Two Years After: A Scoping Review of GDPR Effects on Serious Games Research Ethics Reporting

Abstract

On May 25th, 2018, the EU General Data Protection Regulation (GDPR) came into force. Recognised as a comprehensive regulation for improving privacy and data protection, a substantial impact on data processing disciplines such as Serious Games (SG) research was expected.By conducting a scoping review, this paper explores the effects of GDPR on reporting of ethics approval, informed consent, ethics guidelines and data protection in SG studies. Five scientific databases were searched for research between 2016 and 2020 addressing Serious Games, Exergames and Applied Games. A total of 2146 full-text studies split into equal collections before and after GDPR were included. Lexicometric and keyword-in-context analysis were conducted and comparatively evaluated regarding ethics reporting and trends.Results unexpectedly show that GDPR so far hardly left a mark. While a slight increase of 12% in general ethics reporting can be observed, less than 6% of the studies after GDPR coming-into-force report on data protection. Ethics procedures remained consistent with most researchers reporting the approval from their home university committee and stating the Declaration of Helsinki as followed guidelines. Overall, the verifiable impact of GDPR was found negligibly small, with only 0.5% of studies referring to the regulation in the two years after introduction. Conclusively, further research is suggested to focus on integrating ethics and data protection guided on GDPR from an early conceptual stage to the reporting of the findings.

The Ethics of AI in Games

“…In the European Union, the General Data Protection Regulation (GDPR) [52] is meant to give a legal framework and transparency to data handling (also in an AI context). However, a review of serious gamesgames developed for healthcare, educational, hiring, or other non-entertainment purposes-found that two years after the adoption of GDPR, it has had little to no effect on the research community [53]. Similarly, in a recent exploration of affective computing through the lens of GDPR laws Hauselmann found that the field faces serious issues in terms of transparency, responsibility, and predictability [54].…”

“…This issue is even more complex in closed ecosystems that can facilitate cocreation with AI designers. As discussed earlier in Section II, affective computing applications face challenges addressing these questions under the current regulatory frameworks [51], [53], [54]. Even though users should have (at very least) rights to have control over their own data, to portray themselves accurately, to be forgotten [104], and to be self-determined, in reality, information inferred from big data is often exempt from the same legal protection afforded to first-hand personal data [31].…”

Towards Suitable Free-to-Play Games for Children

“…The General Data Protection Regulation (GDPR) was established in EU and came into effect May 2018 (Jost and Lampert, 2020). GDPR aims to provide guidance in privacy and data protection and improve scientific integrity of human-related studies.…”