Making a serious game to protect children online

Timelex presents the RAYUELA project

For almost a year now, Timelex has been involved in the RAYUELA project. This Horizon 2020 EU-funded project aims to provide a ‘fun way to fight cybercrime’ by making available a serious game to minors that presents them with in-game scenarios which could potentially lead to dangerous situations if they were real life. The game is aimed at educating and empowering minors playing the game by ‘playing these dangers out of their daily life’. In other words, by playing the game, the minors will be taught how to conduct themselves on the internet in a safe manner. The focus is on the prevention of cyberbullying, online grooming, human trafficking (with a cyber component). The project will also look at the effects of misinformation and deception. With regards to these crimes the serious game wants to prevent minors becoming a victim, but equally wants to avoid minors becoming perpetrators themselves.

Data leads to better education

In addition to educating its players, the serious game has as its second goal to produce data by measuring the behaviour of the players during the game. This data, which will reveal the human drivers leading to cybercriminal behaviour or victimhood, will then be analysed by the project to provide insights for policymakers and stakeholders on how to better educate young people on the dangers of the internet and to prevent minors from engaging in cybercriminal activities or becoming the victim of cybercrime. In order to have the best understanding of the elements that lead to a minor becoming a perpetrator or a victim of cybercrime, and to offer every player the most appropriate in-game scenarios, it is important to link every player to a baseline profile that matches their character and risk profile. To build these profiles and to make the scenarios representative of reality, the project has analysed real convictions in this field and carried out interviews with experts, victims and perpetrators, leveraging existing knowledge.

Collecting sensitive data must be carefully monitored

While the goals of RAYUELA are laudable, the project presents some ethical sensitivities and legal challenges. While players’ data will be pseudonymized, this still constitutes the recording of personal data. Since the behaviour of the players will be monitored in detail, the amount of information gathered is significant. Moreover, in order to present each player with the most appropriate scenarios, they will need to be matched to a baseline profile at the start of the game, during an onboarding process (e.g. avatar creation). Not only will RAYUELA involve profiling, since it addresses crimes such as online grooming, human trafficking and cyber-bullying, sensitive information may come to light, including special categories of data under Article 9 of the GDPR. As children enjoy special protection under the GDPR, this process must be carefully monitored. Moreover, when relying on consent of a minor, specific considerations apply. Sometimes parental consent is needed to protect the minor. In any case, minors must be carefully informed about the data processing and must have the free option to refuse. This is especially important when a serious game is educational and may be offered or tested in a school context, where there may be real or perceived pressure to not refuse playing the game.

Protecting data by design

Because of these challenges, Timelex has been asked to join this project to lead the legal and ethical work, making sure that minors playing RAYUELA’s game retain their privacy and are protected from stigmatization or any other negative effects as a consequence of playing the game. At this point in time, the RAYUELA serious game is in the initial stages of its design. By involving Timelex as a legal expert already during the design stages, the RAYUELA project provides for a data protection by design (and by default) approach, as required by Article 25 GDPR. In addition, during the piloting phase, Timelex will perform a data protection impact assessment for the use case scenarios to ensure that the personal data of the children playing the game is processed appropriately in practice.

More information about RAYUELA

See our Horizon 2020 page for more information about the RAYUELA project or take a look at the RAYUELA website. To keep up with the project’s progress, please refer to the project’s social media channels.

If you have questions about the processing of children’s personal data under the GDPR, please contact a Timelex lawyer.