GDPR : What are the implications for LMS systems ?

Discuss anything you like about chess related matters in this forum.
Alex Holowczak
Posts: 9085
Joined: Sat May 30, 2009 5:18 pm
Location: Oldbury, Worcestershire

Re: GDPR : What are the implications for LMS systems ?

Post by Alex Holowczak » Tue Apr 03, 2018 10:25 pm

Roger de Coverly wrote:
Tue Apr 03, 2018 10:17 pm
Alex Holowczak wrote:
Tue Apr 03, 2018 9:57 pm
I wrote it from scratch, and I don't claim to be a lawyer or have any expertise in the field, but it might be useful as a template for organisations to use.
I don't think the ECF should ask for date of birth when it already knows what it is by virtue of a player quoting a grading code reference.
There's a false assumption there: That having a grading code means the ECF has a record of the date of birth. There are a number of league submissions, for example, that don't submit date of birth information, because they don't collect it.

Roger de Coverly
Posts: 21301
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Tue Apr 03, 2018 11:00 pm

Alex Holowczak wrote:
Tue Apr 03, 2018 10:25 pm
There's a false assumption there: That having a grading code means the ECF has a record of the date of birth. There are a number of league submissions, for example, that don't submit date of birth information, because they don't collect it.
How difficult can it be to check the grading code against the grading data and only ask for date of birth when it isn't known? You could even not do this and trust the entrant to notify the ECF of the date of birth only when it hasn't already been disclosed.

Nick Grey
Posts: 1838
Joined: Thu Dec 01, 2011 12:16 am

Re: GDPR : What are the implications for LMS systems ?

Post by Nick Grey » Tue Apr 17, 2018 11:35 pm

I think ECF & some systems, and clubs are going OTT on this. Basically, I'm going for'
removal of my e-mail address removal of birth year/and dob, removal of my home address and old home address (I'm shocked on chess leaflets coming in the post there) removal of my phone numbers. Clubs and tournament records too.

I also believe that in the real world they will go after large authorities, organisations, companies and even the press especially where they are misreporting where there are public inquiries and criminal prosecutions first.

Ought to stop selling electoral information especially where always said no

Paul Buswell
Posts: 427
Joined: Sun Jul 06, 2008 4:56 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Paul Buswell » Wed Apr 18, 2018 11:23 am

Roger de Coverly wrote:
Tue Apr 03, 2018 11:00 pm
Alex Holowczak wrote:
Tue Apr 03, 2018 10:25 pm
There's a false assumption there: That having a grading code means the ECF has a record of the date of birth. There are a number of league submissions, for example, that don't submit date of birth information, because they don't collect it.
How difficult can it be to check the grading code against the grading data and only ask for date of birth when it isn't known? You could even not do this and trust the entrant to notify the ECF of the date of birth only when it hasn't already been disclosed.
Why is date of birth necessary? Surely it goes against the principle that data should only be collected to the extent that it is necessary or serves a useful purpose?

A small bugbear of mine is the occasional congress entry form that says date of birth 'must' be given. Why? If there is an age-related prize I can give my dob if I wish to compete for it, but otherwise why? Especially as I always give my grading code which is all that is needed.

I usually annotate such requests on the entry form 'refused', and no congress has yet returned my entry and fee.

PB

Roger de Coverly
Posts: 21301
Joined: Tue Apr 15, 2008 2:51 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Roger de Coverly » Wed Apr 18, 2018 11:36 am

Paul Buswell wrote:
Wed Apr 18, 2018 11:23 am
Why is date of birth necessary? Surely it goes against the principle that data should only be collected to the extent that it is necessary or serves a useful purpose?
Age related prizes (obviously) as well as player identification. The ECF uses age as part of its grading calculations for junior players.

How players named "Danny Wright" are there? The year of birth indicated on the FIDE site suggests another one as well as one of the leading English players in the years 1967-1976.

Paul Buswell wrote:
Wed Apr 18, 2018 11:23 am
I usually annotate such requests on the entry form 'refused', and no congress has yet returned my entry and fee.
Easy enough to do if a paper form, less easy if using on-line entry and it's been made a compulsory field.

There are various explanations by Congress organisers up thread as to why they've got into the habit of asking for DoB even when not needed. A lack of clarity or understanding of the minimum data required by grading and rating systems may not help.

An indicator on the grading page that the date of birth/age was known to the ECF might help Congress organisers avoid asking for unnecessary data.

Kevin Thurlow
Posts: 5821
Joined: Wed Apr 30, 2008 12:28 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Kevin Thurlow » Wed Apr 18, 2018 8:43 pm

"Easy enough to do if a paper form, less easy if using on-line entry and it's been made a compulsory field."

You could invent one.

David Gilbert
Posts: 962
Joined: Sat Apr 04, 2009 10:03 am

Re: GDPR : What are the implications for LMS systems ?

Post by David Gilbert » Sat May 26, 2018 9:13 am

To give this a little more publicity, the ECF has helpfully produced a template for Clubs to use to develop their own privacy notice. It can be downloaded from the link beneath:

https://www.englishchess.org.uk/ecf-privacy-notice/#cps

It might be particularly useful for Clubs with their own websites wondering what to do. Congress organisers might also be able to use it as a starting-point for their needs too.

Mike Truran
Posts: 2393
Joined: Wed Apr 11, 2007 3:44 pm

Re: GDPR : What are the implications for LMS systems ?

Post by Mike Truran » Sat May 26, 2018 9:47 am

More precisely, it's the Word document at the bottom of the page.

Michael Flatt
Posts: 1235
Joined: Tue Jul 02, 2013 7:36 am
Location: Hertfordshire

Re: GDPR : What are the implications for LMS systems ?

Post by Michael Flatt » Sat May 26, 2018 10:10 am

David Gilbert wrote:
Sat May 26, 2018 9:13 am
To give this a little more publicity, the ECF has helpfully produced a template for Clubs to use to develop their own privacy notice. It can be downloaded from the link beneath:

https://www.englishchess.org.uk/ecf-privacy-notice/#cps

It might be particularly useful for Clubs with their own websites wondering what to do. Congress organisers might also be able to use it as a starting-point for their needs too.
It seems only to have appeared on the 24th May (the day before the legislation comes into effect) which is rather too late for most clubs who will have had to come up with something themselves. Nevertheless, it will allow clubs the opportunity to compare their policies against a standard template. The reference to Article 13 is particularly useful.

In our club there was a great deal of misunderstanding over the legal basis of collecting data; some arguing for explicit consent from all data subjects and not willing to accept the 'legitimate interest' argument.