33

Too Lawyerly; Didn't Read: Mods are explicitly not agents of SE, and no one but an agent is supposed to access the private info mods do access.

The moderator agreement on each site says (emphasis added):

I acknowledge and agree that I am an independent volunteer moderator to Stack Overflow and I am not an employee, agent or representative of Stack Exchange Inc.

Well and good, that's standard phrasing.

But the privacy policy says, in multiple places:

We almost never share any of your personal information with non-agent third parties […] Other than on Careers, we won’t share your personal information with non-agent third parties unless we are required to do so by law, or if we believe in good faith that disclosure is reasonably necessary to protect our property, rights or those of third parties or the public at large.

And earlier, where it might clarify this, it specifically distinguishes moderators from agents again (emphasis added):

When we collect your personal information, we’ll tell you how we’re using it, any types of third parties to which we might disclose it, (other than moderators or “agents,” such as vendors or contractors, who are only processing such information for us or at our direction), and the choices we offer you to limit the use of your information.

This distinction is upheld by a recent answer by Tim Post, the Director of Stack Overflow Communities that opens by saying (emphasis added):

Moderators are not agents or employees of Stack Exchange.

Moderators have the ability to access any user's PII without needing permission from anyone else, and although this access is logged and isn't exactly routine, it's not anywhere near as uncommon as the second quote would suggest. Taking these all together, the policy appears to say that ♦ moderators are not allowed to do what, in fact, they actually do. That's quite distressing.

4

Upon further reflection (on the occasion of another election into which I am shortly to enter), I think the existing language actually has a loophole that is sufficient — barely. Most access to PII is in cases where a user appears to be abusing the system; most of the rest appears to be in cases where a user is having trouble accessing their account. In the first case, it's not too much of a stretch to assert that the PII access is (or reasonably could be) necessary to preserve SE's right to enforce its Terms of Service that forbid users from abusing the system in various ways. In both cases, there is some risk of a legitimate user's right to access the system and maintain their content being lost, either by being confused with a malicious user, or by losing their login information.

I would still appreciate a wording improvement that makes it clearer what sorts of situations this applies in and removes the agent/non-agent confusion, and I wouldn't say no to official confirmation that the above two cases are essentially the only ones that matter. But I'm rather more confident now that this would actually stand up in court.

1

From the wording there, moderators and "agents" are two separate groups. "agents" are parties such as

vendors or contractors, who are only processing such information for us or at our direction

Removing the description of what an "agent" is, that statement reads

When we collect your personal information, we’ll tell you how we’re using it, any types of third parties to which we might disclose it, (other than moderators or “agents”)

which is simply stating that you will be informed of any third parties beyond moderators or the defined "agents" who have access to this personally identifying information. Moderators are clearly stated to have access to this information, so I don't see how this disallows any access by a moderator to this.

  • 1
    Sorry, that wasn't quite as clear as I'd intended. The last quote does not affect ♦ mod access, but it does reinforce that ♦ mods are not agents, and the previous two quotes (and others) forbid sharing PII with non-agents except under extreme circumstances. Taking these all together, that's what creates the problem. – Nathan Tuggy Sep 3 '15 at 22:11
  • 11
    I agree with Nathan Tuggy. This answer addresses the second quote from the privacy policy, but it ignores the first quote. In particular, look at the quote "we won’t share your personal information with non-agent third parties...". ♦-moderators are non-agent third parties, so that statement seems to be saying "we won’t share your personal information with ♦-moderators" -- which doesn't seem accurate. – D.W. Sep 4 '15 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .