This is a great question, and unfortunately, it requires kind of a complex answer that comes down to the specifics of where a user resides, or works, and what the situation is. Like most other companies in the industry, we don’t publish our full compliance strategy around this, because some things are just better kept in your pocket until you need them. It’s also very important to remember that we have a global user-base, and as such, we are tasked to comply with more than just the GDPR.
First, it’s important to know that Privacy Shield itself was not something with which to comply: it was a certification that we were in compliance with the GDPR requirements. But broadly speaking, it’s correct that Privacy Shield (the certificate, not the GDPR) was invalidated. The fact that it was invalidated didn’t immediately change anything for us here: we continue to execute on the same practices and processes that allowed us to obtain Privacy Shield (which, again, only certified compliance with the GDPR), while we wait for governments and courts to work out whatever the next iteration is. However, Privacy Shield was only one avenue for compliance with EU laws. Depending on the situation, there are several other paths we take to remain in compliance, including through the use of Standard Contractual Clauses (SCCs), which are widely accepted as meeting requirements.
We also identified that our old policy was outdated and still mentioned the Privacy Shield framework, which we’ve corrected with the changes made today. Although I can’t go into the pieces in place for each of the legal eventualities, what I can do is assure you that Stack takes user privacy seriously. We have staff that is targeted at privacy generally (a data privacy attorney), and we have privacy baked into our design principles. We believe these things demonstrate the care and thoughtfulness that’s gone into crafting our policies and practices around privacy.
If you’d like to get directly in touch with our privacy protection officers, the email@example.com is still the right email address.