Can I waive my statutory rights? I've noticed that Steam has recently added this bit of text to its review and confirm page: By clicking the button below to proceed you agree that Valve provides you immediate access to digital content as soon as you complete your purchase, without waiting the 14-day withdrawal period. Therefore, you expressly waive your right to withdraw from this purchase. To me that translates to "I waive my statutory rights that have been granted to me by the EU", which, to my knowledge cannot be done. So does this paragraph have any legal bearing within the EU (I know this practice is commonplace in the States)? Thanks in advance! Note: Steam has recently begun allowing refunds within 14 days for faulty products with a few caveats, whether or not this is a result of a legal challenge or not I don't know.
The European laws have specific sections regarding digital goods. The following two passages are relevant to you: From Returning unwanted goods: Warning! Please note that you may not use goods that you have received before deciding to withdraw from the purchase. The right to withdraw exists to allow you to examine the product in the same way as you would in a shop, not to give you 14 days free use. Be aware also that more specific rules apply to digital content (e.g. downloading or streaming music or video). From Shopping online: Digital content Specific information requirements apply when you buy digital content online, e.g. when downloading or streaming music or video. Before you make the purchase, you must also be informed how the content operates with relevant hardware/software (interoperability) and about its functionality, including whether any geographical restrictions apply to the use of the content and if private copies are allowed. You also enjoy the right of withdrawal within 14 days from concluding the contract for online digital content. However, once you start downloading or streaming the content you may no longer withdraw from the purchase, provided that the trader has complied with his obligations. Specifically, the trader must first obtain your explicit agreement to the immediate download or streaming, and you must explicitly acknowledge that you lose your right to withdraw once the performance has started. So yes, the law specifically allows you to waive that right when purchasing digital goods. So long as Steam has correctly advertised the product's system requirements and other key details, you lose your right to withdraw from the purchase the moment you start downloading it to your system.
There are two relevant bodies of EU law to consider here. The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly. The ePrivacy directive is also relevant, and covers how you may access and store information on the user's device. Directives are not directly applicable law. Instead every member state translates the directive into national law. In the UK, ePrivacy is implemented by PECR. Is the data you collect personal data in the sense of the GDPR? Yes: that hashed unique device ID or a system-provided advertising ID likely is personal data, and any linked data would then be personal data as well. This is going to be the case in particular if you store user accounts on your server and can connect these bug reports to a user. Consider also whether the game save could include personal data, and whether the video clip could be analyzed to identify the data subject. Does this mean collecting this information in bug reports is forbidden? No, the GDPR doesn't forbid or allow anything outright. Instead, you should go through the compliance process. In a nutshell: determine the purpose of this processing, e.g. “fixing bugs” find an Art 6 legal basis for this purpose, e.g. “Art 6(1)(f) legitimate interest” or “Art 6(1)(a) consent” if the legal basis is legitimate interest, you must balance that interest against the data subject's interests determine whether your compliance requirements include creating/updating your Records of Processing, or whether you have to write a Data Protection Impact Assessment implement the processing in a manner that respects GDPR principles such as Transparency and Data Minimization if the legal basis is legitimate interest you must implement an opt-out solution if the legal basis is consent, you must request consent first in a manner that satisfies the Art 7 conditions for consent – and allow consent to be revoked easily prepare to satisfy data subject rights: information requirements per Art 13, usually done in the privacy policy right to access, rectification, erasure, and data portability right to object (opt-out) and to restrict processing be aware of your general requirements a data controller to process this data securely, e.g. use HTTPS connections to transmit bug reports, take steps to protect your own accounts (e.g. 2FA), and ensure you have a suitable contract with any data processors that act on your behalf, e.g. cloud providers or contractors I would question whether your bug reports really need to include a device ID. That isn't forbidden, it just complicates compliance a bit. And what about ePrivacy? The ePrivacy directive is known for its cookie consent requirements. But these consent requirements apply when accessing any information on the user's device, or when applying equivalent fingerprinting techniques. Your game save is not an issue because it is necessary for the game. But that device ID and other system information is more difficult. So what to do? Compliance isn't trivial, but certainly possible. You will likely process the bug reports under your legitimate interest, but might still have to collect consent for accessing a system ID due to ePrivacy. Such a screen might look like this: Oh no, the game crashed! Do you want to send a bug report to the developers? Your bug report will be protected as per our privacy policy (link). Your bug report will contain the following information: … Yes, collect system information and send bug report No, do not send bug report You could make an argument that a bug report can be sent in any case, and that you just need ePrivacy consent to collect useful system information. For example: Oh no, the game crashed! When sending a bug report to developers, do you want to include extra system information (link to details) that helps fixing the problem? In any case, your bug report will be protected as per our privacy policy (link). Your bug report will contain the following information: … Yes, send bug report with extra system information No, send anonymous report
