Do you have to provide the name and email address of your data protection officer?
<p>Looking at <a href="https://store.steampowered.com/privacy_agreement/" rel="nofollow noreferrer">Steam's privacy policy</a>, they don't provide an email address to reach the DPO nor do they name them:</p>

<blockquote>
  <p>You can contact Valve's data protection officer at the address below. </p>
  
  <p>While we review any request sent by mail, please be aware that to combat fraud, harassment and identity theft, the only way to access, rectify or delete your data is through logging in with your Steam User Account at <a href="http://help.steampowered.com" rel="nofollow noreferrer">http://help.steampowered.com</a> and selecting the menu items -> My Account -> View Account Data. </p>
  
  <p>Valve Corporation<br>
  Att. Data Protection officer<br>
  P.O. Box 1688<br>
  Bellevue, WA 98009</p>
  
  <p>European representative for data protection questions:</p>
  
  <p>Valve GmbH<br>
  Att. Legal<br>
  Rödingsmarkt 9<br>
  D-20354 Hamburg<br>
  Germany</p>
</blockquote>

<p>Is there any requirement for them to provide an email address or name the DPO? </p>

<p>Articles 13 and 14 discuss what information must be provided to the data subjects, for example via a privacy policy. Art 13(1) requires:</p>

<blockquote>
  <p>(a) the identity and the contact details of the controller, and where applicable, of the controller's representative;</p>
  
  <p>(b) the contact details of the data protection officer, where applicable;</p>
</blockquote>

<p>The quote you have shown contains both the identity and contact details (postal address) of the representative, and the contact details (postal address) of the DPO. This seems to comply with the letter of the law.</p>

<p>Respectfully, I would dissent from both legs of <a href="https://law.stackexchange.com/a/38643/10">amon's answer</a>, for multiple reasons.</p>
<p>SHORT ANSWER</p>
<p>As to contact details, in this instance Steam should provide two or more methods of contact, at least one of which must be electronic. The electronic point applies to almost all controllers; the multiple methods point applies only to a few, which likely includes Steam.</p>
<p>As to any naming requirement, this is merely inferable (from the DPO's statutory duties) but (because of maintenance costs and proportionality) I would regard it as only a minor breach <em>unless</em> the controller actively refuses, upon request, to name the DPO (following, of course, the data subject's electronic request).</p>
<p>EXPLANATION</p>
<p>There are a number of circumstances in respect of various data subject rights in which, especially as an &quot;information society&quot; enterprise, Steam's &quot;policy&quot; likely amounts, in and of itself, to breach. A webform would seem to be the bare minimum required, given (for example) <a href="https://www.gdpr360.com/gdpr#art12(1)" rel="nofollow noreferrer">Article 12(1)</a> as expressly clarified by <a href="https://www.gdpr360.com/gdpr#rec59" rel="nofollow noreferrer">Recital 59</a>: <em>&quot;The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means.&quot;</em> Both of these provisions are engaged by the instant context of facilitating the exercise of data subject rights. EDIT: see also <a href="https://www.gdpr360.com/gdpr#art21(5)" rel="nofollow noreferrer">Article 21(5)</a>: <em>&quot;In the context of the use of information society services... the data subject may exercise his or her right to object by automated means using technical specifications.&quot;</em></p>
<p>Additionally, <em>especially</em> in respect of Steam's named German office (Valve GmbH) several EU nations may impose more onerous obligations on controllers by way of mandating provision of alternative contact methods. I've seen case law on this, if I recall correctly, in 2018 at CJEU level re German law, but I can't immediately identify it, apologies.</p>

gdpr european-union data-protection