please say so.

Roger de Coverly
Posts: 16578
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Wed Feb 21, 2018 12:26 pm

Gerry_Jepps wrote:
Wed Feb 21, 2018 11:49 am
The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
You would hope that it would only check for date of birth as part of the creation of the record for a new player. Given that the rating systems used to operate without requiring date of birth, that might be the expected system design.

Mick Norris
Posts: 6661
Joined: Tue Apr 17, 2007 10:12 am
Location: Bolton, Greater Manchester
Contact:

Re: GDPR : What are the implications for LMS systems ?

Post by Mick Norris » Wed Feb 21, 2018 2:19 pm

Eversheds have quite a bit of info on the GDPR
Any postings on here represent my personal views and should not be taken as representative of the Manchester Chess Federation www.manchesterchess.co.uk

Michael Flatt
Posts: 1193
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Wed Feb 21, 2018 2:30 pm

Roger de Coverly wrote:
Wed Feb 21, 2018 12:26 pm
Gerry_Jepps wrote:
Wed Feb 21, 2018 11:49 am
The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
You would hope that it would only check for date of birth as part of the creation of the record for a new player. Given that the rating systems used to operate without requiring date of birth, that might be the expected system design.
For FIDE events/rating submission the FIN is sufficient identification.

I've never had any rating submissions refused for not completing the date-of-birth data field.

David Sedgwick
Posts: 2923
Joined: Mon Apr 09, 2007 5:56 pm
Location: Croydon

Re: GDPR : What are the implications for LMS systems ?

Post by David Sedgwick » Wed Feb 21, 2018 3:27 pm

Gerry_Jepps wrote:
Wed Feb 21, 2018 11:49 am
Roger de Coverley [sic] wrote.
David Sedgewick [sic} wrote something earlier.

A FIDE rating file will be accepted with an incorrectly spelt name if it has a correct FIN


Moving on to your questions:
Apart from new players, FIDE and thus the ECF Office will know the date of birth.

Certainly true for English players, but do FIDE tell the ECF of the dates of birth of all non-English players?

The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
b) If so, is the ECF office willing and able in every case to fill in the missing data?

I believe the answers to a) and b) are "yes" and "no" respectively. In which case organisers need to know the dates of birth. However, if the answer to a) is "no" (or, much less likely, the answer to b) is "yes") can someone who knows please say so.

A FIDE rating file without a date of birth for a player will be accepted if the player's FIN is included.

If a player does not have a FIN, the file will not be accepted if the player is not ENG (for English events).

If an ENG player does not have a FIN, an ENG FIN will be created automatically for the player if the date of birth is quoted. Alternatively, a FIN can be created separately by entering the player's name and date of birth onto the FIDE Ratings Server.

If you don't know the date of birth, the only thing yoyu can do is make one up. Obviously this is rather undesirable.

If a file is rejected for any reason, the ECF Office are understandably cautious about trying to correct it themselves. Normally they will forward the error message to the organiser for his / her attention.

Gerry_Jepps
Posts: 49
Joined: Thu Jun 26, 2008 4:45 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Gerry_Jepps » Wed Feb 21, 2018 5:55 pm

David Sedgwick wrote:
A FIDE rating file without a date of birth for a player will be accepted if the player's FIN is included.
Thank you David. That is a helpful clarification.

It would be helpful if someone at the ECF could produce a relatively short guide to FIDE rating files spelling out what other deviations from the strict formal FIDE specification for rating files are acceptable. For example, the date of birth format specified by FIDE differs from that used for ECF grading files, which is a pain if it is really necessary. (Is it?) Bit off the original GDPR topic.

David Sedgwick
Posts: 2923
Joined: Mon Apr 09, 2007 5:56 pm
Location: Croydon

Re: GDPR : What are the implications for LMS systems ?

Post by David Sedgwick » Wed Feb 21, 2018 7:58 pm

Gerry_Jepps wrote:
Wed Feb 21, 2018 5:55 pm
David Sedgwick wrote:
A FIDE rating file without a date of birth for a player will be accepted if the player's FIN is included.
Thank you David. That is a helpful clarification.

It would be helpful if someone at the ECF could produce a relatively short guide to FIDE rating files spelling out what other deviations from the strict formal FIDE specification for rating files are acceptable. For example, the date of birth format specified by FIDE differs from that used for ECF grading files, which is a pain if it is really necessary. (Is it?) Bit off the original GDPR topic.
I am not familiar with the techicalities of ECF grading.

However, the date of birth in a FIDE rating file, if required at all, must be in the prescribed format.

Roger de Coverly
Posts: 16578
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Wed Feb 21, 2018 11:33 pm

David Sedgwick wrote:
Wed Feb 21, 2018 7:58 pm
However, the date of birth in a FIDE rating file, if required at all, must be in the prescribed format.
I thought the ECF had a conversion program, so that if an organiser is using one of the programs that does pairings by FIDE rules and produces FIDE compatible rating files, that same file can be used as input to the ECF grading system. As far as I am aware, the ECF data validation is happy not to expect date of birth to be repeated.

Alex Holowczak
Posts: 8228
Joined: Sat May 30, 2009 5:18 pm
Location: Oldbury, Worcestershire
Contact:

Re: GDPR : What are the implications for LMS systems ?

