# A Cloud Game-Based Educative Platform Architecture:
## 5 Cloud Game Monitor
### Data Privacy  
Accompanying the need to follow the activity of students, we must include in any development project, even more, if it is educational, mechanisms to protect the privacy of data. Democratization for the use of social networks has made society increasingly aware of the growing exposure of personal data in an increasingly global context. In 2018, a survey conducted by the United Nations Conference on Trade and Development [61], 107 countries (58%) had developed data protection legislation, and the 10% were in the process of doing so. In Spain, this is regulated by the Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPGDD) and GDPR [14]. This privacy of data must also be regulated in the field of education, in which personal data is being managed. Automation of LA processes are increasingly being integrated into educational institutions and platforms oriented to Lifelong Learning, such as the case of our CyberScratch project. Addressing issues for ethics and privacy becomes essential in all LA phases [40]. In 2015, a code of good practices at an institutional level for LA was proposed by [41] and updated in 2018. JIST is a non-profit organization that supports educational and research technologies, being supported by various European projects, such as the LACE project [42] for the Open University in UK. In the LACE project, the question of the impact of privacy on the area of the development of LA was raised. Another relevant project is the SHEILA project [43], for providing a privacy data framework to educative institutions. Therefore, there is an increasing development for data protection regulation. It is necessary to follow modern standards that help us to do so, as we propose in this work. Following this spirit of the regulation, the ISO/IEC TR 20748-1:2016 standard [16] have been adapted to our purposes. This way, it will be possible to provide with mechanisms to avoid students' monitoring and manage data control and user identification. This way, great transparency and suitable privacy of data must be achieved at an institutional level. An initial approach is being deployed in the CyberScratch project. According to this work, each phase must fulfill the following privacy requirements, as shown in Figure 8. Our framework start from these recommendations, as well as the rights that must be guaranteed according to the GDPR standard to include mechanisms that allow us to guarantee them through the different phases of our LA process. As a result, Table 1 represents these relationships, in which each GDPR right is associated to each LA phase. The collected data is basically the recommended by the ISO/IEC TR 20748-1:2016 standard. Our main objective here is to establish a correlation about the LA phases and the GDPR rights. Thus, we have adapted these GDPR recommendations to our CyberScratch framework, which is summarized as follows:  
* _The right to be informed_. Our framework does not collect many sensitive mandatory information further than an email account and the actions of the user inside the platform. Users are informed when they first register on the platform by means of a form. This form allows them to consent which treatments of the information they accept. More detailed information is provided through a document that is posted on the project's website and linked to the acceptance form. * _The right of access_. Users _\"shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data\"_, cited from [14]. Users can access to the following collected data: