1

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them:

You can contact Valve's data protection officer at the address below.

While we review any request sent by mail, please be aware that to combat fraud, harassment and identity theft, the only way to access, rectify or delete your data is through logging in with your Steam User Account at http://help.steampowered.com and selecting the menu items -> My Account -> View Account Data.

Valve Corporation
Att. Data Protection officer
P.O. Box 1688
Bellevue, WA 98009

European representative for data protection questions:

Valve GmbH
Att. Legal
Rödingsmarkt 9
D-20354 Hamburg
Germany

Is there any requirement for them to provide an email address or name the DPO?

Improve this question

2 Answers 2

Reset to default
5

Articles 13 and 14 discuss what information must be provided to the data subjects, for example via a privacy policy. Art 13(1) requires:

(a) the identity and the contact details of the controller, and where applicable, of the controller's representative;

(b) the contact details of the data protection officer, where applicable;

The quote you have shown contains both the identity and contact details (postal address) of the representative, and the contact details (postal address) of the DPO. This seems to comply with the letter of the law.

Improve this answer
1
  • 2
    OP seems to want personally identifiable information about the data protection officer, which the data protection officer probably should deny.
    – gnasher729
    Mar 30, 2022 at 13:20
1

Respectfully, I would dissent from both legs of amon's answer, for multiple reasons.

SHORT ANSWER

As to contact details, in this instance Steam should provide two or more methods of contact, at least one of which must be electronic. The electronic point applies to almost all controllers; the multiple methods point applies only to a few, which likely includes Steam.

As to any naming requirement, this is merely inferable (from the DPO's statutory duties) but (because of maintenance costs and proportionality) I would regard it as only a minor breach unless the controller actively refuses, upon request, to name the DPO (following, of course, the data subject's electronic request).

EXPLANATION

There are a number of circumstances in respect of various data subject rights in which, especially as an "information society" enterprise, Steam's "policy" likely amounts, in and of itself, to breach. A webform would seem to be the bare minimum required, given (for example) Article 12(1) as expressly clarified by Recital 59: "The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means." Both of these provisions are engaged by the instant context of facilitating the exercise of data subject rights. EDIT: see also Article 21(5): "In the context of the use of information society services... the data subject may exercise his or her right to object by automated means using technical specifications."

Additionally, especially in respect of Steam's named German office (Valve GmbH) several EU nations may impose more onerous obligations on controllers by way of mandating provision of alternative contact methods. I've seen case law on this, if I recall correctly, in 2018 at CJEU level re German law, but I can't immediately identify it, apologies.

Improve this answer
3
  • 1
    I agree that Steam should offer email addresses and phone numbers here, but I can't see an actual written requirement to do so. Recitals are not normative but merely guide the interpretation of the articles. The cited recital doesn't indicate a strict obligation to offer electronic contact details. Art 25 is specific to objections, and merely shows that objections through technical means are valid, not that controllers must always offer electronic means to exercise data subject rights.
    – amon
    Jan 16, 2020 at 11:28
  • Thanks @amon. On the Art 21(5) point, I suspect it may depend on the language version of the GDPR being relied upon (some of the English version in other contexts is definitely flaky to the point of introducing legal nullities), combined with local statutory interpretation rules. In my jurisdiction I would be prepared to argue "may exercise... by automated means" creates a right to so exercise, with a corollary duty on the controller to provide it (as the controller has not done). Of course you may differ! I accept your points on specificity and Recitals, but would still mention them as issues
    – gdpr360
    Jan 16, 2020 at 17:38
  • 3
    Because this is your own site, you must disclose your affiliation in the answer in order for it not to be considered spam. Having the same text in your username as the URL or mentioning it in your profile is not considered sufficient disclosure under Stack Exchange policy.
    – Ryan M
    Sep 11, 2020 at 0:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .