24

The GDPR gives us some rights, e.g. the right to be forgotten or to have one's data rectified. I submit this question and my answer, such that what I found might be easier for others to access.

E.g. a user wishing to be forgotten might be misled by questions such as How can I delete my account?. I hope the wording of this question might help others find this information.

E.g. a user wishing to rectify his email address might be misled, like this user in 2016, this user in 2017 and this moderator in 2019. Having one's data rectified should be complete and should not require inside knowledge.

I found various answers:

There may be even more solutions that work and what works may change over time (at which point a new answer here might share new knowledge).

  • I think you can't be completely forgotten. Comment replies aren't renamed. – user Dec 24 '19 at 17:25
  • @Fermiparadox All of those can be manually deleted by the comment author. – Mast Apr 20 at 21:01
17

Update 2020-04-21 : rewrite

The way to submit a GDPR request is via the Submit a Data Access Request form form. Though this is on the StackOverflow domain you can use it to submit any GDPR request to StackExchange, just make sure to clearly describe what you want (e.g. for which SE sites). Also note that you will automatically receive an email with a link to confirm your GDPR request. If you overlook this / is lost in your spam you can wait for a long time I experienced :-) Also note that those mails come from privacy-support [AT] stackoverflow [DOT] email so you might want to white-list that address and might be able to alert SE in case of problems with the GDPR form.

I have two experiences to share with this form:

  • Dec 2019 - SE network wide removal of account

    I originally did this via the contact form, selecting the Other topic and received a swift reply asking me to use the Submit a Data Access Request form instead. My experience with the GDPR form was in this instance very good: the complete process was finished within minutes.

  • Jan 2020 - SE network wide correction of email address

    After confirmation of the request by me I got no reply for 6 weeks, so I sent a reminder by mail. 3 weeks after the reminder I got a fairly boilerplate reply:

    Unfortunately, the Data Access Request you submitted cannot be fulfilled at this time for the following reason:

    We have a legal obligation that requires us to decline this request.

    If you have additional questions, please reply to this email and someone from our privacy team can assist you.

    Sincerely, The Stack Overflow Team

    Of course I still have questions, most obvious: what legal obligation would require you to not correct an email address that will become obsolete in the near future? I am now waiting for an answer to that question for almost 4 weeks... The problems with Corona might not help things, but do not justify that the only result in over 3 months since my confirmation of the GDPR request is one boilerplate email "We have a legal obligation that requires us to decline this request."... I do believe this is an important process and I believe that SE believes this is an important process, so I hope they are able to fix this in the future (please share some more positive experience if you have it in the comments).

With regards to changing your email address: with the help of @animuson via comments I learned the following:

  • You can update your email address via the Edit Email Settings page (make sure to insert / use your own user ID in this URL).
  • You can add the new email address via the "add more logins..." button on the My Logins page (make sure to insert / use your own user ID in this URL).
  • Even though this My Logins page linked is part of the Meta SE domain, the changes are network wide.
  • Allow some time / refreshes for your new credentials to show up under the Stack Exchange heading of your My Logins page (for me it sticked for a couple of minutes under the Other heading on that page).
  • You can then remove the old credentials (and your old email) yourself from that My Logins page.
  • I will now submit a new GDPR request to ask for confirmation that my old email address is indeed removed from all systems (I am a bit defensive, see the 3 links with surprises others had in the past when it comes to completely changing your email address). Hopefully a positive update on that in the near future.
  • Based on the comments it seems debatable whether my request should have been declined: the address is valid / verified, so one might say it is not about correcting wrong information, so one might say SE is not obliged to change it to something else. I do not have an opinion on it. It might have been nice if their reply was a bit more helpful like the help I got from @animuson. Maybe my wording of the request (make sure the old email is replaced everywhere in the system) was a bit intimidating to the employee that handled the mailbox that day :-) Who knows. No hard feelings. I just hope the above helps others solve their requests.
| improve this answer | |
  • Thanks for keeping us "updated". I guess these are times with a lot of churn and whatnot ... but I also think: up to now, your experience isn't how GDPR is meant to work for users. So if SE Inc. isnt able to do better, they are probably open for trouble ... – GhostCat Apr 20 at 8:57
  • 1
    What do you mean by "correct your email"? Our system does not allow simply changing email addresses on an account, and a GDPR request cannot handle that. If you want to change your email, you need to set up the new credential and attach to your account yourself, at which point you can request erasure of the old email. – animuson Apr 20 at 14:03
  • 2
    @animuson An email address is PII. The GDPR allows users to request correction of any PII a company holds about them. Would you explain why SE thinks it's not allowed? – ArtOfCode Apr 20 at 14:44
  • 1
    @ArtOfCode The GDPR has a right to rectify any inaccurate information and correct mistakes. An email address a user actively used and verified is accurate information. Them wanting to change it to a different email they actively use is just a general support request, not a GDPR request. Our system does not support changing email addresses on a verified credential. They can only be created and deleted, and they cannot be inaccurate because they require verification first. – animuson Apr 20 at 14:51
  • @PaulvanLeeuwen Edit your profile here, and click on My logins, then click on the add new login button. Enter the email you want to use and a password for it, and it should send you a verification email to add it to your account. – animuson Apr 20 at 14:52
  • @PaulvanLeeuwen If it's listed under Other, then it is only a verified email eligible for notifications and does not have a credential attached to it. You'll still need to complete the add new login process to set it up as a credential. – animuson Apr 20 at 15:03
  • 1
    @PaulvanLeeuwen Yes credential changes are network-wide. I don't know why it's showing under Other, but I checked your account and the credential was successfully added. – animuson Apr 20 at 15:16
  • @animuson I rewrote my Answer and attempted to include the information of our exchange in the comments. I plan to remove all my comments on this Answer soon (after which some of yours will not make much sense anymore). You might want to consider removing some as well... – Paul van Leeuwen Apr 21 at 19:29
  • 1
    It's worth noting that that process doesn't entirely work to completely remove your previous email address. It's still stored internally in the system in a legacy field. – Sonic the K-Day Hedgehog Apr 21 at 23:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .