33

I just recently learned about the automated service provided by Stack Exchange for handling GDPR Data Access Requests. So, of course, I tried it out, and indeed promptly received a 13 megabyte zip file (reference code GDPR-P20210515-3112) supposedly containing all data SE has about me.

However, while the data I received is quite interesting, it does not seem to actually be complete. In particular:

  • The /chat folder only includes, for each of the three SE chat servers I've used (chat.stackoverflow.com, chat.stackexchange.com and chat.meta.stackexchange.com), files named ActiveRooms.json, Events.json, User.json, Votes.json and (for chat.meta.stackexchange.com only) Schedule.json. None of these files seems to contain chat messages that I've written. In fact, searching the entire zip archive for known substrings from my past chat messages turns up no results.

    For a specific example, this chat message (posted by me in 2016 and still clearly present on SE servers) contains the substring "Wednesday here for 45 minutes". This string does not appear in any of the JSON files included in the archive I received.

  • Also, the /jobs directory that's (according to readme.txt included in the archive) supposed to contain "Your personal data associated with activity on Stack Overflow’s Jobs site (for candidates) and Stack Overflow Talent (for employer accounts)" is entirely missing from the archive I received, even though I've used SO Jobs actively in the past and Stack Exchange clearly still retains data about my activity there.

    In particular, I searched the entire archive for some phrases from my past job applications and from messages in my Jobs inbox and found none of them in the archive. (My Developer Story and job preferences do seem to be included, but they're under /qa/stackoverflow.com for some reason.)

  • Also, while the job preferences dump does contain the filename of my saved resume, an actual copy of the resume doesn't seem to be included, even though the archive claims to contain "a copy of all your personal data associated with your account." While I'm not a lawyer or an expert on the GDPR, it seems to me that the least SE should do, if they don't want to include the resume itself in the data archive, would be to clearly indicate e.g. in the readme file that they're storing it (no, just having a filename buried in a huge JSON dump isn't enough) and provide a link to download it.

There might be more things missing, but these are just what I noticed in a few minutes of casual examination. In any case, it's not really my job to try and guess what data SE might have about me beyond what's included in the archive. Rather, it's Stack Exchange's responsibility to comply fully with all valid GDPR subject access and data portability requests.

FWIW, I don't think any of these omissions are deliberate or malicious — it would be pretty silly for SE to e.g. provide me with detailed information about when I've entered and left each chat room and which messages I've starred, but leave out the obvious and easily discoverable data about what I've posted in chat. It seems much more likely to me that these omissions are simply caused by bugs, perhaps due to changes made to how SE stores this data since the GDPR data access service was implemented.

But they still should be fixed.

(Also, while you're at it, could you please fix the zip file generator to use normal slashes instead of backslashes after the site part in the file names? That would make the archive much easier to browse on non-Windows systems.)


Ps. Just to make this a formal request, I am hereby invoking my rights to data access and data portability, as granted to me as a citizen of an EU member state by the EU GDPR, and requesting that Stack Exchange, Inc. provide to me without undue delay:

  • a copy of any personal data and other supplementary information relating to me that they possess, including
  • a copy in a commonly used machine-readable structured format of any personal data that I have provided to them, either explicitly or as a result of using their services, including but not limited to any recorded website usage and search history, and specifically including the missing data identified above.

This request has also been sent (with minor amendments) to privacy@stackoverflow.com (Jira ticket # PRIVACY-1474).

