Chat messages and SO Jobs data are missing from the GDPR Data Access Request JSON dump

Question

I just recently learned about the automated service provided by Stack Exchange for handling GDPR Data Access Requests. So, of course, I tried it out, and indeed promptly received a 13 megabyte zip file (reference code GDPR-P20210515-3112) supposedly containing all data SE has about me.

However, while the data I received is quite interesting, it does not seem to actually be complete. In particular:

• The /chat folder only includes, for each of the three SE chat servers I've used (chat.stackoverflow.com, chat.stackexchange.com and chat.meta.stackexchange.com), files named ActiveRooms.json, Events.json, User.json, Votes.json and (for chat.meta.stackexchange.com only) Schedule.json. None of these files seems to contain chat messages that I've written. In fact, searching the entire zip archive for known substrings from my past chat messages turns up no results.

  For a specific example, this chat message (posted by me in 2016 and still clearly present on SE servers) contains the substring "Wednesday here for 45 minutes". This string does not appear in any of the JSON files included in the archive I received.

• Also, the /jobs directory that's (according to readme.txt included in the archive) supposed to contain "Your personal data associated with activity on Stack Overflow’s Jobs site (for candidates) and Stack Overflow Talent (for employer accounts)" is entirely missing from the archive I received, even though I've used SO Jobs actively in the past and Stack Exchange clearly still retains data about my activity there.

  In particular, I searched the entire archive for some phrases from my past job applications and from messages in my Jobs inbox and found none of them in the archive. (My Developer Story and job preferences do seem to be included, but they're under /qa/stackoverflow.com for some reason.)

• Also, while the job preferences dump does contain the filename of my saved resume, an actual copy of the resume doesn't seem to be included, even though the archive claims to contain "a copy of all your personal data associated with your account." While I'm not a lawyer or an expert on the GDPR, it seems to me that the least SE should do, if they don't want to include the resume itself in the data archive, would be to clearly indicate e.g. in the readme file that they're storing it (no, just having a filename buried in a huge JSON dump isn't enough) and provide a link to download it.

There might be more things missing, but these are just what I noticed in a few minutes of casual examination. In any case, it's not really my job to try and guess what data SE might have about me beyond what's included in the archive. Rather, it's Stack Exchange's responsibility to comply fully with all valid GDPR subject access and data portability requests.

FWIW, I don't think any of these omissions are deliberate or malicious — it would be pretty silly for SE to e.g. provide me with detailed information about when I've entered and left each chat room and which messages I've starred, but leave out the obvious and easily discoverable data about what I've posted in chat. It seems much more likely to me that these omissions are simply caused by bugs, perhaps due to changes made to how SE stores this data since the GDPR data access service was implemented.

But they still should be fixed.

(Also, while you're at it, could you please fix the zip file generator to use normal slashes instead of backslashes after the site part in the file names? That would make the archive much easier to browse on non-Windows systems.)

---

Ps. Just to make this a formal request, I am hereby invoking my rights to data access and data portability, as granted to me as a citizen of an EU member state by the EU GDPR, and requesting that Stack Exchange, Inc. provide to me without undue delay:

• a copy of any personal data and other supplementary information relating to me that they possess, including
• a copy in a commonly used machine-readable structured format of any personal data that I have provided to them, either explicitly or as a result of using their services, including but not limited to any recorded website usage and search history, and specifically including the missing data identified above.

This request has also been sent (with minor amendments) to [email protected] (Jira ticket # PRIVACY-1474).

Answer 1

The /jobs data export has now been fixed for GDPR requests. Please generate another export request and the data should be there.

Regarding the /chat data: We will not be including that in the data export after internal discussions, we'll include messages sent to public chatrooms to GDPR requests. While we don't have a set date for when this will be live, we'll report back here when it is.

Update: Starting on July 19th, we're now exporting all content for your messages in public chatrooms in the data export, including ones that were later deleted/removed. The content of an event is not included for messages that are not your own - for example, if as a moderator, you've edited another user's message. However, metadata is still included for events targeting messages that are not your own. Please let us know if you find any problems with it.

Answer 2

IANAL, but IMHO chat messages should be included in GDPR data dumps.

"Personal data" are defined in the GDPR (art. 4 no. 1) as "any information relating to an identified or identifiable natural person ('data subject')". Given that email addresses are identifying information, most data relating to your account can be considered personal. A relation is a meaningful connection between two things, IMHO the connection "said in chat" is meaningful, so chat messages should be personal data.

Thus they should also be included in the data dump. Art. 15 par. 3 says "The controller shall provide a copy of the personal data undergoing processing"; given that "processing" includes storage (art. 4 no. 2), chat messages are still undergoing processing and should therefore be eligible for a request of a copy.

Furthermore we have art. 20 (right to data portability), which says that the data subject shall have the right to receive the personal data concerning them which they have provided to the controller if the processing is based on consent or a contract and the processing is carried out by automated means. Given that the relevant chat messages were written and submitted by the OP, it is IMHO very clear, that they have provided them to the controller. AFAICT (and the privacy policy generally confirms), SE bases their processing on contractual obligations (aka providing the site under the ToS) and on your consent. And given that it's a website, the automated processing thing is applicable too.

To the objection that messages might contain personal data of other users: I don't really see this as a concern. GDPR only allows to deny the requests of art. 15 and 20 in case of adverse effects on the rights and freedoms of others (art. 15 par. 4, art. 20 par. 4). Given that the messages were written by the OP, all information inside those have already been -- at some point of time -- known by them. Furthermore they are all already public and could be scraped from the site, even by third parties. Given that, I can't see how giving the OP formal access to them could be in any way adverse.

Therefore I think SE should give access to these data in the GDPR dump too. Especially, as it is in their own interest too, as the OP could, if they wanted to, complain to any EU supervisory authority (which could possibly impose administrative fines) or even sue SE in their local jurisdiction (Finland iirc), possibly even for (non-)material damages... 🙃