Brace yourselves: The GDPR is coming!

Question

It's actually nothing to worry about. You as users end up with more protection, and companies like us are left in a place where we've got a framework for handling your information that puts much stronger guard rails around responsibility, transparency, and accountability.

The GDPR (General Data Protection Regulation) is a good thing, and not just for European citizens. While you've probably heard quite a few folks grumbling about it, including some of our own, we feel that it's a major step in the right direction and we're enthusiastically embracing it.

tl;dr; — There's going to be a new 'legal portal' launching on or just before the last week of May, 2018. You'll see a banner you can dismiss when it launches; we strongly recommend that you check it out. You'll also receive an email to let you know about the changes. We're expanding our privacy policy, providing a policy on cookies, and giving you ways that you can view and interact with data that we store about you. While this was done to be compliant with the GDPR, we strongly believe in the intent and spirit of the GDPR, and have extended its protection to everyone.

It's never a bad idea to get your legal documents in order so that folks can find them easily, and make use of any associated tools, but the landing of the GDPR is an especially fine reason to do that. So, we're rolling out what we call our 'legal hub', which will replace /legal on the sites; it's going to look a lot like this¹:

¹_{Note: The actual interface will likely vary from what's depicted; it's still a work-in-progress. Things like e-opt-out for the arbitration clause are likely to appear here, anchored links might appear or work differently, etc.}

That's a bit different from what we currently have. Our goals in this update are to ensure we're fully GDPR-compliant, that the rights and protections afforded by the GDPR are extended to all of our users, regardless of location, and that all of the information anyone would want to know about our policies is as easy to find.

We've been rather proud of our plain English privacy policy that we created during a time when a common complaint was companies making such policies as difficult to understand as possible, which is a key reason that we were so eager to embrace the intent and protections of the GDPR. That sets our final goal, to make all policies as easy to read and understand as is legally possible, with as much transparency as possible.

The GDPR puts some pretty powerful new tools ² in the hands of users to control their information:

²_{Depicted implementation is subject to change, the legal hub and tools it offers are still being finalized.}

.. and that's a great reason for every company to firmly get behind it. As we've said, changes are pretty reaching. We'll touch on some stuff, and then just open things to questions.

New cookie policy summary:

The cookie policy lets folks know about the types of cookies that we utilize, and why. It's broken down by product, or everything from Q&A to display ads, analytics and third-party cookies.

This policy is important because not only does it explain what cookies we set and why we need them, the process of explaining it and requirements to keep it updated help keep us mindful of how we use them as our distributed development teams continue to grow.

It's also neat if you just like poking around at how things work. Great things get built as a result of simply indulging curiosity.

Many product-specific updates:

There are a number of places where we need to mention Stack Overflow For Teams as a product (and one where we collect information about you). There's also stuff about Talent (formerly Careers), advertising products, and other things. There are many places where policies don't really change beyond what's needed for GDPR compliance, we're just adding more things that these policies cover.

Summary of ToS updates:

The first two items in our previous Terms Of Service update announcement are pretty unremarkable. To reiterate, we'll be specifically addressing some needs for Stack Overflow For Teams, and ensuring everything is compatible with the GDPR.

The final update regarding the arbitration clause will be amended to include two means of electronic opt-out (through email, as well as through a form on the site); snail mail will continue to work. All means of opting out will generate an indication that you’ve opted out, which could come in the form of an email reply, or a visual indication on a form that you’ve previously triggered it, provided that you have an account. If we can't correlate your request to opt-out to an actual profile, we'll just keep the request as notice that you've opted-out on file.

The arbitration clause in the new terms will not go into effect until everything updates, at which point notices will go out. The 30 day opt-out window for arbitration will go into effect at that point; we're reserving the option to extend the window should we determine a need to do so.

We will be GDPR compliant on May 25. Having everything complete (hub, all forms, etc) should fall within the same week. We'll make it as smooth as possible; a lot of work is going to be coming together at once.

