{ "compartment_id": "section-18", "number": "Section 18", "title_local": "A GDPR access request closed without data", "title_english": "A GDPR access request closed without data", "source_url": "https://phishdestroy.io/steam_dossier/#gdpr-live-case", "source_document": "index.html", "content": { "html": "
\n
\n
\nPart C — Legal frameworks · Section 18 · GDPR Article 15 request\n

The request. The reply. The missing comparison.

\n\n

He asked for four things, one of them the log that would name whoever put an API key on his account. Three days later the ticket was closed with a link to a page that holds none of them — and the sentence used to close it is contradicted by Valve's own lawyers.

\n
\n
Whose account this is · Provenance & Limits
\n

These screenshots are not PhishDestroy's. They come from an ordinary Steam account holder — one respondent to a short survey run by this project, who filed the request himself and supplied the captures. The account is his, the ticket is his, and the correspondence is between him and Steam Support. This project did not submit the request, holds no account on the platform, and is not a party to this ticket.

\n

On 16 September 2026 he filed a GDPR/CCPA Article 15 subject access request asking specifically for API-key registration logs, login history with IPs, device authorisation history and trade history. On 17 September agent \"Logen\" referred him to the self-service Account Data page. On 18 September he stated that the requested categories were not on that page and asked for escalation to the Privacy Team or DPO. On 19 September agent \"Kal\" closed the ticket with the same referral. Both screenshots are preserved below (requester e-mail redacted; SHA-256 in steam_tos_assets/screenshot-manifest.json).

\n

He is a fitting requester for an ordinary reason: his account carries a Steam Web API key he did not create, registered to localhost. When it was created is not known — not to him, and not from anything Valve has made available to him, because the single record that would date it is the API-key registration log, which is exactly the category the closure withheld. The key is not new: it predates his awareness of it by an interval he cannot measure, for the same reason.

\n

Other account holders are filing the same request. Any reply that arrives will be added here on the same terms as these two — ticket number, capture date, SHA-256, requester redacted — whether it supplies the categories or refuses them.

\n

This project takes no position on why the ticket was closed. No reason was stated in it, and none is inferred here.

\n
\n
The request. The response. The comparison.FOLLOW THE RECORD
THE REQUESTSpecific categoriesAPI-key, login, device and trade records
THE RESPONSEAccount Data referenceInspect the support exchange
THE TESTWhat was supplied?Compare each requested category

He asked for four named categories. The Account Data page he was referred to is Valve's own self-service export, and this project cannot enumerate its contents for someone else's account — so no full category-by-category comparison is published here. What is on the record is his statement of 18 September that the categories were not there, and the closure of 19 September that repeated the referral without addressing them.

\n
\n
\n
Screen 1/2 — Request (16 Sep) and first reply, agent \"Logen\" (17 Sep)
\n
\n\"GDPR\n
\n
Source: help.steampowered.com, ticket HT-2YBP-F7JP-D4VB · captured 16–17 Sep 2026 · requester e-mail redacted 2026-09-21 · File: gdpr-ticket-1.png · SHA-256 da940c731ab9869d226e9d06ccc8a1b393738766b7b0c445a56662623e025a66 (screenshot-manifest.json).
\n
\n
\n
\n
Screen 2/2 — Escalation request (18 Sep) and closure, agent \"Kal\" (19 Sep)
\n
\n\"GDPR\n
\n
Source: help.steampowered.com, ticket HT-2YBP-F7JP-D4VB · captured 18–19 Sep 2026 · File: gdpr-ticket-2.png · SHA-256 44844ea7b251f7fd7d79f87ee1578a846606a97b9659d3a53b322120c422219b (screenshot-manifest.json).
\n
\n
\n
Closing response, 19 Sep (verbatim):
\n
\"The data Steam retains can already be found in your Account Data page. As there's no further information Steam Support can offer, this request will be closed.\"
\n
No data supplied · no legal basis for refusal stated · no escalation outcome shown
\n
That sentence is false, and Valve's own lawyers prove it. Counsel's letter of 1 October 2025, paragraph 1.9, describes device-level correlation linking one device to dozens of accounts (Appendix A). The same response carried 830 pages of retained records (Appendix B). None of it is on the Account Data page.
\n
\n
\n
\n
\n
Why this account asked for the API-key log
\n

He did not pick those four categories at random. The localhost key on his account is the mark of a script, not of a person typing a real domain into the developer page (Section 5, Section 6). The one record that shows who created it and from where is the API-key registration log. That was the first thing he asked for. That is what the closure withheld.

\n

Source: the account holder, during this project's survey. The ticket screenshots above are hashed; the key page is not published.

\n
\n
\n
Assessment · PhishDestroy
\n

Closing a ticket with the question still open is not an accident here. It is the normal outcome. We hold 16,319 preserved complaint and support records and 354 de-duplicated support exchanges drawn from them. This ticket is one dated, fully captured example of the shape they take.

