Personal information before buying stuff

[S!cko]

Hi there!

Just wanted to buy something from the community market and I realized I now have to type in my whole ♥♥♥♥♥♥♥ personal stuff - real name, adress etc, what the ♥♥♥♥ is going on? Is this even legal?? I doubt it is...

What is the reason for that? And can we do something about it? Tthis is violating the data privacy.

It was never neccessary why would it be NOW? Also, why is it needed in the community market? It just doesn't make sense to me, we are not ordering actual physical stuff which has to be SHIPPED to us.

[crunchyfrog]

GuRu Asaki の投稿を引用：

;2451595019863196436 の投稿を引用：

I'll just link you to the previous thread I posted in...



https://steamcommunity.com/discussions/forum/1/2451595019856043695/#c2451595019856056570

:qr:

You had to ask a Valve Employee?

I dont believe other Platforms do this, & I am not buying this info the Valve Employee had told you...

No Laws were made to make this a Requirement... Not that I was aware of...

Also, the whole Privacy issue was Disbanded back in March, due to the Corona Virus outbreak, but companies still continue to collect Private Info from their Customers...

Some News Reporters & some Celeberties were even starting to ask the question...

What all this Private Data being collected is even for? Even they are starting to worry about it...

Yeah, but here's the thing - if you don't know what it's for then you can NEVER make the argument that it's being used for ill.

That's a massive argument from personal incredulity fallacy.

I never buy fearmongering anyway. This reminds me of one particular set of individuals that would contact our local council when I served on it, going on about how we needed more police on the streets.

It didn't matter that our crime rate is incredibly low, nor that police being "on the beat" does NOTHING to stop crime. The only relevance it has is if they coincidentally catch a crime in the act, which is so rare as to be negligible.

Yet still they persisted even after this evidence was presented.

Fear of the problem is quite different to an actual, demonstrable problem.

[WolfEisberg]

JVC の投稿を引用：

Eisberg の投稿を引用：

You guys pay VAT which is a county tax, any postal code in the UK is sufficient. In the US, sales tax is done by state and zip codes don't cross state borders.

No, postal code is sufficient enough for sales tax purposes.

The tax authority in each country where VAT applies decides what documentation they demand.

Valve and similar companies are obliged to collect said tax on behalf of the countries that levy it, in this case EU countries.

What each EU country wants as documentation is incribed in national laws and regulations, it isn't in an EU directive.

And your analogy with the postcal code doesn't work. Revenue agencies will demand samples of these data to determine if they look solid. If not the revenue agency has the power to write a bill to Valve based on the revenue agency's estimate of the amount of VAT owed. So companies want to avoid this.

Demanding a full address is one step on the way to ensure that people are taxed correctly. Instead of people jumping through hoops to fake that they live in countries where prices and taxes are lower. I collected the same data on all sales back when I ran my employer's webshop in Denmark.

I call absolute BS on that, because Valve is the only one that is even asking for complete information, nobody else does. Sorry, but you are wrong, and Valve is asking for way to much information that they do not even need.

Again, a Postal code is sufficient, they do not need full address for a sales tax.

[crunchyfrog]

Eisberg の投稿を引用：

JVC の投稿を引用：

The tax authority in each country where VAT applies decides what documentation they demand.

Valve and similar companies are obliged to collect said tax on behalf of the countries that levy it, in this case EU countries.

What each EU country wants as documentation is incribed in national laws and regulations, it isn't in an EU directive.

And your analogy with the postcal code doesn't work. Revenue agencies will demand samples of these data to determine if they look solid. If not the revenue agency has the power to write a bill to Valve based on the revenue agency's estimate of the amount of VAT owed. So companies want to avoid this.

Demanding a full address is one step on the way to ensure that people are taxed correctly. Instead of people jumping through hoops to fake that they live in countries where prices and taxes are lower. I collected the same data on all sales back when I ran my employer's webshop in Denmark.

