Page 4 of 5

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 11:28 am
by Roger de Coverly
Gerry_Jepps wrote:
Wed Feb 21, 2018 11:18 am
I don't expect the ECF office to fill in the missing data if the date of birth is absent (even if they know it, which they may very well not).
Apart from new players, FIDE and thus the ECF Office will know the date of birth. One of the possible consequences of the new legislation is that even where data such as date of birth is essential, it will need to be kept under lock and key. So if systems need to be amended not to ask for date of birth where it's already known, that's going to be one of the changes.

With the GPDR just being a UK implementation of an EU Directive, such consequences will apply to FIDE for all the EU states, unless the UK has chosen a uniquely stringent rule set.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 11:49 am
by Gerry_Jepps
Roger de Coverley wrote:
Apart from new players, FIDE and thus the ECF Office will know the date of birth.
Certainly true for English players, but do FIDE tell the ECF of the dates of birth of all non-English players?

The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
b) If so, is the ECF office willing and able in every case to fill in the missing data?

I believe the answers to a) and b) are "yes" and "no" respectively. In which case organisers need to know the dates of birth. However, if the answer to a) is "no" (or, much less likely, the answer to b) is "yes") can someone who knows please say so.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 12:26 pm
by Roger de Coverly
Gerry_Jepps wrote:
Wed Feb 21, 2018 11:49 am
The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
You would hope that it would only check for date of birth as part of the creation of the record for a new player. Given that the rating systems used to operate without requiring date of birth, that might be the expected system design.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 2:19 pm
by Mick Norris
Eversheds have quite a bit of info on the GDPR

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 2:30 pm
by Michael Flatt
Roger de Coverly wrote:
Wed Feb 21, 2018 12:26 pm
Gerry_Jepps wrote:
Wed Feb 21, 2018 11:49 am
The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
You would hope that it would only check for date of birth as part of the creation of the record for a new player. Given that the rating systems used to operate without requiring date of birth, that might be the expected system design.
For FIDE events/rating submission the FIN is sufficient identification.

I've never had any rating submissions refused for not completing the date-of-birth data field.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 3:27 pm
by David Sedgwick
Gerry_Jepps wrote:
Wed Feb 21, 2018 11:49 am
Roger de Coverley [sic] wrote.
David Sedgewick [sic} wrote something earlier.

A FIDE rating file will be accepted with an incorrectly spelt name if it has a correct FIN


Moving on to your questions:
Apart from new players, FIDE and thus the ECF Office will know the date of birth.

Certainly true for English players, but do FIDE tell the ECF of the dates of birth of all non-English players?

The point I was trying to make can be summarised as follows:
a) Will FIDE processing automatically reject a results file if the date of birth data field is omitted or empty?
b) If so, is the ECF office willing and able in every case to fill in the missing data?

I believe the answers to a) and b) are "yes" and "no" respectively. In which case organisers need to know the dates of birth. However, if the answer to a) is "no" (or, much less likely, the answer to b) is "yes") can someone who knows please say so.

A FIDE rating file without a date of birth for a player will be accepted if the player's FIN is included.

If a player does not have a FIN, the file will not be accepted if the player is not ENG (for English events).

If an ENG player does not have a FIN, an ENG FIN will be created automatically for the player if the date of birth is quoted. Alternatively, a FIN can be created separately by entering the player's name and date of birth onto the FIDE Ratings Server.

If you don't know the date of birth, the only thing yoyu can do is make one up. Obviously this is rather undesirable.

If a file is rejected for any reason, the ECF Office are understandably cautious about trying to correct it themselves. Normally they will forward the error message to the organiser for his / her attention.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 5:55 pm
by Gerry_Jepps
David Sedgwick wrote:
A FIDE rating file without a date of birth for a player will be accepted if the player's FIN is included.
Thank you David. That is a helpful clarification.

It would be helpful if someone at the ECF could produce a relatively short guide to FIDE rating files spelling out what other deviations from the strict formal FIDE specification for rating files are acceptable. For example, the date of birth format specified by FIDE differs from that used for ECF grading files, which is a pain if it is really necessary. (Is it?) Bit off the original GDPR topic.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 7:58 pm
by David Sedgwick
Gerry_Jepps wrote:
Wed Feb 21, 2018 5:55 pm
David Sedgwick wrote:
A FIDE rating file without a date of birth for a player will be accepted if the player's FIN is included.
Thank you David. That is a helpful clarification.

It would be helpful if someone at the ECF could produce a relatively short guide to FIDE rating files spelling out what other deviations from the strict formal FIDE specification for rating files are acceptable. For example, the date of birth format specified by FIDE differs from that used for ECF grading files, which is a pain if it is really necessary. (Is it?) Bit off the original GDPR topic.
I am not familiar with the techicalities of ECF grading.

However, the date of birth in a FIDE rating file, if required at all, must be in the prescribed format.

Re: GDPR : What are the implications for LMS systems ?

Posted: Wed Feb 21, 2018 11:33 pm
by Roger de Coverly
David Sedgwick wrote:
Wed Feb 21, 2018 7:58 pm
However, the date of birth in a FIDE rating file, if required at all, must be in the prescribed format.
I thought the ECF had a conversion program, so that if an organiser is using one of the programs that does pairings by FIDE rules and produces FIDE compatible rating files, that same file can be used as input to the ECF grading system. As far as I am aware, the ECF data validation is happy not to expect date of birth to be repeated.

