11

A while back, I discovered a bug in the GDPR data exporter. This data exporter is supposed to export all user data, but at the moment, it doesn't.

While I didn't talk publicly about this to prevent any reputation damage, the fact that I'm getting ignored when contacting Stack Overflow, made me make this meta post, because this is a pretty serious issue.

Timeline:

  • 2019-03-21: I requested a GDPR export of my data
  • 2019-03-21: Stack Overflow acknowledged that my request was received, and promised to send me all data at 20 April
  • 2019-03-21: Stack Overflow send me a partial data dump of my data, and said it was completed
  • 2019-03-22: I discovered some data was missing the from the data, so I tried to contact Stack Overflow using the contact form on the website, this has been logged under ticket id 201903221938094138, I received no response so far.
  • 2019-04-04: I send a mail to legal@stackoverflow.com, as this was the contact email listed at the GDPR form, stating that information was missing, I received no response so far.
  • 2019-05-19: Since no response from SO has been received so far, I made this meta post

Expectations:

I expected the following content to be present in the data dump, but it wasn't:

  • The time of all my votes I ever cast on aan normal and meta sites
  • The time and the source markdown of all questions and answers I made that didn't get modified by others on all normal and meta sites
  • 1
    What would that huge reputation impact be? Tech site lost my private data! would be a novum and a positive thing for once ... – rene May 19 at 10:11
  • 10
    @rene If a website does not send all a users data when they request it, the site is against the law, because they break conditions in the GDPR, and this basically allows people in europe to sue Stack Exchange for this, what costs SO a lot of money, and if word spread round that SO got sued and lost, they will lose trust in SO – Ferrybig May 19 at 10:14
  • 3
    Okay, can you give an idea, without revealing too much, what data isn't included? – rene May 19 at 10:25
  • @rene This is actually hard because about 49% of all sites are not included in the data dump – Ferrybig May 19 at 12:13
  • @Ferrybig can you make it less revealing by listing all data that should be exported, instead of only the missing data? – Meta Andrew T. May 19 at 14:15
  • The data request seems to have a lot of issues. The waiting time alone seems to be extremely varying (anything from a few minutes to months overdue). SE probably has some issues they need to work out with data requests, especially if it now causes missing data as well – Olivia May 19 at 15:31
  • 9
    Your votes and posts are not personal data, at least not how I read the privacy-policy. I don't believe GDPR was meant as a service to collect a data-dump of your own posts. But I'm not a lawyer. – rene May 19 at 15:51
  • @rene I have an old GDPR request laying around - <request folder root>/qa/stackoverflow.com (and several others - I haven't checked all) contains two files: PostVotes and UserVotes. The first one contains votes on posts, the second contain election votes. Not sure if they classify as personal data, but they at least have been included in the past – Olivia May 19 at 16:23
  • @Olivia fair enough. Let's have this documented then so it becomes clear what to expect. – rene May 19 at 16:35
  • 2
    We're looking into this, looks like you've uncovered a bug somewhere along the way – Dean Ward May 20 at 12:12
  • Worth mentioning that PostVotes.json, UserVotes.json and PostHistory.json contain the data you're looking for but that for some reason meta sites aren't being generated correctly. – Dean Ward May 20 at 12:14
13

I've checked the data you were sent and your votes and markdown content are in the UserVotes.json, PostVotes.json and PostHistory.json files. However we had a bug that prevented any data being generated for meta sites (except meta.stackexchange.com). I've just fixed that and it is being deployed to production shortly.

I've also brought up some of the concerns around responsiveness on the contact form and legal@ and we're looking into our processes there to see where things went awry.

Thanks for the patience and sorry for the inconvenience. If you re-submit a GDPR request in the next hour or so you'll get your data including all meta sites as well.

  • Markdown content will be all your posts? – rene May 20 at 18:48
  • 1
    @rene PostHistory - so history of everything you created/edited, etc. – Dean Ward May 20 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .