8

There has been a recent announcement of the new privacy policy. However I would like to know what has been done to ensure the privacy respect to the previous setting.

If the NSA or CIA or any other agency (from the USA or outside) asks for (or tries to get) my data, will you deny them the access? Or are there are some internal (technological or not) changes to ensure the levels of safeness required? In the later case, which ones?

7

The recent changes to our privacy policy shouldn't impact the way we handle government orders in any way.

The only thing that's new is that the new policy slightly increases user privacy assurances to comply with the US-EU "Privacy Shield" framework that's replacing the US-EU "Safe Harbor" framework.

But in both versions, we make clear that there are some relatively unusual cases in which we might have to disclose information to comply with legal governmental requests.

In the past, we've occasionally complied with narrow, legally-binding, requests from the government. These requests are pretty rare and we review them individually. If requests don't look legally compelling, or seem overbroad, we'll challenge them, (and have declined to provide information in the past).

It's worth mentioning that - to the best of my knowledge, and I'd probably know - we have not received any of broad-based governmental data requests that really scare folks and are often issued under a National Security Letter.

| improve this answer | |
  • 2
    The kinds of request people are scared of is the kind that you couldn't even tell us exists without getting into serious trouble. There is really nothing you can do to reassure us that you haven't received a National Security Letter giving the NSA all of our data, as that NSL would likely also prohibit you from disclosing its existence. – Mad Scientist Mar 15 '17 at 17:51
5

No, Stack Exchange does not appear to make any claim to denying any three-letter agency access to data that they've requested legally. Quite the contrary:

Here are some of the ways we may use personal information you provide us:

[…]

  • To transfer information to others as described in this policy or to satisfy our legal, regulatory, compliance, or auditing requirements

In the United States, this is fairly standard, if rather unfortunate, as, after all, the US intelligence community has put a great deal of time and money into building an enormous capacity to spy wherever it seems to be necessary, and has a lot of legal force behind its demands.

Some organizations deliberately ensure that no protected data is accessible even to the organization's staff (e.g. the famous Lavabit), but this is utterly impossible for SE, which routinely uses individual personally-identifiable information for communicating with users, catching abuse, and so on. None of this can be made to require an active login session to work. So not only does SE not currently make any such attempt, it almost certainly never will.

Note that the quoted text above did not change since the previous version of the privacy policy.

See also Privacy Shield Principle 1.a.:

An organization must inform individuals about:

[…]

xiii. the requirement to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements

So this is baked into the Privacy Shield framework.

| improve this answer | |
  • 1
    Thanks for this answer, however this doesn't explain if something has changed before the new policy and after the new policy – llrs Mar 13 '17 at 8:44
  • @Llopis: Since, in my last sentence, I claimed that SE never would make any such attempt to protect data, it is anything but difficult to extrapolate that historically it never has. So no, nothing has changed in this particular respect. – Nathan Tuggy Mar 13 '17 at 21:13
  • @Llopis: Added further evidence that SE didn't change anything, and further evidence that SE wouldn't have changed anything. But I guess you can leave the downvote there if this is something you really don't want to hear. – Nathan Tuggy Mar 13 '17 at 23:54
  • If nothing changed, how is my privacy more protected? – llrs Mar 14 '17 at 8:35
  • @Llopis: It isn't, at least not in that sense. SE was previously in Safe Harbor, and didn't downgrade their privacy policy when that lost its legal footing, so they didn't need to change much to enter Privacy Shield. And, of course, it would not have worked for the EU to try, in an agreement with the US, to force US companies to include provisions to disobey US law. – Nathan Tuggy Mar 14 '17 at 8:39
  • But they can neither disobey EU laws if they want to operate in EU. But maybe this should go for legal.SE or something alike. – llrs Mar 14 '17 at 8:48
  • Might need to update the answer according to new court's orders noyb.eu/en/cjeu – llrs Jul 16 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .