91

As you all know, once in a while we have to update our Privacy Policy. Now is one of those times.

Here's what's different with today's update:

  • Safe Harbor has been replaced by the EU-US Privacy Shield. We updated all references to Safe Harbor and relevant links, as well as the logo at the bottom of the page. Along with that, there's an updated dispute resolution process.
  • The site formerly known as Stack Overflow Careers is now known as Stack Overflow Jobs for candidates and Stack Overflow Talent for employers. The Privacy Policy now correctly refers to those brands.
  • We have a new Data Protection officer.
  • Last but not least, all outgoing links are HTTPS. 🎉
  • 10
    Does any of this actually affect the lives of ordinary users who only care about Q&A? (I'm guessing not, except for the hoohah about editing old images from http to https.) – Rand al'Thor Mar 8 '17 at 15:45
  • 14
    @randal'thor There's no fundamental functional change here this time, but the policy covers how we collect and use data on the entire network, Q&A included. In this case, EU residents are the users who are primarily potentially affected. – Adam Lear Mar 8 '17 at 15:51
  • 5
    @randal'thor Yes. Even though Privacy Shield is something designed to protect European users, the updates to the way we protect user data are global and affect all users. We're not just going to do those things only for European users, after all. – animuson Mar 8 '17 at 15:52
  • 89
    Thank you for outlining what is different. I'm really tired of getting emails about a policy change but only being given the new policy and having to cross check carefully to figure out what's changed. Really appreciated. – ɥʇǝS Mar 8 '17 at 16:07
  • 10
    @Adam cheers, any chance to explain in simple words what is this "EU-US Privacy Shield" and how it actually affect the users? – Shadow The Dragon Wizard Mar 8 '17 at 16:39
  • 3
  • 65
    @ShadowWizard: Simply put, the EU has privacy laws that prohibit exporting sensitive data to countries that have insufficient protection. The US is considered to be such a country, which basically means that any sort of electronic commerce between the EU and the US is more or less illegal according to EU law. Since this is a highly undesirable situation, the EU invented the idea of "Safe Harbor", which means that US companies can voluntarily promise to keep to EU privacy standards. However, this was nixed by the European Court. So, the EU and the US tried to cobble together another solution, … – Jörg W Mittag Mar 8 '17 at 17:38
  • 58
    … the Privacy Shield. This is a tiny bit better, since the Judicial Redress Act introduced by Obama actually allows EU citizens to sue in the US over violating EU privacy standards, but the crucial centerpiece of the entire thing is a non-binding promise by the Obama administration … which however is no longer in power. And in fact, Trump signed an Order on January 25th stating that the Privacy Act only applies to citizens and permanent residents, which basically makes all of this moot. There are already two lawsuits pending with the European Court. – Jörg W Mittag Mar 8 '17 at 17:40
  • 60
    The original problem was that EU citizens didn't get sufficient protection in the US, but with Trump's Order, they now get no protection whatsoever, so the entire thing is now more or less useless. At least that's how I understood it; the whole thing is a giant mess: the EU does not want to give up privacy of their citizens, the US doesn't want to improve privacy, so any "solution" to be found must necessarily be some sort of deal that more or less violates at least one "country's" ideals. – Jörg W Mittag Mar 8 '17 at 17:42
  • 15
    @JörgWMittag This feels like it should be a Q&A somewhere... have you heard of Stack Exchange? ;) Seriously, I'd upvote this as a great overview if it was in an appropriate place, with a bit of extra formatting. – IMSoP Mar 8 '17 at 19:46
  • 6
    @IMSoP: Much too ranty for that ;-) I'd downvote it myself :-D – Jörg W Mittag Mar 8 '17 at 20:38
  • 1
    @JörgWMittag probably history: Why were the safe harbors revoked/Why was privacy shield implemented instead of safe harbor. Probably law: What's the status of the provisions of privacy shield; etc. if you separate your points into specific answers to specific questions, you may have a good Q&A. – Braiam Mar 9 '17 at 1:20
  • 4
    "We have a new Data Protection officer." ...are you going to mention who it is? Or describe their role? These aren't normally things I'd expect to see in a meta post, but then again neither is the fact that you hired someone for this... – TylerH Mar 9 '17 at 15:07
  • 3
    Seems odd that outgoing links are https, yet SE sites are not. – bye Mar 9 '17 at 16:37
  • 3
    @TylerH The name's in the policy itself. As far as I know, appointing a DPO is another thing we do for compliance with the EU regulations. We didn't hire someone just for that, although that's neither here nor there. – Adam Lear Mar 9 '17 at 16:49
23

I can't find Stack Overflow or Stack Exchange as a company certified using Privacy Shield. I can find Facebook and Google though. Should I blame cache/bureaucracy?