19
  • 1
    Just to be sure: your jobs account is linked to your current account?
    – Luuklag
    May 15 at 22:50
  • 7
    @Luuklag Personal data is any information relating to an identifiable person. OP's chat messages clearly relate to OP, and OP is clearly identifiable. It is not necessary that the personal data itself is identifying, but it can also be linked data. Furthermore, chat messages are clearly information that OP has provided to an information society service, so that they are covered by the right to data portability.
    – amon
    May 16 at 7:18
  • 9
    I've opened a bug report with the community engineering team to look into this ASAP.
    – Juice StaffMod
    May 17 at 11:42
  • 2
    Quick update. We are investing the missing Jobs information. Chat content does not contain message content by design. There's no way for us to guarantee that we're not handing out message content that could contain the PII of another user.
    – Juice StaffMod
    May 17 at 18:28
  • 6
    @Juice Re: chat messages – Does that apply even if we're talking about exclusively chat messages sent by the requesting user? The given reason just sounds odd to me, since I would think you'd be able to use the same argument for comments or even posts; you'd never be able to 100% guarantee that some user-inputted text field doesn't have PII of another user, right?
    – zcoop98
    May 17 at 18:34
  • 1
    @zcoop98 That applies to all chat messages. Edit I've brought this up internally to see if I can get an explanation.
    – Juice StaffMod
    May 17 at 19:27
  • 7
    @Juice - but the messenger can take the reply back with them to those who provided the explanation, can't they? :) After all, proper attribution in posts requires one to add information about other users in the body of the post. The same goes for comments - usernames, etc. I can only second zcoop98 here - it doesn't make sense that chat messages are treated as a special case. May 17 at 19:56
  • 12
    @Juice: I'm also rather confused by the claim that chat "message content that could contain the PII of another user." Sure, technically that's true. But we're talking about chat messages sent by me, so surely they cannot contain any PII that I wouldn't already have access to? Also, chat messages are (generally) public, so isn't any PII in them already out there anyway? And I also don't see what makes chat messages special — surely the same concerns apply to Q&A posts and comments too? I'd very much appreciate an answer to these questions from whoever provided you with that explanation. May 18 at 10:23
  • 3
    Are you considering further legal steps given the current answer?
    – rene
    Jun 22 at 6:32
  • 1
  • 4
    I'm not sure that the tag should be status completed. After all it was half declined. Shouldn't it also have status declined at least.
    – Trilarion
    Jun 23 at 7:33
  • 7
    @EkadhSingh: While there's no simple and unambiguous definition of what accepting an answer on meta.SE means, generally doing so suggests that the issue has been resolved and that an acceptable solution has been found. While I haven't had much time to pursue this issue recently, I do not consider that to be the case here, as I note in my comment below. Jun 30 at 22:20
  • 2
    The staff answer has been edited by another CM; just mentioning. (cc @rene) Jul 1 at 23:00
  • 3
    @SonictheAnonymousHedgehog thanks. Not thrilled by the 6 to 8 weeks timeline but it is progress so I'm happy for now.
    – rene
    Jul 2 at 5:22
  • 3
    It's truly completed now. See the updated staff answer. Jul 22 at 0:36
15

The /jobs data export has now been fixed for GDPR requests. Please generate another export request and the data should be there.

Regarding the /chat data: We will not be including that in the data export after internal discussions, we'll include messages sent to public chatrooms to GDPR requests. While we don't have a set date for when this will be live, we'll report back here when it is.

Update: Starting on July 19th, we're now exporting all content for your messages in public chatrooms in the data export, including ones that were later deleted/removed. The content of an event is not included for messages that are not your own - for example, if as a moderator, you've edited another user's message. However, metadata is still included for events targeting messages that are not your own. Please let us know if you find any problems with it.

