91

As you all know, once in a while we have to update our Privacy Policy. Now is one of those times.

Here's what's different with today's update:

  • Safe Harbor has been replaced by the EU-US Privacy Shield. We updated all references to Safe Harbor and relevant links, as well as the logo at the bottom of the page. Along with that, there's an updated dispute resolution process.
  • The site formerly known as Stack Overflow Careers is now known as Stack Overflow Jobs for candidates and Stack Overflow Talent for employers. The Privacy Policy now correctly refers to those brands.
  • We have a new Data Protection officer.
  • Last but not least, all outgoing links are HTTPS. 🎉
Improve this question
25
  • 11
    Does any of this actually affect the lives of ordinary users who only care about Q&A? (I'm guessing not, except for the hoohah about editing old images from http to https.)
    – Rand al'Thor
    Mar 8, 2017 at 15:45
  • 14
    @randal'thor There's no fundamental functional change here this time, but the policy covers how we collect and use data on the entire network, Q&A included. In this case, EU residents are the users who are primarily potentially affected.
    – Adam Lear StaffMod
    Mar 8, 2017 at 15:51
  • 5
    @randal'thor Yes. Even though Privacy Shield is something designed to protect European users, the updates to the way we protect user data are global and affect all users. We're not just going to do those things only for European users, after all.
    – animuson StaffMod
    Mar 8, 2017 at 15:52
  • 89
    Thank you for outlining what is different. I'm really tired of getting emails about a policy change but only being given the new policy and having to cross check carefully to figure out what's changed. Really appreciated.
    – ɥʇǝS
    Mar 8, 2017 at 16:07
  • 10
    @Adam cheers, any chance to explain in simple words what is this "EU-US Privacy Shield" and how it actually affect the users?
    – Shadow Wizard Is Sad And Angry
    Mar 8, 2017 at 16:39
  • 3
    @ShadowWizard d11m3yrngt251b.cloudfront.net/images/content/8/5/v2/85609/…
    – animuson StaffMod
    Mar 8, 2017 at 17:12
  • 66
    @ShadowWizard: Simply put, the EU has privacy laws that prohibit exporting sensitive data to countries that have insufficient protection. The US is considered to be such a country, which basically means that any sort of electronic commerce between the EU and the US is more or less illegal according to EU law. Since this is a highly undesirable situation, the EU invented the idea of "Safe Harbor", which means that US companies can voluntarily promise to keep to EU privacy standards. However, this was nixed by the European Court. So, the EU and the US tried to cobble together another solution, …
    – Jörg W Mittag
    Mar 8, 2017 at 17:38
  • 59
    … the Privacy Shield. This is a tiny bit better, since the Judicial Redress Act introduced by Obama actually allows EU citizens to sue in the US over violating EU privacy standards, but the crucial centerpiece of the entire thing is a non-binding promise by the Obama administration … which however is no longer in power. And in fact, Trump signed an Order on January 25th stating that the Privacy Act only applies to citizens and permanent residents, which basically makes all of this moot. There are already two lawsuits pending with the European Court.
    – Jörg W Mittag
    Mar 8, 2017 at 17:40
  • 61
    The original problem was that EU citizens didn't get sufficient protection in the US, but with Trump's Order, they now get no protection whatsoever, so the entire thing is now more or less useless. At least that's how I understood it; the whole thing is a giant mess: the EU does not want to give up privacy of their citizens, the US doesn't want to improve privacy, so any "solution" to be found must necessarily be some sort of deal that more or less violates at least one "country's" ideals.
    – Jörg W Mittag
    Mar 8, 2017 at 17:42
  • 15
    @JörgWMittag This feels like it should be a Q&A somewhere... have you heard of Stack Exchange? ;) Seriously, I'd upvote this as a great overview if it was in an appropriate place, with a bit of extra formatting.
    – IMSoP
    Mar 8, 2017 at 19:46
  • 6
    @IMSoP: Much too ranty for that ;-) I'd downvote it myself :-D
    – Jörg W Mittag
    Mar 8, 2017 at 20:38
  • 1
    @JörgWMittag probably history: Why were the safe harbors revoked/Why was privacy shield implemented instead of safe harbor. Probably law: What's the status of the provisions of privacy shield; etc. if you separate your points into specific answers to specific questions, you may have a good Q&A.
    – Braiam
    Mar 9, 2017 at 1:20
  • 4
    "We have a new Data Protection officer." ...are you going to mention who it is? Or describe their role? These aren't normally things I'd expect to see in a meta post, but then again neither is the fact that you hired someone for this...
    – TylerH
    Mar 9, 2017 at 15:07
  • 3
    Seems odd that outgoing links are https, yet SE sites are not.
    – bye
    Mar 9, 2017 at 16:37
  • 3
    @TylerH The name's in the policy itself. As far as I know, appointing a DPO is another thing we do for compliance with the EU regulations. We didn't hire someone just for that, although that's neither here nor there.
    – Adam Lear StaffMod
    Mar 9, 2017 at 16:49

2 Answers 2

Reset to default
23

I can't find Stack Overflow or Stack Exchange as a company certified using Privacy Shield. I can find Facebook and Google though. Should I blame cache/bureaucracy?