I call absolute BS on that, because Valve is the only one that is even asking for complete information, nobody else does. Sorry, but you are wrong, and Valve is asking for way to much information that they do not even need.

Again, a Postal code is sufficient, they do not need full address for a sales tax.

Nope, a postal code is not sufficient as I pointed out with evidence above.

And once again, it's largely moot because there's ZERO evidence anything is or can be done with this data. It has to be encrypted by law, so it's not as if it'll get hacked or anything.

Name and address scaremongering is all this is. I don't know why people still think this info can cause a load of issues for people anymore.

[gamerhelligon]

Let's not forget that Valve also used to ask for social security and phone numbers at one time as well. (Well before taxes were a thing.)

They were not needed and have since been taken away.

So excuse me when a company that has already lied about needing info once decides it needs info again (that it does not really need).

What next, they need to know my mothers maiden name, what type of pet do I have and what is it's name, how many flowers are in my yard, and how many cars do I own?


The point has been made that Valve is asking for more info than they really need and due to what they have asked for in the past and did not need, excuse me for not just giving them anything they want "Just cuz they say so".

[crunchyfrog]

gamerhelligon の投稿を引用：

Let's not forget that Valve also used to ask for social security and phone numbers at one time as well. (Well before taxes were a thing.)

They were not needed and have since been taken away.

So excuse me when a company that has already lied about needing info once decides it needs info again (that it does not really need).

What next, they need to know my mothers maiden name, what type of pet do I have and what is it's name, how many flowers are in my yard, and how many cars do I own?


The point has been made that Valve is asking for more info than they really need and due to what they have asked for in the past and did not need, excuse me for not just giving them anything they want "Just cuz they say so".

Ah but did they LIE?

Or did they jkust remove it because they realised it wasn't necessary? That's a bold claim you'd need to demonstrate with evidence of Valve lying about it.

[Brian9824]

crunchyfrog の投稿を引用：

gamerhelligon の投稿を引用：

Let's not forget that Valve also used to ask for social security and phone numbers at one time as well. (Well before taxes were a thing.)

They were not needed and have since been taken away.

So excuse me when a company that has already lied about needing info once decides it needs info again (that it does not really need).

What next, they need to know my mothers maiden name, what type of pet do I have and what is it's name, how many flowers are in my yard, and how many cars do I own?


The point has been made that Valve is asking for more info than they really need and due to what they have asked for in the past and did not need, excuse me for not just giving them anything they want "Just cuz they say so".

Ah but did they LIE?

Or did they jkust remove it because they realised it wasn't necessary? That's a bold claim you'd need to demonstrate with evidence of Valve lying about it.

Yep and that was also during a time when the IRS itself wasn't even sure how to handle digital market sales and their laws were constantly changing. I don't have an archive over all the old law articles but wouldn't be surprised to have seen the issue with the SSN was on the IRS itself not clarifying exactly what they needed. They have done it before.

[endrsgm]

the part Brian REFUSES to get is that valve isn't playing lawyer. it's not their job to prove anything. period. all they have to do is make a good faith effort.

for the vast overwhelming majority of the world an ip is a valid data point. for the decimal point its not then maybe valve needs a 3rd data point (they need 2 non contradictory data points). but that's a big maybe. because it needs to he contradictory to get a 3rdd point. if you say you live in the USA (for example) and your ip shows you as living on the border between Canada and the USA then that doesn't contradict it, it just doesn't 100% confirm it. but the law didn't say to 100% prove it, it said the data can't definitely contradict it. whereas if I said I lived in the usa but my ip shows as being in Italy then it would.

if I said I lived in luxembourg and my ip said maybe there, maybe France, maybe Belgium, maybe Germany it still doesn't contradict it. again, it's not valves job to be Internet cop.

in fact the second major law involved is the privacy law. it's says not to collect more than needed bare minimum and to basically err on the side of less info than more.

all ecommerce taxes are collected national or state level except Chicago. its the only city in world collecting etaxes. let's pretend I'm in Chicago. in every other case in the world it doesn't matter what city I'm in, instead it matters what state or what country. but in this case its the single case my city matters.
in which case it should go as valve askss >are you in USA? and if yes are you in illinois? and if yes a are you in Chicago?

so then explain to me... WHY IS VALVE ASKING THE STREET ADDRESS?
most restrictive geographical tax in the world. isnt national or state, is city. so tell me does Chicago tax ecommerce differently if your address is main street vs 1st avenue? nope.

which is where the argument for all this collapses. obviously your street address doesn't impact national, state, or city levied exommerce taxes. nor did your phone number when valve wanted that too.

