10

This recent question here on meta has brought to my attention something I never realized before - non-employee moderators have access to some tools that can disclose an user EMail address.

Since I was quite surprised by this discovery (yes, I know, it has probably been referenced before but I didn't know, sorry) I had the idea to look at the Privacy Policy to see what other data can non-employee access.

I wasn't able to find any definitive info, only this relevant passage:

We collect information such as your username, password, email address, IP address (collected at each site visit). This information is also used to identify individual users to the public Network and to award activities and attribute them to you. Your username and additional content you provide including your profile picture, question and answer content, and your reputation are visible publicly. Other limited information is visible to moderators, who have elevated access privileges, and may access content including your posts. For more information about moderators and their role in the Stack Overflow Network, please visit: /help/site-moderators.

Sadly, this doesn't seem to further elaborate what other "limited information" is visible to moderators.

I am therefore asking for support here: is there a page that list which users PII non-employee are granted access to? Or can anyone give me some info in that regard?

Improve this question
0

1 Answer 1

Reset to default
8

Moderators have access to certain information about your account for moderation purposes, such as sockpuppet identification. If it's attached to your account, assume a moderator can see it.

However, revealing the exact tools and what mods can and cannot see would tell anybody trying to get away with stuff exactly how to get around the tools that mods have at their disposal, which is why this stuff is generally kept quiet. Revealing the workings of the tools is not something that I believe any moderator should do, since it would essentially render those tools useless. Sorry.

Improve this answer
13
  • 1
    I don't think, that it's a big secret.
    – Suvitruf - Andrei Apanasik
    Dec 31, 2019 at 12:44
  • 6
    I respect the answer, but also don't accept the concept. I should be able to know what personal info are shared with external parties, and mods apparently are de-facto that. Notice that I am not claiming that I don't want mods to have access to some info, that is a discussion for another time. But the info they have at their disposal should be know. Especially since we already saw mods disclosing "private" stuff before - see the TL leaks. This is not a you shouldn't have that info issue right now, I am only trying to know what a non employee can know so that I can see if I am fine with it.
    – SPArcheon
    Dec 31, 2019 at 12:45
  • @Suvitruf - I can think of certain tools that I would not want people to know about. Policy has been, at least since when I became a mod, not to discuss certain tools in public.
    – Mithical
    Dec 31, 2019 at 12:47
  • 3
    @Mithical yes, in terms of tools you are right. I'm talking more about raw user's data.
    – Suvitruf - Andrei Apanasik
    Dec 31, 2019 at 12:49
  • 2
    @Νеvеrꭑoꭇе - that is a fair point, and I'm still annoyed at whoever leaked the TL transcript. But it's a bit of a no-win situation.
    – Mithical
    Dec 31, 2019 at 12:49
  • 8
    This answer is not OK from a GDPR perspective. Art 13.1 states the data controller is obligated to tell us who has access to which PII and for which purpose when collecting the data (obligatory IANAL but I've worked on GDPR stuff before). Afaik it is allowed to overshoot (state that moderators have access to everything while that is not in fact true), but not undershoot or be vague (and limited subset is very vague).
    – Erik A
    Dec 31, 2019 at 12:59
  • @ErikA Stack Exchange is USA company, GDPR is only for Europe.
    – Shadow The GPT Wizard
    Dec 31, 2019 at 13:05
  • 10
    @ShadowTheBurningWizard SE collects European users data. They should follow GDRP.
    – Suvitruf - Andrei Apanasik
    Dec 31, 2019 at 13:06
  • 1
    @SuvitrufsaysReinstateMonica not sure about that. Good luck to folks from Europe who will file lawsuits against SE. ;)
    – Shadow The GPT Wizard
    Dec 31, 2019 at 13:06
  • 3
    @ShadowTheBurningWizard "It also addresses the transfer of personal data outside the EU and EEA areas."
    – user
    Dec 31, 2019 at 13:07
  • 3
    @Mithical can mods see a list of user's login providers? If so, maybe worth editing this answer? Also, as you see, SE itself shared the info of what mods can see, it is really not a secret like you claim.
    – Shadow The GPT Wizard
    Dec 31, 2019 at 13:08
  • @ShadowTheBurningWizard - there are certain things not listed in that answer, I believe, which I can a.) no longer check b.) would not want to reveal for the reasons stated in the answer
    – Mithical
    Dec 31, 2019 at 13:09
  • 6
    @Shadow While there might be little risk for a lawsuit over this, SE has invested in being GDPR compliant (e.g. by making this GDPR request panel), and it would be a waste to not be compliant over a small thing like this.
    – Erik A
    Dec 31, 2019 at 13:12

Not the answer you're looking for? Browse other questions tagged .