[sanst]

blackshoe, on 2018-June-08, 16:54, said:

Probably. But I'm not in the EU, so I don't care.

Maybe you should.

Quote

As the legal form of the GDPR is that of an EU regulation, the Ministry of Justice and Public Security has proposed that it should be incorporated into Norwegian law via a reference clause (c.f. EØS-notat, 24 March 2017). In effect, this means that a clause in the main text of the law will incorporate the GDPR into Norwegian law, with the GDPR text being then reproduced as an appendix to such law.

[pran]

gordontd, on 2018-June-09, 01:19, said:

I don't see why, as long as you are clear that it is done and give the data subjects access to their record to correct if necessary. It strikes me as coming under "legitimate interests" for an organisation running a competitive mind sport.

weejonnie, on 2018-June-09, 02:19, said:

That is my 1st impression as well - the GDPR doesn't prevent usage of data, only that there must be awareness by the data subject of how the data is used and be willing to apply their rights to have the data sent to them, corrected and, in some cases, removed. "Legitimate Interests as a bridge RA", would almost certainly include the right to record things such as psyches (which the EBU, and many clubs, do anyway) and activities subject to penalties at the bridge table. What it wouldn't include would be selling the database of members to,say, an insurance company, for marketing purposes (without the active consent of the members whose details are in the database), as that would be an unusual action.

The general principle is that certain types of information about a person may not be filed and used without that person's general beforehand express consent. Records of actions by a TD against a player will most certainly be of such type (unless the recorder has been issued a special license for such registration).

[gordontd]

pran, on 2018-June-09, 04:06, said:

The general principle is that certain types of information about a person may not be filed and used without that person's general beforehand express consent. Records of actions by a TD against a player will most certainly be of such type (unless the recorder has been issued a special license for such registration).

This is simply not true. Have you actually read the GDPR?

Special category data includes:
race;
ethnic origin;
politics;
religion;
trade union membership;
genetics;
biometrics (where used for ID purposes);
health;
sex life; or
sexual orientation.

Even for those categories of data, consent is not the only lawful basis for processing.

[blackshoe]

sanst, on 2018-June-09, 02:42, said:

Maybe you should.

I'm not in Norway either. Really, why should I care what craziness is produced by governments in far away places? I have enough troubles with the idiocies promulgated in my back yard.

[paulg]

blackshoe, on 2018-June-09, 10:37, said:

I'm not in Norway either. Really, why should I care what craziness is produced by governments in far away places? I have enough troubles with the idiocies promulgated in my back yard.

Perhaps you don't, but the ACBL has to worry about the GDPR because EU players can join and renew membership of the ACBL from home.

To me it is just analogous to the businesses I worked for in the UK, mainly subsidiaries of US companies that were governed by the US Foreign Corrupt Practices Act (FCPA): this led to strange situations where a business practice was legal in the UK but illegal due to FCPA: such as bribing a public sector employee with a $2 pen.

[pran]

gordontd, on 2018-June-09, 09:43, said:

This is simply not true. Have you actually read the GDPR?

Special category data includes:
race;
ethnic origin;
politics;
religion;
trade union membership;
genetics;
biometrics (where used for ID purposes);
health;
sex life; or
sexual orientation.

Even for those categories of data, consent is not the only lawful basis for processing.

For one thing, GDPR is not yet in force, and as far as I have understood the above list is not exhaustive.
I do not know the full extent of information categories, but the principle is that the list shall include all kind of sensitive information related to a person.

[PeterAlan]

pran, on 2018-June-09, 17:10, said:

For one thing, GDPR is not yet in force ...

Not so; it came into force on 25 May 2018.

[blackshoe]

paulg, on 2018-June-09, 13:35, said:

Perhaps you don't, but the ACBL has to worry about the GDPR because EU players can join and renew membership of the ACBL from home.

To me it is just analogous to the businesses I worked for in the UK, mainly subsidiaries of US companies that were governed by the US Foreign Corrupt Practices Act (FCPA): this led to strange situations where a business practice was legal in the UK but illegal due to FCPA: such as bribing a public sector employee with a $2 pen.

Then that's the ACBL's problem.

"Foreign Corrupt Practices". As opposed, perhaps, to domestic corrupt practices?

I infer that you mean that FCPA views giving a public sector employee a $2 pen as bribery. Like I said, idiocy.

[pran]

PeterAlan, on 2018-June-09, 18:33, said:

Not so; it came into force on 25 May 2018.

My information is: That was the intention, but it has been postponed?

[paulg]

pran, on 2018-June-10, 02:00, said:

My information is: That was the intention, but it has been postponed?

No.

As always happens in these situations, law suits have already been filed against some major corporations, like Google and Facebook, for not complying with the regulation.

https://www.theguard...consumer-rights

[lamford]

Clear 72C adjustment, as gordontd and others point out.

[pescetom]

weejonnie, on 2018-June-09, 02:19, said:

That is my 1st impression as well - the GDPR doesn't prevent usage of data, only that there must be awareness by the data subject of how the data is used and be willing to apply their rights to have the data sent to them, corrected and, in some cases, removed. "Legitimate Interests as a bridge RA", would almost certainly include the right to record things such as psyches (which the EBU, and many clubs, do anyway) and activities subject to penalties at the bridge table. What it wouldn't include would be selling the database of members to,say, an insurance company, for marketing purposes (without the active consent of the members whose details are in the database), as that would be an unusual action.

I would add that such awareness on the part of the data subject might increase the effectiveness of the tool.
The GDPR doesn't hinder intelligent attempts to identify misbehaviour at club level.
But the existing Privacy Laws in some countries (like Italy) may do so, for instance by forbidding video recording of play without the explicit consent of all players involved or by limiting access to such video without the explicit consent of the players involved.