GDPR : What are the implications for LMS systems ?

Discuss anything you like about chess related matters in this forum.
User avatar
John Upham
Posts: 7179
Joined: Wed Apr 04, 2007 10:29 am
Location: Cove, Hampshire, England.

Re: GDPR : What are the implications for LMS systems ?

Post by John Upham » Wed Feb 14, 2018 6:54 pm

Nick Grey wrote:
Wed Feb 14, 2018 5:54 pm
Just choose the right one after a legal process.
What sort of legal process would you favour ?

I ask this since you declared that you know "a whole lot more" or words to that effect.
British Chess News : britishchessnews.com
Twitter: @BritishChess
Facebook: facebook.com/groups/britishchess :D

Nick Grey
Posts: 1838
Joined: Thu Dec 01, 2011 12:16 am

Re: GDPR : What are the implications for LMS systems ?

Post by Nick Grey » Wed Feb 14, 2018 9:50 pm

Try not to mix the phrases up John with their context.

I worked for a Council that was the leading light on tendering services for 20 years, spent a lot of time on governance arrangements and constitution and implementing EU directives. Childrens' Services too.

I'm very much in favour of the suggestion of a tender for a single LMS as proposed as part of what ECF want to achieve on national grading. That is legal process. And ought to lead to savings.

I am working in a joint-up local authorities service and we have to follow the laws.

Have a bit more diversity of very old , new, females, males, children and ethnic diversity, physical diversity, etc on the photos on the front pages on your sites, which I know you have in your photos, and I will be a bit more comfortable in the current climate on these matters, every time I look at them or input.

Michael Flatt
Posts: 1235
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Wed Feb 14, 2018 10:17 pm

Today, all graders received a communication from the ECF Grading Team regarding some planned developments.

The current system in which individual graders are supplied with individuals' dates of birth held on a Master Grading Database has been identified as an area of concern since it involves widespread sharing of sensitive personal data.

How the submission of results is to change has yet to be agreed.

John Foley
Posts: 369
Joined: Thu Oct 15, 2009 9:58 am
Location: Kingston-upon-Thames

Re: GDPR : What are the implications for LMS systems ?

Post by John Foley » Thu Feb 15, 2018 10:57 am

This discussion reminds me of a proposal that I made some years ago on this Forum.
The UK Driving Licence hides the DOB by mixing up the numbers in a standard way.
We can have a chess-specific encoding method for dates of chess players.
We can disguise people's dates of birth so that it is not so easy to decode, except by chess players.
Chess encoding of DOBs

Michael Flatt
Posts: 1235
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Thu Feb 15, 2018 12:26 pm

As suggested earlier in the thread, it might be simpler to record just the year of birth rather than the full date.

Age restricted competitions (under11, over-60, etc) would then need to align with calendar years (1st january) rather than academic years (1st September) as is International practice (i.e. FIDE).

Roger de Coverly
Posts: 21301
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Tue Feb 20, 2018 10:04 pm

Michael Flatt wrote:
Wed Feb 14, 2018 10:17 pm
The current system in which individual graders are supplied with individuals' dates of birth held on a Master Grading Database has been identified as an area of concern since it involves widespread sharing of sensitive personal data.
Earlier today, I entered my next few tournaments. I was struck that they all asked for a date of birth. I don't think that's necessary as both the ECF and FIDE know what it is and for identification, the ECF grading code and FIDE's FIN should suffice. The ECF and FIDE can flag players as Seniors or Veterans without organisers needing to ask for dates of birth for established players.

Michael Flatt
Posts: 1235
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Tue Feb 20, 2018 10:38 pm

Roger de Coverly wrote:
Tue Feb 20, 2018 10:04 pm
Michael Flatt wrote:
Wed Feb 14, 2018 10:17 pm
The current system in which individual graders are supplied with individuals' dates of birth held on a Master Grading Database has been identified as an area of concern since it involves widespread sharing of sensitive personal data.
Earlier today, I entered my next few tournaments. I was struck that they all asked for a date of birth. I don't think that's necessary as both the ECF and FIDE know what it is and for identification, the ECF grading code and FIDE's FIN should suffice. The ECF and FIDE can flag players as Seniors or Veterans without organisers needing to ask for dates of birth for established players.
I don't think that most organisers are aware of data protection legislation and, you are correct, in that most players have their Date-of-Birth recorded on the ECF or FIDE database. As Roger has pointed out organisers shouldn't be requesting and storing data that they don't need. Being guilty myself, I'll see if I can modify the St Albans Online Entry form without wrecking it.

The other concern is the practice of 'harvesting' email address from various chess sites and sending messages (i.e spam) since the recipients wouldn't have agreed to receive them.

Nick Grey
Posts: 1838
Joined: Thu Dec 01, 2011 12:16 am

Re: GDPR : What are the implications for LMS systems ?

Post by Nick Grey » Wed Feb 21, 2018 12:17 am

It is important to help ECF out with this as they have asked. I'm going through our club ungraded list. There are a few that I know have been deceased a long time ago. Others that have left saying they never will play competitive chess again and have not. Some if they are still alive will be 100.
It seems strange that it is missing one noticeable person, and I know that the club secretary at that time was fantastic in doing this with manual records.

The name is CJ.

David Sedgwick
Posts: 5249
Joined: Mon Apr 09, 2007 5:56 pm
Location: Croydon

Re: GDPR : What are the implications for LMS systems ?

Post by David Sedgwick » Wed Feb 21, 2018 9:46 am

Roger de Coverly wrote:
Tue Feb 20, 2018 10:04 pm
Earlier today, I entered my next few tournaments. I was struck that they all asked for a date of birth. I don't think that's necessary as both the ECF and FIDE know what it is and for identification, the ECF grading code and FIDE's FIN should suffice. The ECF and FIDE can flag players as Seniors or Veterans without organisers needing to ask for dates of birth for established players.
Michael Flatt wrote:
Tue Feb 20, 2018 10:38 pm
I don't think that most organisers are aware of data protection legislation and, you are correct, in that most players have their Date-of-Birth recorded on the ECF or FIDE database. As Roger has pointed out organisers shouldn't be requesting and storing data that they don't need. Being guilty myself, I'll see if I can modify the St Albans Online Entry form without wrecking it.
The problem is that many players don't know their ECF grading code or their FIN and may leave those boxes blank on an entry form. If you ask for the Date of Birth as well, you can identify the player nevertheless.

With online entry and compulsory fields, you can of course solve this. As Michael indicates, you can ask for Dates of Birth only for players who don't have a FIN or don't know what it is.

Roger de Coverly
Posts: 21301
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Wed Feb 21, 2018 10:28 am

David Sedgwick wrote:
Wed Feb 21, 2018 9:46 am
If you ask for the Date of Birth as well, you can identify the player nevertheless.
If you've quoted grading code and FIN there's no need to quote Date of Birth. Unless there's a grader on the control team, tournament organisers shouldn't have access to date of birth, so would have to rely on address, club or quoted grade/rating if identity had to be clarified.

It's a hope it never happens, but despite occasionally large prizes, chess tournaments have so far escaped the attention of those who write money laundering regulations.

Gerry_Jepps
Posts: 49
Joined: Thu Jun 26, 2008 4:45 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Gerry_Jepps » Wed Feb 21, 2018 10:35 am

David Sedgewick wrote:
With online entry and compulsory fields, you can of course solve this. As Michael indicates, you can ask for Dates of Birth only for players who don't have a FIN or don't know what it is.
A FIDE rating submission file has a mandatory data field for date of birth. If this field is left blank would the file still be processed? If, as I believe is the case, a file with this omission would be rejected, organisers need to know a player's date of birth whether or not they already have a FIN.

Michael Flatt
Posts: 1235
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Wed Feb 21, 2018 10:46 am

Gerry_Jepps wrote:
Wed Feb 21, 2018 10:35 am
David Sedgewick wrote:
A FIDE rating submission file has a mandatory data field for date of birth. If this field is left blank would the file still be processed? If, as I believe is the case, a file with this omission would be rejected, organisers need to know a player's date of birth whether or not they already have a FIN.
I believe a date of birth is only required when registering a new player.

To enter a FIDE rated tournament you must provide a FIN, and that is only available by registration with FIDE via one's national federation (i.e. the ECF for 'English' players).

Roger de Coverly
Posts: 21301
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Wed Feb 21, 2018 10:54 am

Michael Flatt wrote:
Wed Feb 21, 2018 10:46 am
I believe a date of birth is only required when registering a new player.
Is it still the case that all rating files can only reach FIDE via the ECF office?

Michael Flatt
Posts: 1235
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Wed Feb 21, 2018 11:01 am

Roger de Coverly wrote:
Wed Feb 21, 2018 10:54 am
Michael Flatt wrote:
Wed Feb 21, 2018 10:46 am
I believe a date of birth is only required when registering a new player.
Is it still the case that all rating files can only reach FIDE via the ECF office?
Yes. The ECF acts as an intermediary between the grader and FIDE. Any grading files I have submitted have always gone through the ECF. Not that I do many.

Gerry_Jepps
Posts: 49
Joined: Thu Jun 26, 2008 4:45 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Gerry_Jepps » Wed Feb 21, 2018 11:18 am

Michael Flatt wrote:
The ECF acts as an intermediary between the grader and FIDE.
Yes, that is true. However, the report data file format that FIDE stipulates contains a data field for date of birth. I don't expect the ECF office to fill in the missing data if the date of birth is absent (even if they know it, which they may very well not). So the organiser needs to know the date of birth if the tournament is to be FIDE-rated.