I have a player who has asked that ‘his results don’t go to the IFPA’.
How is it best to handle this without impacting too much on the other players results, and keeping his wishes?
Options I can see are:
1 Just completely remove him from the results and everyone below him would get bumped up a place.
2 Submit the results with him in, but replacing his name with “Supressed Player” or Anonymous
3 Have him request to be a supressed player to the IFPA, and the software would then remove his details from the results at point of publication of the results
3 may not be an option depending on his willingness to remove himself by sending an email. As a TD would I be able to request him to be supressed? (If so I could be sending a number of emails if people p!$$ me off )
As TD, email the IFPA and tell them to suppress this player. I’ve done it, it’s easy.
From then on, you submit the actual name of the player. They’ll always show up as suppressed, and will contribute properly to the value of future events. Plus, they can unsuppress at any time, and it’s as if it never happened.
In order for players to be credited for their activity against this “Suppressed Player”, they must be included in the results submitted to the IFPA (if our rules dictate that they are eligible to be included).
The only way you can ‘legally’ remove them from the results is if:
They don’t participate in at least 50% of the qualifying portion of the event.
If the event is in the US/Canada, the TD has offered a player-opt-out for the $1 endorsement fee, and the player has opted to not be included.
Outside of that they have to be.
Your option #3 is the ‘best path’. We would ask you send the request to Suppress the player along with copying in that player on the email. I would then respond with acknowledging the suppression. If you were trying to suppress someone that didn’t want to be suppressed, surely I would get an email from that player shortly thereafter letting me know you were up to no good
This seems as good a place as any to just mention that us Euro citizens will soon fall under GDPR data protection.
Just checking you IFPA guys at least have this on your radar!? I’d suggest it probably impacts how you should treat suppressed players ‘behind the scenes’.
Getting into the technicalities, one way to handle it might be to securely hash the suppressed players name. That would anonymise the data, but still allow the player to be uniquely identified.
As a website that tracks existing results of tournaments, the only information we have on any player is that their name is included on the standings of an existing event. For suppressed players their name is of course hidden from public display.
There’s no other data to be found that’s attached to that player even on the back end of our system.
I’m pretty sure that simply hiding the data from view is insufficient under the GDPR, due to the “Right to Erasure”. There are a few exceptions (accounting records, legal discovery, scientific/historical archiving, and likely others), but by and large data has to be deleted, not simply darkened. This probably means that there needs to be some level “beyond” suppressed, where anything that reaches beyond what you might get away with calling “historical archiving” actually gets deleted.
IANALTINLA
This may be an overly simplistic solution and assumes some of the IFPA database architecture, but starting with a player record identified by a unique primary key (let’s assume IFPA number) then any attached records (say, tournament results) should then be associated to that PK only and no other tables should contain personally-identifiable information.
A player to be suppressed under this scheme can be handled by a flag on the user record, and a player wishing erasure can simply have all personally identifiable columns blanked without affecting any historical data associations like tournament results or rankings.
You’d then update all frontend code to handle the possibility of a player record with no name/country/whatever. Ranking and rating would probably still work. There’s also the upshot of letting said player continue to play by providing his/her IFPA number at tournaments, with the knowledge that any personally-identifiable information is not associated in IFPA’s database.
PII as we use the term in the US doesn’t go anywhere near covering all the data the GDPR expects you to properly handle. Under the GDPR, personal data is defined as “any information relating to an identified or identifiable natural person.”
The gist is you can’t just strip the identifiers from the information, you actually have to discard the information if you no longer have an authorized or legally required use for it.
How will online newspapers handle this when they go to report news that includes the names of people?
If Raymond Davidson wins the World Championship, can we not report that on our site by displaying the results . . . but the Chicago Tribune can report those results on their website?
I feel bad for anyone that doesn’t wish to be included in the box scores of sporting events if this is the way it shakes out.
4 Any player not wanting their data captured enters under a pseudonym. Creating a new pseudonym for every comp they enter. (It’ll certainly show a growth in number of unique players for the IFPA)
5 Have a disclaimer in the published rules and regs for every comp stating something along the lines of " The results of this comp WILL be submitted to the IFPA and results recorded. For further details visit the IFPA website."
6 Anyone asking to have their results removed should be told to STFU
)
