Once the data are tied to email, IP address, SSN, eID, ID card or even a name, they are personal data. Sure, "owns FIFA 2019" is not sensitive data like "suffer

Once the data are tied to email, IP address, SSN, eID, ID card or even a name, they are personal data. Sure, "owns FIFA 2019" is not sensitive data like "suffers from depression" or "voted Green" would be, but it's still data about a person. Many people confuse identifiers with personal data. Next time, assume personal data means all columns of the "user" table and everything that can be sensibly joined to them. "Anonymized" means setting all non-synthetic identifiers to NULL. "Pseudonymized" means replacing all non-synthetic identifiers with generated ones. "Sufficiently" means you ask yourself: "Would I be plausibly able to identify rows related to this one person I personally know stuff about?" But obviously, keeping user accounts to be able to provide them with their games is a given. No data protection agency would be able to convince a court that you should have made the games inaccessible without explicit instruction from the user. It's a textbook example of legitimate interest.