On 13 November 2019 I found Stack Exchange. However, it says (a bit reorganized):

Original Certification Date: 8/16/2017
Next Certification Due Date: 10/30/2020
Data Collected: HR, NON-HR

Purpose of Data Collection

We collect limited personal data for users who use our platforms/products (which are various software offerings), including users who want to apply for jobs listed through our web-hosted platform. Such personal data includes, name, IP address, email, phone number and types of personal data processed is organization, customer, and user data. We collect personal data on our employees for payroll and other personnel administration processes. Types of third parties with whom we share data are vendors (including sub-processors), employers and advertisers.

Improve this answer
4
  • 11
    We submitted out policy for review by the US Department of Commerce. Once that goes through, we should appear on that site AFAIK. In the meantime, here's the verification from Privacy Trust (also linked from the bottom of the privacy policy): privacytrust.com/cert/878767.html
    – Adam Lear StaffMod
    Mar 10, 2017 at 16:58
  • 3
    How can the Privacy Shield be "Certified on 11 June 2012" ? If the privacy Shield is more recent?
    – llrs
    Mar 13, 2017 at 8:07
  • @Llopis That's the date we were originally certified to Safe Harbor. I'd imagine the date probably transfers over on purpose so it's easier to see which companies have been participating in Safe Harbor / Privacy Shield over the years, versus those who only started with Privacy Shield.
    – animuson StaffMod
    Mar 13, 2017 at 14:42
  • 1
    cache/bureaucracy - coz they are basically the same thing lol.
    – n00dles
    Mar 18, 2017 at 15:56
11

The wording is still off.

We have chosen to comply with the principles of the Privacy Shield Framework developed by the U.S. Department of Commerce in consultation with the European Commission except where limited by any legal, regulatory, ethical or public interest considerations.

Privacy Shield (and it's predecessor) were not developed by the U.S. Department of Commerce, this is a regulation by the EU Commission (which did talk to the US, but the U.S. Department of Commerce does not have any authority in the matter). And saying that you choose to comply except when you won't is just a roundabout way of saying that you do not comply. All possible exceptions are already part of the agreement, and SO cannot unilaterally choose to amend EU legislation.

In fact that the US (Facebook, specifically) reserved itself a right to proliferate data without possible legal recourse for the affected persons was what killed the original Safe Harbor accord.

Obviously SO does not mean this in the way this is written (else they could not hope to get certified), so it would be nice to adapt the wording to at least vaguely reflect the actual circumstances.

Improve this answer
6
  • I don't know for sure but that isn't what Privacy Shield says
    – Cai
    Mar 16, 2017 at 10:44
  • @Cai, this is not what the US Department of Commerce says, for reason of their own. Since this concerns European legislation it might be better to refer to the original sources (I will add a few links later in the day).
    – Eike Pierstorff
    Mar 16, 2017 at 11:30
  • That's not what it says here: commerce.gov/tags/eu-us-privacy-shield Everything I can find from both the US Department of Commerce and the EU Commission says this was a equally negotiated agreement—just because it arose from a change in EU regulation doesn't mean the US had no part in it.
    – Cai
    Mar 16, 2017 at 11:34
  • @Cai, well you know what, you might be right (especially since the US developed the self certification process). Can you by chance equally allay my fear re/ the exceptions that SO grants itself ? Since such things are the reason the original Safe Harbour fell through I am rather afraid that we will have to go through this all again in the near future.
    – Eike Pierstorff
    Mar 16, 2017 at 11:48
  • 3
    No, I think you have a good point on compliance (speaking with my IANAL hat on). The policy has been submitted for review though so we'll have to see if it is deemed sufficient... Assuming the policy is approved I suspect any issues would come from actual compliance rather than the wording of a policy.
    – Cai
    Mar 16, 2017 at 11:59
  • 3
    @Cai, yes of course (and I do not have any issue with the way data is handled here, I just thought the sentence looked odd). However I do think wording is important, since this is how the general public (well, me, in this case) tries to ascertain how SO thinks about those things. Thank you for your replies.
    – Eike Pierstorff
    Mar 16, 2017 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .