Address for puzzle submission

[ddurschlag]

I'd like to be able to contribute puzzles to the Logic Masters community, but upon clicking "Create a new puzzle" I am directed to a page which says:

"You have to provide some user data before you can publish puzzles. This data is incomplete. The following items are missing: Adresse. Navigate to your user page to enter the missing data."

I have filled in (partial) address data on my profile. What is required to meet this criterion?

[Hausigel]

Hello,

I have checked your database entry. According to the database, you have only entered the town name. Please complete the address data, and the use of the Puzzle Portal should be enabled.

Best regards,
Roland

[ddurschlag]

Hello,

I have checked your database entry. According to the database, you have only entered the town name. Please complete the address data, and the use of the Puzzle Portal should be enabled.

Best regards,
Roland

Hi Roland,

The privacy policy seems to say my address could be given out to other members of logic-masters without my permission. Could you explain a bit about what this is used for? Is it also required for paying members? Perhaps I'm old and paranoid, but it strikes me as slightly creepy.

[Joe Average]

Hello ddurschlag,

were you trying to register as a user of the puzzle portal, or were you trying to register as a (paying) member of the "Logic Masters Deutschland e.V." association? Those are two separate things. We have hundreds of portal users who are not members of the association, and not every member of the association is regsitered with the portal.

For regular portal users, there's only very limited circumstances under which your data may be given to another person; as is stated in the "terms of use". https://logic-masters.de/nutzungsbedingu...?chlang=en

The privacy policy seems to say my address could be given out to other members of logic-masters without my permission.

Actually that's not quite accurate. You'd give your permission by signing up as a member.

You being a paying member of the association may require some other members to have access to your data. For example, you'd be invited to the annual general assembly where you'd have voting rights (both active and passive) and for that, some verification is needed that you are indeed the paying member you claim to be. There's also the advantage of attending some events hosted by the associtation at a reduced price, for which - repeat - a form of verification is needed. Additionally, for a while there was a printed copy of the semi-regular publication "N.E.D." that you'd be get sent by mail.

Any registered paying member of the association has the option to choose wether they are
- generally okay with their adress data being privy to all other members of the association,
- or it being handled on a strict need to know basis (usually only elected board members and advisors as they perform specific tasks for which your data would be required)

[PaperScissors]

Sorry for bumping this up, but the fundamental question has still remained unanswered. 

Data minimisation is one of the core principles of the GDPR. Art. 5.1.c: "Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." The reason for it is simple: If you don't collect the street address of 'hundreds of portal members who are not members of the association' that data can never leak either. That's by far the best and cheapest form of data protection in existence.

I have no idea why a street address would be of any relevance in relation to uploading some puzzles and the privacy statement stays completely silent about the purpose of that data collection as well. This practice strikes me as creepy too. In fact every responsible internet user should hear alarm bells ringing when a website tries to lure them into sharing certain data for no apparent reason.

So again: 'Could you explain a bit about what this is used for?' - Are you welcoming new portal users with a postcard? Are you going to send some angry men to a setter's house after accidentally uploading a broken puzzle? Or ...

The obligation to share any data in your possession if requested by the legal authorities is by itself not a justification for collecting certain data in the first place. And people with bad intentions would provide a false street address anyway, don't you think?

[Joe Average]

The obligation to share any data in your possession if requested by the legal authorities is by itself not a justification for collecting certain data in the first place. 

You may not think so, but it is the justification in this case. The collection of personal data is for legal protection of Logic Masters e.V.

Registered users are able to upload content (puzzles and/or comments) to our website. The puzzles and comments that go online are not validated by anyone before they appear. That would be way too big a task. So, we have to trust the site users to act within legal guidelines when they upload content, meaning no plagiarism, no defamatory hate speech, etc. 

But in the very rare case that somebody would violate those terms, Logic Masters needs to be able to show the authorities (upon request) the information that the user provided, and the boxes they checked/conditions they agreed on while signing up, demonstrating that Logic Masters insn't responsible for the content in question. 
And If someone chose to provide false information, well, then that would be just an additional violation and legal issue to add upon the matter that the authorities are looking into. 

All in all, it's quite similar to most email providers out there. With them you also have to give your real adress when you sign up for an account, and indeed you can choose to give a fake one... and most likely you'll never face any consequences for it. 

You may not like it, but those are the terms. If you don't want to register under these "creepy" conditions, that's absolutely fine.   Even without registering you can still enjoy solving the puzzles other people do upload. It's possible to type in a solution code and have it validated without being a registered user.

[n99]

You may think so, but you're most definitely wrong.

The fact that anyone can post comments on your site without giving their name or address already shows that the justification is wrong.

> All in all, it's quite similar to most email providers out there. 

It's a puzzle website, not an e-mail provider. Also, you *don't* have to give these data to a lot of e-mail providers.

> The collection of personal data is for legal protection of Logic Masters e.V. 

It doesn't protect you in any way. Not only does it not do that, laws and regulations that apply here tell you to *not* collect information like that.

GDPR: "Personal data shall be […] adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)"

Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (German Telecommunications and Digital Services Data Protection Act): " Anbieter von digitalen Diensten haben die Nutzung von digitalen Diensten und ihre Bezahlung anonym oder unter Pseudonym zu ermöglichen, soweit dies technisch möglich und zumutbar ist." ("Providers of digital services must enable the use and payment of digital services anonymously or under a pseudonym, insofar as this is technically feasible and reasonable.")

Digital Services Act: "Where an information society service is provided that consists of the storage of information provided by a recipient of the service, the service provider shall not be liable for the information stored at the request of a recipient of the service, on condition that the provider […] does not have actual knowledge of illegal activity or illegal content and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or illegal content is apparent; or […] upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the illegal content. "

> If you don't want to register under these "creepy" conditions, that's absolutely fine. 

They are indeed creepy. Supplying your real name and address to upload a puzzle is not just out of touch, but wildly so. It's so unusual that I created an account for this forum just for this message. Not how dedicated discussion forums like Heise, which get far more (and more controversial) comments don't ask you for any of this.

It is not a matter of "if" the account database lands on the Internet, shared among scammers, but "when". With most services it's just a pseudonym or e-maill address and a (hopefully salted) password, here it's a full name and address, which then can be linked to other data. Please change this. It's not needed, it's against the spirit of the law, it keeps users from creating puzzles, and it's imprudent.

[Joe Average]

Thank you for bringing your concerns to us, they have been noted. While we keep considering your concerns, feel free to post your puzzles on a website that handles things the way you deem fit.

As for our terms keeping users from creating puzzles, over 36.000 entries in our puzzle database seem to indicate otherwise.