DMarket: Difference between revisions

Line 32:

===DMarket requires submission of sensitive personal details to delete account.===

[[File:DMarket deletion "process" form screenshots.png|thumb|446x446px|[1] Shows the account deletion page on DMarket. [2] Shows the request submission form on DMarket. [3] Shows the "GDPR form" sent by DMarket support.]]To delete a DMarket account regardless if or any transactions were made, a user must submit a request on the DMarket websites ''[image-n1]'' that includes proof of ownership with screenshots and a detailed explanation. <ref>{{Cite web |title=Account deletion |url=https://support.dmarket.com/hc/en-us/articles/25102594718993-Account-deletion}}</ref> After submission ''[image-n2]'', DMarket support sends a "[[General Data Protection Regulation|GDPR]] form" ''[image-n3]'' requiring full name, government ID, home address and other personal data. This applies to accounts that have not completed "[[KYC]]" (Know Your Customer) verification as well.

[[File:DMarket deletion "process" form screenshots.png|thumb|446x446px|[1] Shows the account deletion page on DMarket. [2] Shows the request submission form on DMarket. [3] Shows the "GDPR form" sent by DMarket support.]]To delete a DMarket account regardless if or any transactions were made, a user must submit a request on the DMarket websites ''[image-n1]'' that includes proof of ownership with screenshots and a detailed explanation. <ref>{{Cite web |title=Account deletion |url=https://support.dmarket.com/hc/en-us/articles/25102594718993-Account-deletion}}</ref> After submission ''[image-n2]'', DMarket support sends a "[[General Data Protection Regulation|GDPR]] form" ''[image-n3]'' requiring full name, government ID, home address and other personal data. This applies to accounts that have not completed "KYC" (Know Your Customer) verification as well.

This appears to violate [[General Data Protection Regulation|GDPR]]'s minimization principle <ref>{{Cite web |title=Art. 5 GDPRPrinciples relating to processing of personal data |url=https://gdpr-info.eu/art-5-gdpr/}}</ref>, as the personal data required to delete an account exceeds what was necessary to create the account.<ref>{{Cite web |title=You will NEVER be able to delete your account and unlinking your steam is a massive hassle. |url=https://www.reddit.com/r/csgomarketforum/comments/w8p4vi/psa_dmarket_is_sketchy_you_will_never_be_able_to/}}</ref> DMarket forces users to provide additional sensitive information than were not originally collected, which is disproportionate and potentially non-compliant with [[General Data Protection Regulation|GDPR]]. DMarket refuses to provide specific legal basis for why this information is needed, ''[image-n4]'' leaving users without justification. As a result, users are effectively prevented from exercising their Right to erasure <ref>{{Cite web |title=Art. 17 GDPRRight to erasure (‘right to be forgotten’) |url=https://gdpr-info.eu/art-17-gdpr/}}</ref> unless they disclose unnecessary personal information, undermining the foundation and the requirements of the regulation.

@@ Line 32: / Line 32: @@
 ===DMarket requires submission of sensitive personal details to delete account.===
-[[File:DMarket deletion "process" form screenshots.png|thumb|446x446px|[1] Shows the account deletion page on DMarket. [2] Shows the request submission form on DMarket. [3] Shows the "GDPR form" sent by DMarket support.]]To delete a DMarket account regardless if or any transactions were made, a user must submit a request on the DMarket websites ''<small>[image-n1]</small>'' that includes proof of ownership with screenshots and a detailed explanation. <ref>{{Cite web |title=Account deletion |url=https://support.dmarket.com/hc/en-us/articles/25102594718993-Account-deletion}}</ref> After submission ''<small>[image-n2]</small>'', DMarket support sends a "[[General Data Protection Regulation|GDPR]] form" ''<small>[image-n3]</small>'' requiring full name, government ID, home address and other personal data. This applies to accounts that have not completed "[[KYC]]" (Know Your Customer) verification as well.
+[[File:DMarket deletion "process" form screenshots.png|thumb|446x446px|[1] Shows the account deletion page on DMarket. [2] Shows the request submission form on DMarket. [3] Shows the "GDPR form" sent by DMarket support.]]To delete a DMarket account regardless if or any transactions were made, a user must submit a request on the DMarket websites ''<small>[image-n1]</small>'' that includes proof of ownership with screenshots and a detailed explanation. <ref>{{Cite web |title=Account deletion |url=https://support.dmarket.com/hc/en-us/articles/25102594718993-Account-deletion}}</ref> After submission ''<small>[image-n2]</small>'', DMarket support sends a "[[General Data Protection Regulation|GDPR]] form" ''<small>[image-n3]</small>'' requiring full name, government ID, home address and other personal data. This applies to accounts that have not completed "KYC" (Know Your Customer) verification as well.
 This appears to violate [[General Data Protection Regulation|GDPR]]'s minimization principle <ref>{{Cite web |title=Art. 5 GDPRPrinciples relating to processing of personal data |url=https://gdpr-info.eu/art-5-gdpr/}}</ref>, as the personal data required to delete an account exceeds what was necessary to create the account.<ref>{{Cite web |title=You will NEVER be able to delete your account and unlinking your steam is a massive hassle. |url=https://www.reddit.com/r/csgomarketforum/comments/w8p4vi/psa_dmarket_is_sketchy_you_will_never_be_able_to/}}</ref> DMarket forces users to provide additional sensitive information than were not originally collected, which is disproportionate and potentially non-compliant with [[General Data Protection Regulation|GDPR]]. DMarket refuses to provide specific legal basis for why this information is needed, ''<small>[image-n4]</small>'' leaving users without justification. As a result, users are effectively prevented from exercising their Right to erasure <ref>{{Cite web |title=Art. 17 GDPRRight to erasure (‘right to be forgotten’) |url=https://gdpr-info.eu/art-17-gdpr/}}</ref> unless they disclose unnecessary personal information, undermining the foundation and the requirements of the regulation.