How can I submit a GDPR request (e.g. delete account, rectify data, etc)?

Question

The GDPR gives us some rights, e.g. the right to be forgotten or to have one's data rectified. I submit this question and my answer, such that what I found might be easier for others to access.

E.g. a user wishing to be forgotten might be misled by questions such as How can I delete my account?. I hope the wording of this question might help others find this information.

E.g. a user wishing to rectify his email address might be misled, like this user in 2016, this user in 2017 and this moderator in 2019. Having one's data rectified should be complete and should not require inside knowledge.

I found various answers:

• this answer to How do I delete my entire Stack Exchange account? suggests to use the contact form, selecting the Other topic
• the announcement Brace yourselves: The GDPR is coming! shows a screenshot with GDPR -> Request Action on the side bar, which was not part of the SE/legal page anymore (which is actually a redirect to SO/legal)
• the question Can a GDPR request take up to a month to process? has a link to a form that allows to Submit a Data Access Request

There may be even more solutions that work and what works may change over time (at which point a new answer here might share new knowledge).

Answer 1

Update 2020-04-21 : rewrite

The way to submit a GDPR request is via the Submit a Data Access Request form form. Though this is on the StackOverflow domain you can use it to submit any GDPR request to StackExchange, just make sure to clearly describe what you want (e.g. for which SE sites). Also note that you will automatically receive an email with a link to confirm your GDPR request. If you overlook this / is lost in your spam you can wait for a long time I experienced :-) Also note that those mails come from privacy-support [AT] stackoverflow [DOT] email so you might want to white-list that address and might be able to alert SE in case of problems with the GDPR form.

I have two experiences to share with this form:

• Dec 2019 - SE network wide removal of account

  I originally did this via the contact form, selecting the Other topic and received a swift reply asking me to use the Submit a Data Access Request form instead. My experience with the GDPR form was in this instance very good: the complete process was finished within minutes.

• Jan 2020 - SE network wide correction of email address

  After confirmation of the request by me I got no reply for 6 weeks, so I sent a reminder by mail. 3 weeks after the reminder I got a fairly boilerplate reply:

  Unfortunately, the Data Access Request you submitted cannot be fulfilled at this time for the following reason:

  We have a legal obligation that requires us to decline this request.

  If you have additional questions, please reply to this email and someone from our privacy team can assist you.

  Sincerely, The Stack Overflow Team

  Of course I still have questions, most obvious: what legal obligation would require you to not correct an email address that will become obsolete in the near future? I am now waiting for an answer to that question for almost 4 weeks... The problems with Corona might not help things, but do not justify that the only result in over 3 months since my confirmation of the GDPR request is one boilerplate email "We have a legal obligation that requires us to decline this request."... I do believe this is an important process and I believe that SE believes this is an important process, so I hope they are able to fix this in the future (please share some more positive experience if you have it in the comments).

With regards to changing your email address: with the help of @animuson via comments I learned the following:

• You can update your email address via the Edit Email Settings page (make sure to insert / use your own user ID in this URL).
• You can add the new email address via the "add more logins..." button on the My Logins page (make sure to insert / use your own user ID in this URL).
• Even though this My Logins page linked is part of the Meta SE domain, the changes are network wide.
• Allow some time / refreshes for your new credentials to show up under the Stack Exchange heading of your My Logins page (for me it sticked for a couple of minutes under the Other heading on that page).
• You can then remove the old credentials (and your old email) yourself from that My Logins page.
• I will now submit a new GDPR request to ask for confirmation that my old email address is indeed removed from all systems (I am a bit defensive, see the 3 links with surprises others had in the past when it comes to completely changing your email address). Hopefully a positive update on that in the near future.
• Based on the comments it seems debatable whether my request should have been declined: the address is valid / verified, so one might say it is not about correcting wrong information, so one might say SE is not obliged to change it to something else. I do not have an opinion on it. It might have been nice if their reply was a bit more helpful like the help I got from @animuson. Maybe my wording of the request (make sure the old email is replaced everywhere in the system) was a bit intimidating to the employee that handled the mailbox that day :-) Who knows. No hard feelings. I just hope the above helps others solve their requests.