Do you have to provide the name and email address of your data protection officer? Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we review any request sent by mail, please be aware that to combat fraud, harassment and identity theft, the only way to access, rectify or delete your data is through logging in with your Steam User Account at http://help.steampowered.com and selecting the menu items -> My Account -> View Account Data. Valve Corporation Att. Data Protection officer P.O. Box 1688 Bellevue, WA 98009 European representative for data protection questions: Valve GmbH Att. Legal Rödingsmarkt 9 D-20354 Hamburg Germany Is there any requirement for them to provide an email address or name the DPO?
Articles 13 and 14 discuss what information must be provided to the data subjects, for example via a privacy policy. Art 13(1) requires: (a) the identity and the contact details of the controller, and where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; The quote you have shown contains both the identity and contact details (postal address) of the representative, and the contact details (postal address) of the DPO. This seems to comply with the letter of the law.
Your data is not anonymous since from the picture of the face the individual can be identified. It would be anonymous, if the face was blurred and other possible identifiable information was removed. Of course, that would defeat your purpose. Please note that, in any case, Anonymization Techniques are, themselves, a type of personal data processing that requires a legal ground, and achieving real anonymization is not a trivial matter (see Article 29 Working Party's opinion 0829/14/EN WP216 on the subject). 1. The face of a person includes biometric information, which is defined in article 4 (14) among other types of personal information regulated by the GDPR as: "personal data resulting from specific technical processing relating to the physical, physio­logical or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data". A facial recognition software's purpose is exactly to perform a specific technical processing based on the facial features of the persons, to achieve a unique identification of a person based on these biometric features. Article 9 of the GDPR includes biometric data among the types of prohibited processing, unless one of the exceptions in § 2 applies. There are 10 types of exceptions among which: consent of the person, employment context, personal data made public by the person, scientific or historical research,... (each exception having its own conditions). You should check that you comply with one of these exceptions stated in article 9 § 2, if your application is about using facial images for unique identification of a person based on these biometric features. 2. In turn, if your processing is not about unique identification of a person based on these biometric features, but only about emotions recognition (which you briefly mentioned at the beginning of your post), it could be considered as not falling under the requirements of Article 9. That would still be a processing of personal information, but it would fall under the normal article 6 requirements.
Because the company that runs the contest is not in the banking or medical industry, or in another business or organization (NGO or governmental) that has to protect personal information by law, your login, email and password can be stored on pieces of paper scattered around their office and it's not illegal. And there are no laws regarding sending your information in plain text in an email. Yes, those are bad security and privacy policies, but they are not illegal. (This may vary by jurisdiction). The TOS (Terms of Serivice) you agreed to are at Eye Win Awards Privacy Policy. Part of it reads: By providing us your Information or by making use of the facilities provided by the Website, You hereby consent to the collection, storage, processing and transfer of any or all of Your Personal Information and Non-Personal Information by us as specified under this Privacy Policy. You further agree that such collection, use, storage and transfer of Your Information shall not cause any loss or wrongful gain to you or any other person. and We cannot guarantee the security of our database, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet. And, of course, any information you include in a posting to the discussion areas is available to anyone with Internet access. You agree to the TOS and Privacy Policy simply by registering and using the site. This is known as a click wrap (Wikipedia) contract. You can choose to stop using the service, or by the company can choose to void the contract and close your account. You can complain, but it is entirely up to the company to address your complaint or even reply to you. The Grievance Redressal contact in India is at the bottom of the link above. There are probably consumer advocacy groups in India; Google will show you those.
Whether or not you are protected by GDPR depends on the location of both yourself and the party processing your data. Citizenship and residence statuses are completely irrelevant (Recital 14(1)): The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence If the party processing your data is established in the EU, then you are protected no matter who you are or where you are (Art. 3(1)): This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. If the party processing your data is not established in the EU, then you are only protected if you are in the EU (Art. 3(2)): This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.
https://www.schäffel.ch/allgemein_de.html: &quot;Die Fonts dürfen für private und professionelle Zwecke unbeschränkt verwendet werden. Sie kommen vollständig und mit allen Einbettungsrechten. Es wird gebeten, jegliche Modifikation der Datensätze, den Vertrieb unter anderen Namen, die Verteilung auf anderen Websites als dieser oder die Eingliederung in Font-Pakete zu unterlassen.&quot; That is, The fonts may be used without restriction for private and professional purposes. They come complete and with all embed rights. Please refrain from any modification of the data sets, distribution under other names, distribution on websites other than this one or incorporation into font packages.
Please note that Google Analytics do not anonymize the data you collect on its behalf unless you configure it to do IP-anonymization. If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) in place with Google in order to comply with the GDPR. This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics. Does data that is anonymized need to be collect in the event of a GDPR Subject Access Request? No. But as the controller, you need to make sure that is is anonymized.
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR) The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person. There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability. To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used. You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent. So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear. Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant: User consent required under GDPR What provisions should I make regarding GDPR consent when users do not sign themselves up? GDPR - Withdrawn user consent Opt Out Consent under GDPR