Post by Alex Holowczak » Thu Feb 22, 2018 12:22 pm

Roger de Coverly wrote:
Wed Feb 21, 2018 11:33 pm
David Sedgwick wrote:
Wed Feb 21, 2018 7:58 pm
However, the date of birth in a FIDE rating file, if required at all, must be in the prescribed format.
I thought the ECF had a conversion program, so that if an organiser is using one of the programs that does pairings by FIDE rules and produces FIDE compatible rating files, that same file can be used as input to the ECF grading system. As far as I am aware, the ECF data validation is happy not to expect date of birth to be repeated.
Half right.

The ECF Checker can convert a FIDE-rating file into an ECF-grading file that you can then submit. But that's not the end of the story; there are a number of things you then have to add to the file:
- Header data (e.g. the Treasurer's name and e-mail, the Grader's name and e-mail)
- It won't add the grading references unless you get the name spot on (e.g. it won't add the reference for De Coverly, Roger; you need the initial FIDE rating file to say De Coverly, Roger D. So you need to add those.
- You need to add club codes or geographic codes for new players, which FIDE has no interest in.
- You need to add all the new FINs you might have just created; a good organiser will send in the rating file first and ask for the new FINs to come back so they can put them in the grading file, which in turn makes the job of grading the event easier in future.
- You might want to add the Sex of the player, which for whatever reason doesn't get transferred across from the FIDE-rating file.

Generating a FIDE-rating file normally takes me about 1 minute for a typical weekend congress. It takes me about half an hour to do an equivalent set of ECF-grading files.

If the date of birth was in the FIDE-rating file, then it will get transferred across to the ECF-grading file without incident.

Paul McKeown
Posts: 3124
Joined: Thu Apr 12, 2007 3:01 pm
Location: Hayes (Middx)
Contact:

Re: GDPR : What are the implications for LMS systems ?

Post by Paul McKeown » Thu Feb 22, 2018 1:52 pm

Speaking for Richmond Juniors, I find this whole topic something of a looming legal liability, which makes me rather nervous. Potentially it might, should the authorities require it, need considerable administrative infrastructure and overhead to be compliant, infrastructure that small chess organisations are not well set up to cater for.

I would be happiest if the ECF took all handling of personal information for the purposes of membership registrations, grading, FIDE registration entirely out of the hands of tournament organisers. In that case, we would require only an ECF grading code and either a current ECF membership number or a FIDE IN, as an identifier, and a secure means to access a database to confirm the identifier as valid.

I understand that that would mean that we would be unable to take entries from non-members, but that would not cause lost sleep.

Michael Flatt
Posts: 1193
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Tue Mar 06, 2018 11:17 am

I would recommend that anyone responsible for an organisation's data should consult the guidance given on the Information Commissioner's Office (ICO) website.

It shouldn't be too difficult to comply if already familiar with the current Data Protection Legislation and the 'eight steps'. It is about accepting responsibilty for correct management of personal data.

1. ICO website: https://ico.org.uk/
2. Introduction to the data protection bill: https://ico.org.uk/media/for-organisati ... n-bill.pdf
3. Preparing for the GDPR. 12 steps: https://ico.org.uk/media/1624219/prepar ... -steps.pdf

David Gilbert
Posts: 701
Joined: Sat Apr 04, 2009 10:03 am

Re: GDPR : What are the implications for LMS systems ?

Post by David Gilbert » Tue Apr 03, 2018 7:01 pm

The ECF's long anticipated guidance on GDPR is now available.

https://www.englishchess.org.uk/data-protection/

To get their houses in order, action appears to be needed by club secretaries, team captains, league secretaries, website managers, congress organisers, and broadly anyone who collects names and contact details. Looks to me that some congress entry forms that are already on the streets may not be compliant, although I don't suppose the Information Commissioner's Office will be issuing €20 million fines at this juncture.

Anyway this should keep us all busy leading to implementation 25 May 2018.

Alex Holowczak
Posts: 8228
Joined: Sat May 30, 2009 5:18 pm
Location: Oldbury, Worcestershire
Contact:

Re: GDPR : What are the implications for LMS systems ?

Post by Alex Holowczak » Tue Apr 03, 2018 9:57 pm

David Gilbert wrote:
Tue Apr 03, 2018 7:01 pm
The ECF's long anticipated guidance on GDPR is now available.

https://www.englishchess.org.uk/data-protection/

To get their houses in order, action appears to be needed by club secretaries, team captains, league secretaries, website managers, congress organisers, and broadly anyone who collects names and contact details. Looks to me that some congress entry forms that are already on the streets may not be compliant, although I don't suppose the Information Commissioner's Office will be issuing €20 million fines at this juncture.

Anyway this should keep us all busy leading to implementation 25 May 2018.
Organisations may also find it useful to see what I wrote in respect of the British Championship: https://www.britishchesschampionships.c ... ns-2018/2/

I wrote it from scratch, and I don't claim to be a lawyer or have any expertise in the field, but it might be useful as a template for organisations to use.

Roger de Coverly
Posts: 16578
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Tue Apr 03, 2018 10:17 pm

Alex Holowczak wrote:
Tue Apr 03, 2018 9:57 pm
I wrote it from scratch, and I don't claim to be a lawyer or have any expertise in the field, but it might be useful as a template for organisations to use.
I don't think the ECF should ask for date of birth when it already knows what it is by virtue of a player quoting a grading code reference.

Post Reply