On 13/09/2017 I found Stack Exchange. However it says (a bit reorganized):

Original Certification Date: 8/16/2017
Effective Date: 3/7/2017

Purpose of Data Collection

HR data collected as well as consumer personal information including username, email address, and IP information for login. B2B login also collects same/similar personal information.

  • 11
    We submitted out policy for review by the US Department of Commerce. Once that goes through, we should appear on that site AFAIK. In the meantime, here's the verification from Privacy Trust (also linked from the bottom of the privacy policy): privacytrust.com/cert/878767.html – Adam Lear Mar 10 '17 at 16:58
  • 3
    How can the Privacy Shield be "Certified on 11 June 2012" ? If the privacy Shield is more recent? – llrs Mar 13 '17 at 8:07
  • @Llopis That's the date we were originally certified to Safe Harbor. I'd imagine the date probably transfers over on purpose so it's easier to see which companies have been participating in Safe Harbor / Privacy Shield over the years, versus those who only started with Privacy Shield. – animuson Mar 13 '17 at 14:42
  • 1
    cache/bureaucracy - coz they are basically the same thing lol. – n00dles Mar 18 '17 at 15:56
11

The wording is still off.

We have chosen to comply with the principles of the Privacy Shield Framework developed by the U.S. Department of Commerce in consultation with the European Commission except where limited by any legal, regulatory, ethical or public interest considerations.

Privacy Shield (and it's predecessor) were not developed by the U.S. Department of Commerce, this is a regulation by the EU Commission (which did talk to the US, but the U.S. Department of Commerce does not have any authority in the matter). And saying that you choose to comply except when you won't is just a roundabout way of saying that you do not comply. All possible exceptions are already part of the agreement, and SO cannot unilaterally choose to amend EU legislation.

In fact that the US (Facebook, specifically) reserved itself a right to proliferate data without possible legal recourse for the affected persons was what killed the original Safe Harbor accord.

Obviously SO does not mean this in the way this is written (else they could not hope to get certified), so it would be nice to adapt the wording to at least vaguely reflect the actual circumstances.

  • I don't know for sure but that isn't what Privacy Shield says – Cai Mar 16 '17 at 10:44
  • @Cai, this is not what the US Department of Commerce says, for reason of their own. Since this concerns European legislation it might be better to refer to the original sources (I will add a few links later in the day). – Eike Pierstorff Mar 16 '17 at 11:30
  • That's not what it says here: commerce.gov/tags/eu-us-privacy-shield Everything I can find from both the US Department of Commerce and the EU Commission says this was a equally negotiated agreement—just because it arose from a change in EU regulation doesn't mean the US had no part in it. – Cai Mar 16 '17 at 11:34
  • @Cai, well you know what, you might be right (especially since the US developed the self certification process). Can you by chance equally allay my fear re/ the exceptions that SO grants itself ? Since such things are the reason the original Safe Harbour fell through I am rather afraid that we will have to go through this all again in the near future. – Eike Pierstorff Mar 16 '17 at 11:48
  • 3
    No, I think you have a good point on compliance (speaking with my IANAL hat on). The policy has been submitted for review though so we'll have to see if it is deemed sufficient... Assuming the policy is approved I suspect any issues would come from actual compliance rather than the wording of a policy. – Cai Mar 16 '17 at 11:59
  • 3
    @Cai, yes of course (and I do not have any issue with the way data is handled here, I just thought the sentence looked odd). However I do think wording is important, since this is how the general public (well, me, in this case) tries to ascertain how SO thinks about those things. Thank you for your replies. – Eike Pierstorff Mar 16 '17 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .