Update 2020-04-2021 : My more recent experience is not as great as described below:
GDPR-R20191223-1354 asking to correct my email address was confirmed by me 2020-01-17. On 2020-03-02 I had to sent a reminder. On 2020-03-25 I finally got the reply SE was legally not allowed to process my request. I asked for clarification 2020-03-26, again no response (now waiting almost a month). Sharing this such others may enter the process with realistic expectations. I hope this will be fixed soon. rewrite
My personal experience as of Dec 2019 with requesting (SE wide) removal of my (other) account via the contact form, selecting the Other
topic, was a swift reply asking meThe way to usesubmit a GDPR request is via the Submit a Data Access Request form form. Though this is on the StackOverflow domain you can use it to submit any GDPR request to StackExchange, just make sure to clearly describe what you want (e.g. for which SE sites). Also note that you will automatically receive an email with a link to confirm your GDPR request. If you overlook this / is lost in your spam you can wait for a long time I experienced :-) Also note that those mails come from privacy-support [AT] stackoverflow [DOT] email
so you might want to white-list that address and might be able to alert SE in case of problems with the GDPR form.
My experienceI have two experiences to share with thatthis form was very:
Dec 2019 - SE network wide removal of account
I originally did this via the contact form, selecting the Other
topic and received a swift reply asking me to use the Submit a Data Access Request form instead.
My experience with the GDPR form was in this instance very good: the complete process was finished within minutes.
Jan 2020 - SE network wide correction of email address
After confirmation of the request by me I got no reply for 6 weeks, so I sent a reminder by mail. 3 weeks after the reminder I got a fairly boilerplate reply:
Unfortunately, the Data Access Request you submitted cannot be fulfilled at this time for the following reason:
We have a legal obligation that requires us to decline this request.
If you have additional questions, please reply to this email and someone from our privacy team can assist you.
Sincerely,
The Stack Overflow Team
Of course I still have questions, most obvious: what legal obligation would require you to not correct an email address that will become obsolete in the near future? I am now waiting for an answer to that question for almost 4 weeks...
The problems with Corona might not help things, but do not justify that the only result in over 3 months since my confirmation of the GDPR request is one boilerplate email "We have a legal obligation that requires us to decline this request."... I do believe this is an important process and I believe that SE believes this is an important process, so I hope they are able to fix this in the future (please share some more positive experience if you have it in the comments). It was completely handled within minutes:
With regards to changing your email address: with the help of @animuson via comments I learned the following:
- You can add the new email address via the "add more logins..." button on the My Logins page (make sure to insert / use your own user ID in this URL).
- Even though this My Logins page linked is part of the Meta SE domain, the changes are network wide.
- Allow some time / refreshes for your new credentials to show up under the Stack Exchange heading of your My Logins page (for me it sticked for a couple of minutes under the Other heading on that page).
- You can then remove the old credentials (and your old email) yourself from that My Logins page.
- I will now submit a new GDPR request to ask for confirmation that my old email address is indeed removed from all systems (I am a bit defensive, see the 3 links with surprises others had in the past when it comes to completely changing your email address). Hopefully a positive update on that in the near future.
- Based on the comments it seems debatable whether my request should have been declined: the address is valid / verified, so one might say it is not about correcting wrong information, so one might say SE is not obliged to change it to something else. I do not have an opinion on it. It might have been nice if their reply was a bit more helpful like the help I got from @animuson. Maybe my wording of the request (make sure the old email is replaced everywhere in the system) was a bit intimidating to the employee that handled the mailbox that day :-) Who knows. No hard feelings. I just hope the above helps others solve their requests.