Steam does ask suddenly for ID, if I want to buy a game?

[Blitzwing]

Its very odd, just yesterday I could simply buy games, now it does ask for ID?
like where you life and phone number

Update 27.01.2020
Here is the proof, what steam does request now.
https://imgur.com/a/BPV7ZG8

Some people do "guess" its due to new laws in USA, but I do life in Germany.

There is still no official statement from Steam.

[cSg|mc-Hotsauce]

Publicado originalmente por Blitzwing:

Publicado originalmente por cSg|mc-Hotsauce:

Complying with laws don't require a statement by the company that is complying.

Changing Contract Agreements does.

It wasn't amended though.

[Brian9824]

Publicado originalmente por Blitzwing:

Publicado originalmente por brian9824:

My guess is they want a secondary validation source so people can't just put in a friend's address to avoid paying taxes or pay less. Like in the EU they request several pieces of data to ensure someones location is being captured accurately.

OK I am no tax expert, but if you do buy game or card in country Germany.
The tax is already part of the price. Government does not need to check it again.

Its called Mehrwertsteuer in Germany and is like 19%, so if I do buy for 100 Euros Steam Wallet card, its already 19 Euros for German government.

Why is there required to know my address or phone number?
Government has already the money.

Don't know the specifics in Germany, but in the US for instance there is no tax on giftcards. The tax is paid when you SPEND the giftcard.

As for Germany EU law does say that for VAT purposes companies are supposed to ask for the address to verify VAT rate that should be applied.

Publicado originalmente por Blitzwing:

Publicado originalmente por cSg|mc-Hotsauce:

Complying with laws don't require a statement by the company that is complying.

:qr:

Changing Contract Agreements does.

Where does the contact agreement state that steam will never ask for your address or phone number?

[RiO]

Publicado originalmente por brian9824:

https://www.bloomberg.com/news/articles/2019-07-16/how-digital-tax-plans-in-europe-hit-u-s-tech-quicktake

https://www.washingtonpost.com/business/how-europes-digital-tax-plans-will-hit-us-tech-companies/2019/07/19/1177baba-aa03-11e9-8733-48c87235f396_story.html

https://taxfoundation.org/digital-taxes-europe-2019/

It's been well documented. So if your upset blame your lawmakers as the changes they are doing are forcing steam and others to make changes to comply.

This is occurring globally and not just in the US.

Only a few EU member states are levying additional taxes on digital revenue. There are plenty which do not. For EU consumers domiciled in any of those other member states, there is no legal requirement for Valve to process or store the requested personal information.

With no legal basis Valve is then - as per the GDPR principles regarding data minimization - not even allowed to collect said information:

GDPR[eur-lex.europa.eu], Article 5 - Principles relating to processing of personal data
1. Personal data shall be:
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

In addition, the GDPR stipulates that processing of personal data shall only be lawful if it fits one of a set of 6 possible criteria.

GDPR[eur-lex.europa.eu], Article 6 - Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Out of these (b) and (c) do not apply because there is no legal obligation and no need for the performance of the sales contract; (d) does not apply because neither Valve nor Steam is a natural person; (e) does not apply because Steam purchases are not a task in the public interest and Valve is not an official authority; and (f) likewise does not apply because there is no legal obligation or need for this data, so the legitimate interests can never outweigh the interest or fundamental rights of the data subject, such as the right to privacy.

That leaves (a) for processing based on consent. For that we first have to look at the legal definition of consent:

GDPR[eur-lex.europa.eu], Article 4 - Definitions

For the purposes of this Regulation:

(11) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

As you can see, consent must be freely given. This is a legally defined term, which amounts to the fact that consent for the collection of personal data which is not required for the performance of contract, is meant to not be treated as freely given - i.e. not be usable as a legal basis for processing.

GDPR[eur-lex.europa.eu], Article 7 - Conditions for consent

4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

As the requested personal data is not required for performance of the contract - i.e. finalizing the sale - yet performance of the contract requires supplying it anyway, whether supplied or not, it can never be legally used. Because by definition, it was not freely given.

This in fact means Valve is not even allowed to request; collect; or digitally transmit said data. All of those already constitute processing according to the GDPR's legal definition:

GDPR[eur-lex.europa.eu], Article 4 - Definitions

For the purposes of this Regulation:

(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

[Brian9824]

Publicado originalmente por RiO:

1. Personal data shall be:
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

Last year, the European Union (EU) released a proposal to tax revenues from certain digital activities of multinational corporations. However, the EU could not reach an agreement on the digital services tax proposal. Although the OECD is currently working on an international solution for digital taxation

There goal is to have a global unified tax scheme by the end of the year regarding digital taxes, and in the meantime nearly 1/2 of the EU is already working on their own version.

So considering they are actively discussing it and have it planned to be active within the year it seems perfectly reasonable to me.

Again if you feel that you know better then steam's lawyers your free to contact your legislators and pursue legal action against them.

Also again per EU law they are allowed to ask for address

https://www.export.gov/article?id=European-Union-How-the-EU-s-Value-Added-Tax-VAT-Impacts-U-S-Exports-2016

IV. Specific VAT rules on Electronically Supplied Services (ESS) to EU non-business customers (Article 58 of VAT Directive) From 1 January 2015, all supplies of telecommunications, broadcasting and electronic services will be taxable at the place where the customer is located. In the case of businesses, this means either the country where it is registered or the country where it has fixed premises receiving the service. In the case of consumers, it is where they are registered, have their permanent address, or usually live.

[Dr. Raven]

Publicado originalmente por brian9824:

Publicado originalmente por Dr. Raven:

This doesn't really seem like the norm to me, actually the opposite. No other site that I use requires this. And Steam is the only gaming platform I use now that requires it. I guess just another reason for console peasants to accurately brag about how consoles are superior. At least nintendo online store isn't asking for my address and phone number yet.

Again though, that information is far from private.

I would say my billing address, zip code, full name, and phone number are pretty private bits of information in this context.

[isomorphic_projection]

They call up on a agreement from 2006 with the EU, did not consider the EU constitution since then. And want to know in which country in the EU we live. They made an agreement with the EU so 15% vats is enough, by law.

[Crazy Tiger]

Member states still are free to set their own VAT, as long as it's a minimum of 15%. If you wish the VAT to decrease from 21% to 15%, you have to take it up with our government. They're the ones deciding that and they have that freedom, by EU directive.

[isomorphic_projection]

Publicado originalmente por Crazy Tiger:

Member states still are free to set their own VAT, as long as it's a minimum of 15%. If you wish the VAT to decrease from 21% to 15%, you have to take it up with our government. They're the ones deciding that.

You know how it is here, you must be a comedian. lol. No fun intended.

[Brian9824]

Publicado originalmente por Dr. Raven:

Publicado originalmente por brian9824:

Again though, that information is far from private.

I would say my billing address, zip code, full name, and phone number are pretty private bits of information in this context.

Not in the context of entering a legally binding contract that involves financial exchanges and purchases over the internet.

It's no different then what is asked for if I buy online at Amazon, walmart, bestbuy, target, etc.

[RiO]

Publicado originalmente por brian9824:

Publicado originalmente por RiO:

1. Personal data shall be:
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

Last year, the European Union (EU) released a proposal to tax revenues from certain digital activities of multinational corporations. However, the EU could not reach an agreement on the digital services tax proposal. Although the OECD is currently working on an international solution for digital taxation

There goal is to have a global unified tax scheme by the end of the year regarding digital taxes, and in the meantime nearly 1/2 of the EU is already working on their own version.

So considering they are actively discussing it and have it planned to be active within the year it seems perfectly reasonable to me.

Again if you feel that you know better then steam's lawyers your free to contact your legislators and pursue legal action against them.

"Working on" means it is not actual law yet, and until it becomes law and there is an actual legal obligation, Valve is not allowed to collect such data in the way they are doing now.

There is absolutely nothing "reasonable" about it.

It's nice that the OECD is trying to come up with a solution, but they are not an actual authority of law. The OECD is an advisory body and discussion forum with no direct power to enact or enforce. Anything coming out of the OECD will again have to walk the official path through the various bodies of EU government, where it will meet the same opposition that the original EU proposal encountered, from the same member states. Because it's a bloody stupid idea and it leads to absolute nuthouse solutions like what we're facing now.

The OECD was originally founded by the French and is still head-quartered in France. None too surprisingly, the most staunch vote in favor of digital taxation came from France who did enact it based on digital legislation and are in a lesser trade war with the USA over it.
I have yet to look up the details of the OECD working group that is handling this proposal for a global digital taxation solution, but I would not be one bit surprised if the roots behind it are political power-play by the French.

Publicado originalmente por brian9824:

Also again per EU law they are allowed to ask for address

https://www.export.gov/article?id=European-Union-How-the-EU-s-Value-Added-Tax-VAT-Impacts-U-S-Exports-2016

IV. Specific VAT rules on Electronically Supplied Services (ESS) to EU non-business customers (Article 58 of VAT Directive) From 1 January 2015, all supplies of telecommunications, broadcasting and electronic services will be taxable at the place where the customer is located. In the case of businesses, this means either the country where it is registered or the country where it has fixed premises receiving the service. In the case of consumers, it is where they are registered, have their permanent address, or usually live.

That excerpt states what a consumer's location should be based on, for the purpose of taxation. It does not state that business are thus entitled to ask for personal information confirming said location.

Again, the GDPR principle of data minimization applies: the minimal amount of sufficing data and no more.

E.g. if I pay for a transaction using a method of payment that is only available within my country of domicile, holding a bank account in said country of domicile which requires steady income - e.g. a pay-check from work, then the fact that said particular method of payment was used already suffices as a means to identify that revenue tax over said transaction needs to be paid to said country.

(All transactions presented to consumers are - by EU law - already required to be presented in the store front with taxes included. This means Valve does not need your personal details to tax you as a consumer.)

[Cryptic]

Publicado originalmente por brian9824:

Publicado originalmente por Dr. Raven:

I would say my billing address, zip code, full name, and phone number are pretty private bits of information in this context.

Not in the context of entering a legally binding contract that involves financial exchanges and purchases over the internet.

It's no different then what is asked for if I buy online at Amazon, walmart, bestbuy, target, etc.

I would say its slightly different. your not receiving a physical item.

[cinedine]

Publicado originalmente por brian9824:

Publicado originalmente por Dr. Raven:

I would say my billing address, zip code, full name, and phone number are pretty private bits of information in this context.

Not in the context of entering a legally binding contract that involves financial exchanges and purchases over the internet.

It's no different then what is asked for if I buy online at Amazon, walmart, bestbuy, target, etc.

Except they have to physically deliver the stuff to you.
Steam doesn't. RiO is completely right on this, this is a breach of the GDPR.

And if anyone else pulls the "legally required" card, it's quite amazing that only Steam now wants this info, isn't it?

[Brian9824]

Publicado originalmente por Cryptic:

Publicado originalmente por brian9824:

Not in the context of entering a legally binding contract that involves financial exchanges and purchases over the internet.

It's no different then what is asked for if I buy online at Amazon, walmart, bestbuy, target, etc.

I would say its slightly different. your not receiving a physical item.

Not really I can buy digital items at amazon and i'm required to provide the exact same information for instance. Also Steam sells physical items as well, so your argument fails.

[Brian9824]

Publicado originalmente por cinedine:

Publicado originalmente por brian9824:

Not in the context of entering a legally binding contract that involves financial exchanges and purchases over the internet.

It's no different then what is asked for if I buy online at Amazon, walmart, bestbuy, target, etc.

Except they have to physically deliver the stuff to you.
Steam doesn't. RiO is completely right on this, this is a breach of the GDPR.

And if anyone else pulls the "legally required" card, it's quite amazing that only Steam now wants this info, isn't it?

I guess you missed that amazon, bstbuy, etc for instance sells digital content as well. Also in case you forget Steam does sell physical items in addition to their digital content....

[RiO]

Publicado originalmente por brian9824:

Publicado originalmente por cinedine:

Except they have to physically deliver the stuff to you.
Steam doesn't. RiO is completely right on this, this is a breach of the GDPR.

And if anyone else pulls the "legally required" card, it's quite amazing that only Steam now wants this info, isn't it?

I guess you missed that amazon, bstbuy, etc for instance sells digital content as well. Also in case you forget Steam does sell physical items in addition to their digital content....

As long as you don't order anything that requires physical delivery, there is no requirement to provide physical address information.

This also goes for a billing address, btw. Legally there is no such concept as a mandatory billing address. There is only a legal requirement for the trader to make available the purchase details - i.e. the receipt - via a durable medium. E-mail services legally count as a durable medium and that's where Steam already sends receipts.