Library

Guide RGPD pour les Développeurs de Jeux Vidéo

• The GDPR significantly increases potential penalties for non-compliance, with fines up to 20 Million Euros or 4% of annual global turnover, a substantial increase from the previous 3 Million Euros maximum under the 1978 French law.
• Data Protection Officers (DPOs) are not held responsible for GDPR non-compliance; the data controller or processor bears this responsibility. DPOs cannot be penalized for performing their duties due to their independence, though they can be dismissed for reasons unrelated to their DPO role.
• Consent under GDPR must be a free, specific, informed, and unambiguous indication of the data subject's wishes, given by a statement or clear affirmative action, and the data controller must be able to prove valid consent.
• Processing 'sensitive data' (special categories of personal data) is generally prohibited unless specific exceptions apply, such as explicit consent from the data subject for defined purposes.
• Data controllers must facilitate the exercise of data subjects' rights (access, rectification, erasure, etc.), responding within one month (or two for complex cases) and providing reasons if a request is denied, with these services generally being free unless requests are unfounded or repetitive.