Do I have any responsibility over 3rd party data collection? I have a little game that does not collect any user data whatsoever, nor does it resell it or anything else. I do employ Google Ads, and the game is planned to be released on the Google Play Store. I do not know what user data Google has collected, and I have absolutely no control over what they will do with it. Do I have any responsibility for it? If so, then to be honest I have no idea what they collected, and I wouldn't know how to list it even if I wanted to. Or could I just say something like, &quot;Third-Party Data Collection has nothing to do with me&quot; in my Privacy Policy?
Simply stating that third-party collection of data has nothing to do with you is not sufficient in your Privacy Policy. You are responsible for ensuring compliance with applicable laws and regulations related to data privacy, including providing clear and accurate disclosures about data collection and use in your Privacy Policy. While you may not have direct control over the practices involved in the data collection process of third parties, you still have a responsibility to inform users about these practices and obtain their consent as necessary. You can include a statement in your Privacy Policy about the use of third-party services like Google Ads, and inform users that these services may collect data and that you have no control over the data collection or use practices of these third parties.
It is hard to prove a negative, but no - there is not rule that an app cannot track a user while the app is in the background. Almost every GPS-function app on every smart phone does the very thing you are talking about.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
Copyrights don't apply to the names used. You mean trademarks. You copyright your game and you trademark the name. http://www.reddit.com/r/gamedev/comments/11v69k/using_a_guns_name_in_your_video_game/ Basically, it wouldn't be wise to use trademarked names in your game. Even though it's unlikely you would be sued and even if you were, you could possibly fight it under Fair Use, but do you want to take the chance? If some gun company decided they didn't like how you used their name, even if they have little to no grounds for a case, they can STILL sue. Anybody can sue for pretty much any reason where there is doubt. If they have enough money to throw around, they can drag you through the mud, ruin your business and then just lift their lawsuit. They don't need to win in court, just destroy you. Keep in mind that even if you don't use the name, if the gun in your game is an accurate replica of the real thing, it could still be a trademark issue. EDIT: Something you could consider though is asking permission. You never know. They may simply not care. You might even try propositioning them to pay YOU to have their gun showcased in your game. It's not entirely uncommon for companies to be willing to pay for a bit of endorsement advertising.
Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it. So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.
It doesn’t make you exempt from the GDPR if that’s what you’re asking The hash you produce is linked to one (or a small number) of computers and it therefore serves as an ID number. Because that ID number is linked to the owner of the computer it is personal information and if you are collecting it, you must comply with the requirements of the GDPR - valid legal reason, deletion when no longer required, deletion on request, data security etc.
A public key is private data - the fact that its a public key is neither here nor there, its data owned by the user and not necessarily in the public domain (I have keypairs for which the public key is only known by myself, for example). For a subject access request, you must give the user all data you hold about them, subject to certain restrictions laid out in the GDPR - in your case, this would be the IP addresses, public keys, encrypted data and anything else involved in identifying their devices for transferring the files. You dont need to decrypt the encrypted data if that is something you cannot do or would not normally do in the course of holding it during a transfer - to you, the encrypted data is what you hold. If you hold the means to decrypt the data, that means (private key for example) would also be included in the subject access requests response, but in your case you say you dont hold that, so there you go. Remember to include information from things like logs etc in your response.