Summary of privacy policy updates:

We'll encourage you to read the privacy policy (and will encourage you to browse the entire new legal hub) once they're public and accessible. The main changes to the privacy policy revolve around GDPR compliance. We're already very conservative and transparent when it comes to protecting your data and information; while the policy will have more legal phrasing, the gist of it won't change much. You get more granular control over how your information is used in a variety of ways, but the transparency remains essentially the same.

The GDPR is somewhat bold; more construction may be ahead.

So is our approach in extending the protection that it offers to all of our users. It's definitely the right decision morally, but the decision comes with practical benefits as well — having only one framework for how information is stored and handled leaves far less opportunity for error. But, since this is all sort of new territory, we're probably going to need to adapt as cases in courts around the globe set precedent post-implementation. We're going to be open and communicative about any changes and why we're making them.

We're open to questions, and expect many.

We're not going to try to anticipate a list of things we think you're going to want to ask, and write lots of text to those things. We'd rather just acknowledge that this post is probably going to leave you with at least one or two more questions than answers, and open it up to those questions.

Please, post anything not easily answerable in 200 something words as an answer, and we'll have a discussion under it if needed. Likewise, please help us help you by moving topics out of comments and into answers (or separate posts entirely if needed) if a topic becomes protracted so that valuable information doesn't get lost in the shuffle.

And remember, we're human, too.

Answer 1

Our goals in this update are to ensure we're fully GDPR-compliant, that the rights and protections afforded by the GDPR are extended to all of our users, regardless of location

How does this apply to underage users? According to GDPR, a user has to be at least 16. Is this going to apply to users everywhere? That... would really suck, since I happen to like my account.

Answer 2

Can we get an answer what will happen to European users with that arbitration clause? Since it's pretty clear that it's unenforceable for European users, and has no real merit here in the ToS.

Maybe in a form of an automatic opt out for European users? Or a header that it applies to US/Canadian citizens only? Facebook couldn't win with their arbitration clause in several European countries, so save yourself such a headache in Europe in a battle you're guaranteed to lose and opt out European users automatically out of the arbitration clause or make the arbitration clause more specific to the US.

So what's the game plan there with that clause?

See for reference this answer https://meta.stackexchange.com/a/310086/214343 and https://meta.stackexchange.com/a/310086/214343 .

Please take a look at SPArchaeologist's question Can we get an official statement about how the arbitration clause will be managed for foreign countries like European ones?

Answer 3

Does a portability request also include data that is personal to specific users but you may not want to share (e.g. moderator annotations, suspension histories, internal notes on an account, etc.)

So can a user request those? If yes, how do you protect yourself against users abusing this to bypass existing checks and balances and cause drama?

Answer 4

Will Stack Exchange treat a disclosure request as a hostile action? I've seen some websites that do allow these requests (by nature of that being the law and all) but will suspend / delete your account if you do so, to disincentivize users from using these for non serious reasons.

Outwardly, if you didn't do this, malicious actors could waste a metric ton of staff time by repeatedly filing obscure disclosure requests.

Is there any such policy planned on Stack Exchange?

Answer 5

How will GDPR work with our existing moderator tools to handle bad actors? Currently, the system can detect if accounts are recreated and extend a suspension to the new accounts automatically. If a user requests erasure of such an account, do we lose this automatic protection?

Answer 6

In what ways do the three GDPR requests for portability, erasure and rectify differ from the already existing tooling in those areas?

For portability, there is already the data dump, the API and SEDE. Will there be additional information available with a portability request that we currently can't get?

For erasure we have the options to delete your entire account, and to request disassociation of individual posts. I assume that it still means that you can't remove your content entirely from the site, as it is still CC-licensed? Can removal requests be targeted very precisely, e.g. for specific types of data SE stores?

I can't really think of any case where the right to rectification would come into play on SE, as most personal data is editable by the user themselves.

Answer 7

How does the system deal with consent?

You'll see a banner you can dismiss when it launches; we strongly recommend that you check it out. You'll also receive an email to let you know about the changes. We're expanding our privacy policy, providing a policy on cookies, and giving you ways that you can view and interact with data that we store about you. While this was done to be compliant with the GDPR, we strongly believe in the intent and spirit of the GDPR, and have extended its protection to everyone.

It is my understanding, that this kind of consent gathering (through inactivity) is not sufficient.

Specifically...

This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data.

And...

Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

Are sites automatically opting-out of all consent requiring activities until consent is gathered?

See also: https://gdpr-info.eu/recitals/no-32/

Or as the privacy authorities put it in their Article 29WP Guidelines on Consent under Regulation 2016/679:

Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice.

Answer 8

What about IP address logging?

IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49 of the GDPR. If StackExchange is complying with this new regulation, they can no longer even log this information.

How is that going to affect moderator tools and spam fighting? Logged IP addresses seem to be a necessary tool for fighting spam here. If that goes away, I fear a spam flood.

Answer 9

How does this pertain to questions and answers that contain personal user information, on say a site like IPS. If a user files an erasure request while having some of those, is that user entitled to also have them removed?

Answer 10

We've been rather proud of our plain English privacy policy that we created during a time when a common complaint was companies making such policies as difficult to understand as possible, which is a key reason that we were so eager to embrace the intent and protections of the GDPR

That's a good thing! But as I user, I struggle to find the differences between what's was on the page (say last month) VS what's live now.

Could we have an edit history like we have for Q&A edits in order to have a real idea of each changes over time?

Answer 11

You talk about portability, but what about Subject Access Request (SAR). As I understand it submitting a SAR requests any and all data that I am linked to. This might be a chat message that mentions my name, or leading on from this post it might be a hidden moderator comment or email sent within SE that is linked to my profile or is about me personally.

Other people's privacy can be protected, in the case of an email you can redact the name of the persons involved but the content should be made available.

Answer 12

One aspect of the Public versus Private Terms really confuses me.

If you’re using the Public Network you apply the Public Network Terms, and if you’re using the Private Network you apply the Private Network Terms:

Public Network Terms

... These terms govern the use of the public Network (the "Public Network Terms"). ... your use of the private Network is governed by the Private Network Terms.

Private Network Terms

... These terms govern the use of the private Network (the "Private Network Terms").

All fine and good, until I get to:

Public Network Terms

... These Public Network Terms ... governs [sic] your permitted use of the public Network ONLY, including any Services or Products that are part of the public Network (e.g., the private Network). [Emphasis added]

This sentence states that the Public Network Terms apply ONLY to the public Network, and therefore they do apply to the private Network, because it is part of the public Network. It seemingly contradicts itself and the earlier statements.

Perhaps not what was intended, but that is what it says. The sentence also contains a grammatical error – that's often a sign that a sentence has been reworked. Did an edit cause a regression, breaking the intended meaning?

Answer 13

How fine control you are going to give when it comes to data erasure?

Will you allow to erase linking between profiles on SE sites, or in case of 'regretted' linking, erasing one of those profiles will be necessary?

Will you provide a canonical answer (FAQ) how to erase profile? I've found nothing for Area51, for example.

Will the anonymisation allow breaking links between posts within one side (to make it impossible to easily find out, they were posted from the same account)?

Answer 14

Can I share my PII information in my SO profile/about me description? Will it be prohibited?

Answer 15

I have just been looking for the new tools, all users shall get and I think the request site is quite hard to find.

Could you please add something to the contact form, maybe a dialog as you already do for Why was my question or answer denied?:

I want to submit a request regarding my personal data.

Requests to obtain, erase or rectify personal data shall be send using our legal portal.

You can click on Submit a request to be redirected to the form where you can submit this type of request.

No thanks, continue     Submit a request