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
england-and-wales The government grants limited rights of return (thanks Jen), for which you are entitled to a cash or cash-like refund (e.g. reversal of a credit card charge as described below). The vendor has the option to go above and beyond that statutory minimum as a courtesy to the customer. In that non-compulsory zone, they have the liberty to offer store scrip rather than a cash refund. Of course, any business can try to cheat you, and then you have to stick up for your rights by insisting or reporting to relevant authorities. united-states If you buy with a credit card, the rules and contractual obligations of the credit card companies oblige the merchant to accept returns by doing a refund to the card. It's important to understand how this happens: the merchant isn't just picking an arbitrary amount of money and doing a new &quot;sale in reverse&quot;... they are identifying a specific past transaction that already happened, and modifying or reversing it. That is a system safeguard so they don't credit the wrong person or be tricked into a reversal on a transaction that never happened. That's why they want your receipt. On a cash transaction, it is sellers prerogative whether to issue cash or store credit. Issuing store scrip is a reasonable option to deter theft and fraud. For instance someone who wanted an item could get it for free, by buying the item, taking it home, returning the next day without the item, grab another identical item off the shelf and sneak over to the CS line and &quot;return&quot; it with yesterday's receipt. With cash sales, that would be completely untrackable, and the thief is gone. With credit card, they have your identity; with scrip they can &quot;flag&quot; the scrip in their system to either prevent its use and/or have a security officer detain you if you try to use it. For instance American home stores will cheerfully take re-saleable condition items back even without a receipt, but will issue a store voucher for the value rather than cash. That policy would be a disaster if they refunded cash. As it is, I find it rather convenient! So if you want the convenience of cash refunds, you can just use credit cards - gaining the feature at the expense of anonymity.
Is UPS allowed to take my money and business without intention to fulfill its side of the transaction? No. The company's belated change of mind constitutes breach of contract, and its subsequent refusal to give you a refund completes the prima facie elements of fraud and/or unjust enrichment. The company's acceptance of your package &amp; money and its subsequent act of sending your package to NC strike the applicability of its clause on Refusal of Service (see the link provided in the other answer). The blanket term of "among other reasons" is hardly enforceable at that point. In particular, the existence of a lawsuit between the recipient and the company further weakens any merits of the company's belated change of mind. That is because, by virtue of that lawsuit, the company currently has to deliver to that same recipient other packages anyway. Thus, the company cannot allege that delivering your package "is unsafe or economically or operationally impracticable". Also, since you are the one who paid for the service, the company cannot withdraw on grounds of "the person or entity responsible for payment is not in good standing".
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
A TOS is not intrinsically illegal, but an interpretation of a TOS may or may not be supported by a court, that remains to be seen. It probably does not constitute a &quot;deceptive practice&quot; under FTC standards. The TOS is your permission to use the software, and there can be no question that they have the right to impose conditions on customer use of the software. E.g. Amazon cannot freely use software that is only licensed for free educational use. They speak of &quot;ownership&quot; of IP so created and explicitly disclaim any claims about Current Law in Your Jurisdiction. At the crucial point in the agreement, they switch to talking about the license (BY-NC) that they grant when you are not a paid member. The exact details of this ownership are not part of the free tier TOS, but they do seem to add certain protections to &quot;owned&quot; content created under the Pro plan – they are under no legal obligation to make all content universally visible and usable.
No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another support channel. (But Google offers infamously bad support.) In some cases, the service may legitimately decide that they cannot give you access to the data, for example if they believe that you are not the actual data subject (e.g. if they think that you hacked the account). The right to access must not adversely affect other people (Art 15(4)). If they have doubts about your identity, they can require further information to verify you (Art 12(6)). If your requests are excessive or unfounded (if you are spamming them), they can also turn down the requests (Art 12(5)).