[GunsForBucks]

I still think the easiest way would be to put some data identifier that shows the point of sale of the card when it gets activated when sold. This could be cross checked with postal code and IP, only if there are suspect inputs should they ask for an address.. and even then they don't need a name. I seriously doubt they are actually checking names for tax purposes.

This all seems like steam just was lazy about implementation and don't care since they are so big. They feel they can do whatever they want and you just have to take it up the rear.

[ReBoot]

endrsgm の投稿を引用：

so then explain to me... WHY IS VALVE ASKING THE STREET ADDRESS?

The street address is a part of your legal address.

[Brian9824]

endrsgm の投稿を引用：

for the vast overwhelming majority of the world an ip is a valid data point

That is so laughable that its funny. For the majority of the world a dynamic IP address isn't even considered personal data unless its an ISP that is using the data which has the ability to correlate that back to a user.

Now a static IP address CAN be considered personal data as that links back to specific device, but 99% of users on steam aren't going to have that.

That goes for the US and EU.

[Brian9824]

GunsForBucks の投稿を引用：

I still think the easiest way would be to put some data identifier that shows the point of sale of the card when it gets activated when sold. This could be cross checked with postal code and IP, only if there are suspect inputs should they ask for an address.. and even then they don't need a name. I seriously doubt they are actually checking names for tax purposes.

This all seems like steam just was lazy about implementation and don't care since they are so big. They feel they can do whatever they want and you just have to take it up the rear.

Again though, per the law gift cards CANNOT be taxed. The address in which you bought a gift card means NOTHING. It has no value whatsoever for tax purposes.

I could buy a $20 giftcard in a state with no tax, and a $20 gift card in a state with 5% tax and a $20 gift card in a state with 7% tax.

When I use that money to buy a $60 game I don't pay 3 different tax rates. I pay one tax rate based on where I live WHEN I MAKE THE PURCHASE.

The ONLY thing that matters is where you live and what your billing location is when the gift card is used.

[cinedine]

brian9824 の投稿を引用：

endrsgm の投稿を引用：

for the vast overwhelming majority of the world an ip is a valid data point

That is so laughable that its funny. For the majority of the world a dynamic IP address isn't even considered personal data unless its an ISP that is using the data which has the ability to correlate that back to a user.

Now a static IP address CAN be considered personal data as that links back to specific device, but 99% of users on steam aren't going to have that.

That goes for the US and EU.

Funny as the GDPR explicitely states that IP addresses are personal data.

https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en
https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/

Oh well, don't let actual law recitals hinder your arm-chair lawyering, though.

[Brian9824]

cinedine の投稿を引用：

brian9824 の投稿を引用：

That is so laughable that its funny. For the majority of the world a dynamic IP address isn't even considered personal data unless its an ISP that is using the data which has the ability to correlate that back to a user.

Now a static IP address CAN be considered personal data as that links back to specific device, but 99% of users on steam aren't going to have that.

That goes for the US and EU.

Funny as the GDPR explicitely states that IP addresses are personal data.

https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en
https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/

Oh well, don't let actual law recitals hinder your arm-chair lawyering, though.

Yep, an IP address when static for instance IS personal data.

Now an IP address of 192.11.13.145 that is assigned to a different person every day is NOT personal data, UNLESS the person assigning that address is the one using it.

