SO's "GDPR Policy" states in part
we describe how we collect and use your data, and how we use technologies like cookies to understand how we can better help developers.
Is personal data provided by EU persons via SurveyMonkey to Stack Overflow protected by GDPR?
a. Is this data subject to the right of portability?
b. Is this data subject to the right to be forgotten?
In order to provide meaningful insights into the developer community, Stack Overflow may collect sensitive data about you, including, but not limited to your gender, race, sexual orientation, immigration status, and your location.
- Since SO's policy does not state that this data may be collected by The Loop, what is the justification for collecting this data, and have you sufficiently notified users such that their consent is knowing and unambiguous? Although the survey states "We will NOT associate your responses to this survey with your account information" that may not be enough to declare it GDPR-compliant. For example, if IP addresses are collected as part of the survey, then this might mean participants could be identified. Is SO asserting that data collected in the survey cannot be traced to the survey respondent in any way?
I think that if the Loop is intended to fall under SO's Policies, it needs to clearly and unambiguously notify users prior to collection of any data.
If SO asserts the survey is truly anonymous, then SO needs to notify users of that prior to collecting data as well.