20

Is Stack Exchange making any changes in preparation for GDPR? What will the procedures be in order to comply with this regulation?

The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union. It addresses the export of personal data outside the EU. The GDPR aims primarily to give control back to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. When the GDPR takes effect, it will replace the 1995 Data Protection Directive (Directive 95/46/EC).*

Note: This question to relates to what system SE will have in place for GDPR.

  • Possible duplicate of meta.stackexchange.com/questions/308110/… – yagmoth555 Mar 29 '18 at 12:47
  • I'm more interested in what their procedure is concerning this regulation. – Azxdreuwa Mar 29 '18 at 12:50
  • 6
    This is not a duplicate of The "right to be forgotten" question, which is related only to the right to be forgotten and not other parts of the GDPR, i.e. the principle of data minimisation, the lawful basis SE is using for processing or the right to data portability. – ben is uǝq backwards Mar 29 '18 at 13:48
  • If anybody's involved in "the export of personal data outside the EU" it'll be the user exporting their personal data from the EU to SO's servers over in America. So suck it, EU bureaucrats. – Won't Mar 29 '18 at 14:38
  • 3
    That's probably not true @Won't. SE has EU based staff. If payroll etc. is done in the US then SE is transporting EU citizens personal data across borders. There's a reason why SE is registered with the Information Commissioners Office in the UK. According to this SE might be processing your family details in order to provide these sites. – ben is uǝq backwards Mar 29 '18 at 15:29
  • Yeah but still... – Won't Mar 29 '18 at 17:31
  • @benisuǝqbackwards How they store their payroll data and such is outoftopic there IMO, it can even be an excel's file, who know, but it's internal process. It's why I flagged as a possible dupe, as Glorfindel's answer, on that possible dupe, relate to an SE user's point of view for it's own data. I dont see the link between "Is your question about the Stack Exchange engine that powers the Stack Exchange network?" and this question, but feel free to enlight me, I maybe miss the point. – yagmoth555 Mar 29 '18 at 18:14
  • 4
    That comment was directly to Won't @yagmoth555. SE stores data on EU citizens and has an office in the EU. GDPR applies to SE and SE should be doing something about (for e.g.) the principle of data minimisation, the right of access, the right of data portability and the right to be informed. I doubt a MSE answer about the profiling that is done on us as users counts as keeping users sufficiently informed. It's entirely possible that there's nothing to do, in which case an answer from someone within SE can say that. This is a completely fair question to be asked of the company though. – ben is uǝq backwards Mar 29 '18 at 18:25
  • 3
    The good thing is that SE has a structure which lends itself very well to GDPR compliance. Data stores are well scoped, data flows are well documented, and the default use of data is practical so consent should be easy. Even the right to be forgotten process is pretty much there in the dissociation request. – Rory Alsop Mar 30 '18 at 16:19
  • 2
    I haven't been a part of the actual work on this, but from what I've heard, there's been a lot of crying involved. – Adam Lear May 10 '18 at 17:05
  • 2
    @AdamLear I hate to put this subtly, but when the tears are red, it's not crying :P – Tim Post May 10 '18 at 17:50
  • Fun information, about 2/3 of the companies tasked with enforcing and supervising the GDPR are not ready for it. We (Europe) have created a monster. – Toon Krijthe May 14 '18 at 8:15

You must log in to answer this question.

Browse other questions tagged .