That is what the courts have ruled in both the US and EU - https://bluecatnetworks.com/blog/ip-addresses-considered-personally-identifiable-information/

In 2016, the Court of Justice of the European Union provided an answer. Ruling in Breyer v. Germany that IP addresses can be considered PII – in certain circumstances.

The case was brought against an ISP, and the court ruled that the company had enough correlating data at its disposal to make an IP address de facto PII for any of its customers. The court limited its ruling, saying that with just an IP address alone, the protections associated with the Directive wouldn’t apply. This essentially splits the difference in the same way that US courts have ruled.

They ruled against the ISP because they had the ability to correlate the address but made it very clear when they stated

The court limited its ruling, saying that with just an IP address alone, the protections associated with the Directive wouldn’t apply.

Hence why its been repeatedly mentioned playing armchair lawyer is something best left to the experts as people can cite laws all they want without actually knowing how the courts interpret those laws.

Points 20 and 21 are they key ones

20 According to the court of appeal, a dynamic IP address, together with the date on which the website was accessed to which that address relates constitutes, if the user of the website concerned has revealed his identity during that consultation period, personal data, because the operator of that website is able to identify the user by linking his name to his computer’s IP address.

21 However, the court of appeal held that Mr Breyer’s action could not be upheld in other situations. If Mr Breyer does not reveal his identity during a consultation period, only the internet service provider could connect the IP address to an identified subscriber. However, in the hands of the Federal Republic of Germany, in its capacity as provider of online media services, the IP address is not personal data, even in combination with the date of the consultation period to which it relates, because the user of the websites concerned is not identifiable by that Member State.

IP address is only personal data under a very narrow scope that being if its static and/or being used by an agency with the capability of connecting the IP back to user aka an ISP.

cinedine の投稿を引用：

Oh well, don't let actual law recitals hinder your arm-chair lawyering, though.

Might want to look in a mirror there.......

[GunsForBucks]

brian9824 の投稿を引用：

GunsForBucks の投稿を引用：

I still think the easiest way would be to put some data identifier that shows the point of sale of the card when it gets activated when sold. This could be cross checked with postal code and IP, only if there are suspect inputs should they ask for an address.. and even then they don't need a name. I seriously doubt they are actually checking names for tax purposes.

This all seems like steam just was lazy about implementation and don't care since they are so big. They feel they can do whatever they want and you just have to take it up the rear.

Again though, per the law gift cards CANNOT be taxed. The address in which you bought a gift card means NOTHING. It has no value whatsoever for tax purposes.

I could buy a $20 giftcard in a state with no tax, and a $20 gift card in a state with 5% tax and a $20 gift card in a state with 7% tax.

When I use that money to buy a $60 game I don't pay 3 different tax rates. I pay one tax rate based on where I live WHEN I MAKE THE PURCHASE.

The ONLY thing that matters is where you live and what your billing location is when the gift card is used.

I guess you can't read or just want to deny what I am saying.

It could be used as a cross check, as stated, and further info gathered if there is an anomaly.
Further info also does not need to include your name.

[Brian9824]

GunsForBucks の投稿を引用：

brian9824 の投稿を引用：

Again though, per the law gift cards CANNOT be taxed. The address in which you bought a gift card means NOTHING. It has no value whatsoever for tax purposes.

I could buy a $20 giftcard in a state with no tax, and a $20 gift card in a state with 5% tax and a $20 gift card in a state with 7% tax.

When I use that money to buy a $60 game I don't pay 3 different tax rates. I pay one tax rate based on where I live WHEN I MAKE THE PURCHASE.

The ONLY thing that matters is where you live and what your billing location is when the gift card is used.

I guess you can't read or just want to deny what I am saying.

It could be used as a cross check, as stated, and further info gathered if there is an anomaly.
Further info also does not need to include your name.

It can't be used to cross check, its a GIFT card. They are used for gifting by so many people it would fail so many times that it would be pointless.

That's not even counting that so many gift cards are bought on line, activated and shipped and not just bought in stores.

I mean no one in the world does what your suggesting in using gift cards to correlate where people live for a very good reason.....