Department for Culture, Media & Sport Privacy Notice for R&D Science and Analysis Programme – Understanding player experiences of loot box protections
This notice is provided within the context of the notice provided to meet the obligations as set out in Article 13 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA).
Who is collecting my data?
The Department for Culture, Media & Sport (DCMS) helps to drive growth, enrich lives and promote Britain abroad.
We protect and promote our cultural and artistic heritage and help businesses and communities to grow by investing in innovation and highlighting Britain as a fantastic place to visit. We help to give the UK a unique advantage on the global stage, striving for economic success.
This website (“Website“) is run by the Department for Culture, Media & Sport (“we” and “us“, “DCMS“). DCMS is the controller for the personal information we process, unless otherwise stated.
Purpose of this Privacy Notice
This notice is provided within the context of the notice provided to meet the obligations as set out in Article 13 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) (this sets out the info we have to provide where the data is received directly from the data subject). This notice sets out how we will use your personal data as part of our legal obligations with regard to Data Protection.
The Department for Culture, Media & Sport’s personal information charter (opens in a new tab) explains how we deal with your information. It also explains how you can ask to view, change or remove your information from our records.
Privacy policies of other websites
https://www.public.io/privacy-policy
What is personal data?
Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject’. A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use and storage.
What personal data do we collect?
The personal information we collect and process for this project is provided to us directly by research participants via surveys and interviews conducted directly for this project and underpinned by full participant information and opt-out consent forms. This information includes:
- Gender and/or sex
- Age
- Video game usage and in-game spend
- Ethnic origin
- Country of residence
- Occupation
- Health
How will we use your data?
DCMS has commissioned PUBLIC and its subcontractors to deliver a project on Understanding player experiences of loot box protection, as part of the R&D Science and Analysis Programme. The project will follow two stages. Stage 1 will require the supplier to establish a methodology for working with loot box data and population samples. This stage is theoretical and will not require any data collection. Stage 2 will address key questions to assess the effectiveness of industry-led measures recently introduced to improve player protections. This stage will in part be underpinned by new data collected for this project.
Specifically, the new data collected for this project will be used to address the following DCMS research questions:
- What proportion of parents or guardians authorise their child’s loot box purchases (including those using technological controls, and those who authorise purchases via an offline arrangement with their child)?
- What proportion of children are purchasing loot boxes without their parent’s awareness and/or consent?
- Do all players purchasing loot boxes, including high spending players, have access to and awareness of spending controls and transparent information to support safe and responsible gameplay?
The findings of this research will inform the DCMS evidence base on lootboxes.
What is the legal basis for processing my data?
Note that we are only collecting data from individuals based on fully informed consent that may be withdrawn at any point.
To process this personal data, our legal reason for collecting or processing this data is: Article 6(1)
e. it is necessary to perform a public task (to carry out a public function or exercise powers set out in law, or to perform a specific task in the public interest that is set out in law)
The lawful basis that we rely on to process your personal data will determine which of the following rights are available to you. Much of the processing we do in DCMS will be necessary to meet our legal obligations or to perform a public task. If we hold personal data about you in different parts of DCMS for different purposes, then the legal basis we rely on in each case may not be the same.
What will happen if I do not provide this data?
Only research participants are asked to provide data via a survey or an interview. They may withdraw their consent from participation at any point and their data will not be processed any further beyond this point. Any processing that has taken place up to this point will remain unaffected.
Who will your data be shared with?
Data will not be shared outside PUBLIC, PUBLIC’s subcontractors for this project, and DCMS.
How long will my data be held for?
We will only retain your personal data for 2 years in line with DCMS retention policy:
- it is needed for the purposes set out in this document,
- it is necessary for archiving, research, or statistical purposes
Will my data be used for automated decision making or profiling?
We will not use your data for any automated decision making. If we need to do so, we will let you know.
Will my data be transferred outside the UK and if it is how will it be protected?
We will not send any data beyond the European Economic Area.
Links to other websites
Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices of the other websites you visit.
What are your data protection rights?
You have rights over your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The Information Commissioner’s Office (ICO) is the supervisory authority for data protection legislation, and maintains a full explanation of these rights on its website
DCMS will ensure that we uphold your rights when processing your personal data.
How do I complain?
Data Controllers Title: R&D Science and Analysis Programme Manager
Data Controllers Address:
Chief Scientific Adviser’s Office,
The Department for Culture, Media and Sport,
BLOC,
17 Marble Street,
Manchester,
M2 3AW
Data Controllers: csa@dcms.gov.uk
The contact details for the data controller’s Data Protection Officer (DPO) are:
Data Protection Officer
The Department for Culture, Media and Sport
100 Parliament Street
London
SW1A 2BQ
Email: dpo@dcms.gov.uk
If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer or the Data Protection Manager at the relevant agency. You can contact the department’s Data Protection Officer using the details above.
How to contact the Information Commissioner’s Office
If you believe that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. You may also contact them to seek independent advice about data protection, privacy and data sharing.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: www.ico.org.uk
Telephone: 0303 123 1113
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Changes to our privacy notice
We may make changes to this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.
If these changes affect how your personal data is processed, DCMS will take reasonable steps to let you know.
This notice was last updated on 06/12/2024.