\n
\n
\n
\n
\n
\nSupport Ticket — Preserved\nHT-2YBP-F7JP-D4VB\n
\n
\n
\n
\nRequest type\nGDPR Article 15 DSAR\n
\n
\nTicket status\nCLOSED 19 SEP 2026 — NO DATA SUPPLIED\n
\n
\n
\n
\nAgents in the exchange\n\"Logen\" (17 Sep), \"Kal\" (19 Sep)\n
\n
\nFiled\n16 Sep 2026\n
\n
\n
\nData requested\nWho registered the Web API key linked to this account, and from which IP / device / timestamp\n
\n
\nLegal basis cited\nGDPR Art. 15 — right of access to personal data\n
\n
\n
\nThe legal frame:\n Article 12(3) gives the controller one month from receipt (extendable with reasons). That period had not expired at publication, and this dossier does not assert a deadline breach.\n The objection is to the substance: the closing response links to a self-service page but does not show that the four named data categories were produced, and if the controller declines to act, Article 12(4) requires it to state the reasons and the complaint routes. Neither appears in the closing response.\n
\n
\n
\nWhy this specific data matters\n

\n The Web API key event log is the record that shows whether a third party registered a key using a stolen session cookie —\n the mechanism described in the inventory-theft complaints preserved in this dossier's archive.\n Disclosing who registered an API key, from which IP, and at what timestamp, would:\n

\n
    \n
  • Allow the victim to compare the API creation IP against their own login history
    • \n
  • Reveal data-centre IPs linked to known phishing / gambling bot infrastructure
    • \n
  • Produce evidence usable in civil or criminal proceedings against the actor
    • \n
  • Show whether the account holder was notified when the key was created
    • \n
\n
\nWhat the record shows: Valve retains device-level and account-correlation records — its counsel's letter of 1 October 2025 describes them (see Appendix A, Evidence Memorandum — Source 1).\n In ticket HT-2YBP-F7JP-D4VB the same class of records was requested by the data subject and the ticket was closed with a referral to a self-service page that the data subject reported did not contain them.\n Whether that refusal is lawful is a question for the supervisory authority; the effect is that the person the data concerns does not get it.\n
\n
\n
\n
\n
\n
\n\nThe exchange — four messages, three days\n
\n

\n Two Steam Support agents replied under first names shown on the ticket: \"Logen\" on 17 September and \"Kal\" on 19 September. Both referred the requester to the Account Data page. Nothing on the ticket shows whether the request reached Valve's Privacy Team or Data Protection Officer, and the dossier does not assert who the agents are, what their roles are, or how the ticket was routed.\n

\n
\n
\n
16 SEP
\n
Art. 15 request filed with four named data categories
\n
\n
\n
17–18 SEP
\n
Referral to Account Data; requester asks for DPO escalation
\n
\n
\n
19 SEP
\n
Ticket closed with the same referral; no data, no stated basis
\n
\n
\n
\n
\nWhat Article 15 GDPR explicitly entitles the subject to\n
\n
\nArt.15(1)(a)\nProcessing purposes — why Valve holds the data\n
\n
\nArt.15(1)(b)\nCategories of data — what Valve holds\n
\n
\nArt.15(1)(c)\nRecipients or categories of recipients — who received the data (e.g., API key holder)\n
\n
\nArt.15(1)(d)\nRetention period or criteria for determining it\n
\n
\nArt.15(3)\nA copy of the personal data undergoing processing — i.e., the API-key log itself\n
\n
\nART.12(3)\nResponse required within one month of receipt; an extension must be communicated within that month. The period had not expired at publication. Art. 12(4): if the controller does not act, it must state why and inform the subject of the complaint routes.\n
\n
\n
\n
\nRegulatory complaint pathway — for any user\n

\n Any user who submitted an Article 15 GDPR request to Valve and received no compliant response (or a template refusal without data) may file a complaint\n with the supervisory authority in their EU/EEA member state.\n Valve's EU establishment is Valve GmbH in Hamburg, so the lead supervisory authority for cross-border complaints is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI). (Valve's Article 27 representative is also located in Hamburg; a representative's address does not by itself determine the competent authority.) A complaint may also be filed with the authority of the complainant's own member state under Article 77.\n

\n
\n\n HmbBfDI complaint form ↗\n \n\n GDPR text (Art. 12, 15, 77) ↗\n archived 2026-09-20 ↗\n\n EDPB guidelines ↗\n \n
\n

\n Ticket reference for any complaint: HT-2YBP-F7JP-D4VB — preserved in this dossier as a documented instance.\n

\n
\n
\n
\n
\n
\nOne documented instance\n

The records exist; the data subject did not receive them.

\n

\n Valve's counsel described device-level correlation records in a letter of 1 October 2025. On 19 September 2026 an Article 15 request for the same class of records was closed with a referral to a self-service page the requester reported did not contain them, without a stated legal basis.\n Ticket HT-2YBP-F7JP-D4VB is one documented instance; whether it reflects a wider practice is a question for the supervisory authority, which can ask Valve for its handling records.\n

\n
\n
\nGDPR Articles 12, 15, 77 / Supervisory authority\n

\n A complaint under Articles 12 and 15 can be lodged directly with the relevant supervisory authority without cost (Article 77).\n The authority may impose corrective measures including orders to comply with the access request, and fines under Article 83(5)(b) for infringements of data-subject rights.\n Preserving the original ticket reference and any Valve response (or its absence) strengthens a complaint.\n

\nSee the DSAR template →\n
\n
\n
\n
" }, "original_content_sha256": "fa6319ee9d4f0391481c70248e0cbd46f6dd8021a47e6975146982e68ca221cb", "author_pseudonym": "Agent Viola", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_18_agent_viola.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_18_agent_viola.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_18_agent_viola.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_18_agent_viola.json", "signature_file": "steam_dossier_section_18_agent_viola.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_18_agent_viola.pdf", "sha256": "949d07f6cee83fd7579cdc6a1879791489a67ef453ebad127dc418e15a163533", "pages": 6 } }