Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?

Question

A few friends and were having an argument on the following situation:

People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to create public profiles for their accounts, a nickname, real name, location, etc - but this is not essential (sometimes people put fake information, but a considerable number of people put legitimate information). Via OpenID, users are able to authenticate and identify themselves to various other websites.

Some games, for example Dota 2 (published by Valve, who also run the Steam network) use publicly visible Steam IDs of players as unique identifiers within their games - in order to track information about their users, including reports, statistics, etc.

Provided that a user consents, part of their data from matches they play in is exposed via an API. This includes stuff like what character you played, your performance in game, etc. This allows 3rd party websites to show you interesting statistics about the games you play.

There is another API (also run by Valve) which allows users to download "replays" of the matches, so users can rewatch what happened. Within these replays are, regardless of what a user's consent status may be, users' uniquely identifiable Steam IDs. This allows 3rd parties to track users even if they've not opted into 3rd party sharing.

My questions are:

1. Is a Steam ID "personal data"?
2. Is the sharing of data to a 3rd party by Valve without consent against the GDPR?
3. If #2, How would I make a formal complaint about this.

Answer mostly important for an EU user, but would be interested if there were US comparisons.

Answer 1

Since the Steam ID contains or may contain enough information for it to be possible to link your account to you as a physical person, it would definitely be considered "personal data" according to Article 4 of the GDPR.

However, by agreeing to the DOTA2 terms of service, you have given consent for them to show your information to other players (or at least that is included in most terms of service I have read for other games. I have not read the one for DOTA2 specifically).

Replays are an interesting corner case. If download of replays are only possible for other players or if the wording of the ToS says that you consent to displaying your user ID to anybody, that would mean that they would have covered their bases. As long as they comply with other parts of GDPR, like "the right to erasure" (Article 17) that is. If the API is accessible to anyone and not covered by the ToS you might have a case.

If you only want to remove the traceability between you and the replays, you can always evoke Article 17 and delete your account.

Answer 2

1. Personal Data is any Data that either on its own or when cross-referenced with other Data allows the univocal Identification of a Natural Person. So for the company towards which you register to get your "steam Account ID", YES it is Personal Data, for they can identify you through it; it is also Personal Data for any partner they share such identifier with and/ or players towards whom the same happens... it is not Personal Data however for those who only can "see" your "Steam Account ID".

2. If Valve shares your Steam Account ID with me and the score that you have achieved over several games, as long as there is no way for me to identify you (as a Natural Person) via such Data... it is not Personal Data, hence GDPR does not apply. However that would mean that Valve does not share your Steam Account ID with any other 3rd party whatsoever, for if it does, at least that 3rd party may identify you as the owner fo that Steam Account ID and them all inherent profiling Data becomes Personal Data... in some cases it is a matter of Context, really.

3. If they have shared your Steam Account ID with other companies or entities where some other 3rd parties can use it to univocally identify you, making it Personal Data and it was shared without your awareness and a Lawful Base (Consent; Legitimate Interest; Legal Obligation; other...) what you should do is:

Step 1 - Submit a DSAR (Data Subject Access Request) inquiring about which Data they have about you; the Lawful Base and with which other entities do they share your Personal Data with under which Lawful Base.

Step 2 - If no answer within 1 month or "NO" for an answer, present a complaint towards the local Supervisory Authority; If there is a comprehensive answer and they tell you they share the Data with Company A... (n), you may then on«object to such sharing unless they have explained HOW and WHY without it they are not capable of delivering the Service.

In the U.S. Personal Data (in fact PErsonal Individual Information) is both a far less broaden context as it is not up to resident Natural Persons to exercise the same types of "rights" that GDPR defines.

As an example under the California, Customer Protection Act (similar to GDPR, yet only for residents of the State of California) companies may pretty much do as they please with your Personal Data until you "opt-out".

So, making a long story short, EU resident Natural Persons have control over their Personal Data as long as they exercise their GDPR established rights, whereas in comparison Natural Persons residing in the U.S. have a much limited set of rights they may exercise.

Disclaimer This is a "broader answer" to your question, meaning adding some details (e.g. your Id shared amongst the gamers of the same gaming group on the platform) may render the entire logic "void".

These platforms/ forums that are either "free" or bear a very "low fee" are businesses, not charities, and that means they need to be profitable, so at the end of the day, some will either charge nothing or a very low fee and compensate for that by selling your Profiling Data to companies that may then attempt at selling you something... it all would be fine if you were informed about such proceedings in advance in a crystal manner having Consented to it... however, that is not how these companies act and that puts them in breach of GDPR.