Re: GDPR : What are the implications for LMS systems ?

Posted: Thu Feb 22, 2018 12:22 pm
by Alex Holowczak
Roger de Coverly wrote:
Wed Feb 21, 2018 11:33 pm
David Sedgwick wrote:
Wed Feb 21, 2018 7:58 pm
However, the date of birth in a FIDE rating file, if required at all, must be in the prescribed format.
I thought the ECF had a conversion program, so that if an organiser is using one of the programs that does pairings by FIDE rules and produces FIDE compatible rating files, that same file can be used as input to the ECF grading system. As far as I am aware, the ECF data validation is happy not to expect date of birth to be repeated.
Half right.

The ECF Checker can convert a FIDE-rating file into an ECF-grading file that you can then submit. But that's not the end of the story; there are a number of things you then have to add to the file:
- Header data (e.g. the Treasurer's name and e-mail, the Grader's name and e-mail)
- It won't add the grading references unless you get the name spot on (e.g. it won't add the reference for De Coverly, Roger; you need the initial FIDE rating file to say De Coverly, Roger D. So you need to add those.
- You need to add club codes or geographic codes for new players, which FIDE has no interest in.
- You need to add all the new FINs you might have just created; a good organiser will send in the rating file first and ask for the new FINs to come back so they can put them in the grading file, which in turn makes the job of grading the event easier in future.
- You might want to add the Sex of the player, which for whatever reason doesn't get transferred across from the FIDE-rating file.

Generating a FIDE-rating file normally takes me about 1 minute for a typical weekend congress. It takes me about half an hour to do an equivalent set of ECF-grading files.

If the date of birth was in the FIDE-rating file, then it will get transferred across to the ECF-grading file without incident.

Re: GDPR : What are the implications for LMS systems ?

Posted: Thu Feb 22, 2018 1:52 pm
by Paul McKeown
Speaking for Richmond Juniors, I find this whole topic something of a looming legal liability, which makes me rather nervous. Potentially it might, should the authorities require it, need considerable administrative infrastructure and overhead to be compliant, infrastructure that small chess organisations are not well set up to cater for.

I would be happiest if the ECF took all handling of personal information for the purposes of membership registrations, grading, FIDE registration entirely out of the hands of tournament organisers. In that case, we would require only an ECF grading code and either a current ECF membership number or a FIDE IN, as an identifier, and a secure means to access a database to confirm the identifier as valid.

I understand that that would mean that we would be unable to take entries from non-members, but that would not cause lost sleep.

Re: GDPR : What are the implications for LMS systems ?

Posted: Tue Mar 06, 2018 11:17 am
by Michael Flatt
I would recommend that anyone responsible for an organisation's data should consult the guidance given on the Information Commissioner's Office (ICO) website.

It shouldn't be too difficult to comply if already familiar with the current Data Protection Legislation and the 'eight steps'. It is about accepting responsibilty for correct management of personal data.

1. ICO website: https://ico.org.uk/
2. Introduction to the data protection bill: https://ico.org.uk/media/for-organisati ... n-bill.pdf
3. Preparing for the GDPR. 12 steps: https://ico.org.uk/media/1624219/prepar ... -steps.pdf

Re: GDPR : What are the implications for LMS systems ?

Posted: Tue Apr 03, 2018 7:01 pm
by David Gilbert
The ECF's long anticipated guidance on GDPR is now available.

https://www.englishchess.org.uk/data-protection/

To get their houses in order, action appears to be needed by club secretaries, team captains, league secretaries, website managers, congress organisers, and broadly anyone who collects names and contact details. Looks to me that some congress entry forms that are already on the streets may not be compliant, although I don't suppose the Information Commissioner's Office will be issuing €20 million fines at this juncture.

Anyway this should keep us all busy leading to implementation 25 May 2018.

Re: GDPR : What are the implications for LMS systems ?

Posted: Tue Apr 03, 2018 9:57 pm
by Alex Holowczak
David Gilbert wrote:
Tue Apr 03, 2018 7:01 pm
The ECF's long anticipated guidance on GDPR is now available.

https://www.englishchess.org.uk/data-protection/

To get their houses in order, action appears to be needed by club secretaries, team captains, league secretaries, website managers, congress organisers, and broadly anyone who collects names and contact details. Looks to me that some congress entry forms that are already on the streets may not be compliant, although I don't suppose the Information Commissioner's Office will be issuing €20 million fines at this juncture.

Anyway this should keep us all busy leading to implementation 25 May 2018.
Organisations may also find it useful to see what I wrote in respect of the British Championship: https://www.britishchesschampionships.c ... ns-2018/2/

I wrote it from scratch, and I don't claim to be a lawyer or have any expertise in the field, but it might be useful as a template for organisations to use.

Re: GDPR : What are the implications for LMS systems ?

Posted: Tue Apr 03, 2018 10:17 pm
by Roger de Coverly
Alex Holowczak wrote:
Tue Apr 03, 2018 9:57 pm
I wrote it from scratch, and I don't claim to be a lawyer or have any expertise in the field, but it might be useful as a template for organisations to use.
I don't think the ECF should ask for date of birth when it already knows what it is by virtue of a player quoting a grading code reference.