15
  • 11
    "Regarding the /chat data. We will not be including that in the data export." - Why?
    – Mithical
    Jun 21 at 13:55
  • 2
    @Mithical From the comments above "Chat content does not contain message content by design. There's no way for us to guarantee that we're not handing out message content that could contain the PII of another user...That applies to all chat messages. Sorry, I'm just the messenger on this one, so I can't answer any further as to why or why not it's that way."
    – ColleenV
    Jun 21 at 14:04
  • 6
    We appreciate you fixing the /jobs export. However, I'm ... concerned regarding the choice with respect to /chat. As a result, while I'd normally upvote, I'm declining to vote in this instance.
    – Makyen
    Jun 21 at 19:09
  • 15
    I'm sorry, but I do not consider this a satisfactory response. At the very least, I am requesting a detailed explanation of 1) what kind of "PII of another user" could be contained in chat messages that I have written myself, 2) how disclosure of any such information to me could harm the other users identified in it, and 3) what technical constraints prevent you (SE) from separating this information from the requested data. I believe such an explanation falls under my right to be informed about the collection and use of my personal data. Jun 21 at 20:03
  • 11
    I'm trying to get my head around wrt your claim about the /chat data. The only thing I can imagine is that chat messages doubled as a password store as well or something similar unimaginable like that. Just to be clear: we're talking about these chat messages, right? And this is how you get to page 2 and page 3. The OP could scrape them from your site ...
    – rene
    Jun 22 at 6:40
  • 5
    Hey all. No promises that I will or can answer this but I've brought it up internally to see if we want to respond further.
    – Juice StaffMod
    Jun 22 at 13:15
  • 6
    You might be required by law to change the behavior of the export. There might even be penalties involved. It will be interesting to see if you want to respond further.
    – Trilarion
    Jun 22 at 14:07
  • 10
    Just to call your attention to it: I have edited Juice's answer above with an update on the chat features.
    – Philippe StaffMod
    Jul 1 at 22:31
  • 3
    @Philippe: Thank you. I'm still not 100% convinced that including only public chat messages is generally enough to satisfy the GDPR requirement of data portability, or that SE has a valid overriding reason to exclude them. But as I have never, to my knowledge, participated in any non-public SE chat room, I consider my personal request here satisfied. Well, at least once the feature is actually implemented. Jul 2 at 15:21
  • @IlmariKaronen By non-public chat rooms, you mean ones that are used by moderators only, right?
    – 41686d6564
    Jul 3 at 14:50
  • @41686d6564 It's possible to have non-public chat rooms that can be used by non-moderators, but yes, those are the better known examples of the non-public ones referred to.
    – Mast
    Jul 3 at 16:03
  • 1
    @IlmariKaronen - the mod agreement states "I acknowledge that I have access to additional personally-identifying information about Stack Overflow or Stack Exchange users as a moderator. Some of this information may be subject to GDPR and other privacy rules. In connection with my access to and/or use of Moderator-privileged personally identifying information" and in relation to that "I will not disclose or share this information with anyone that is not a moderator or employee of Stack Exchange, Inc." - the argument of "We can't be sure if there's PII" can be true here.
    – Journeyman Geek Mod
    Jul 4 at 3:35
  • There's also an implicit expectation of privacy with regards to site-specific mod rooms and the TL. The mod removal process is also done via private chat rooms when done in accordance to process, and that's pretty much supposed to be private. I'm loath to invoke lawyers but I wonder if narrowly scoped waivers for these things would be legal/acceptable to the parties involved, considering for most part, people who can see private rooms are mods, and subject to the mod agreement
    – Journeyman Geek Mod
    Jul 4 at 3:40
  • 4
    @JourneymanGeek: Even for private moderator chat rooms where PII may be discussed, I still fail to see how disclosing to me the content of messages that I have written could in practice violate someone else's privacy. But it's at least a better argument against including such messages in the dump than any other that I've seen so far. And in any case it doesn't apply to me, as I was never elected (or appointed) as a moderator on SE. Jul 5 at 14:57
  • 6
    Right on, @Cesar!
    – Shog9
    Jul 21 at 1:59
15
+100

IANAL, but IMHO chat messages should be included in GDPR data dumps.

"Personal data" are defined in the GDPR (art. 4 no. 1) as "any information relating to an identified or identifiable natural person ('data subject')". Given that email addresses are identifying information, most data relating to your account can be considered personal. A relation is a meaningful connection between two things, IMHO the connection "said in chat" is meaningful, so chat messages should be personal data.

Thus they should also be included in the data dump. Art. 15 par. 3 says "The controller shall provide a copy of the personal data undergoing processing"; given that "processing" includes storage (art. 4 no. 2), chat messages are still undergoing processing and should therefore be eligible for a request of a copy.

Furthermore we have art. 20 (right to data portability), which says that the data subject shall have the right to receive the personal data concerning them which they have provided to the controller if the processing is based on consent or a contract and the processing is carried out by automated means. Given that the relevant chat messages were written and submitted by the OP, it is IMHO very clear, that they have provided them to the controller. AFAICT (and the privacy policy generally confirms), SE bases their processing on contractual obligations (aka providing the site under the ToS) and on your consent. And given that it's a website, the automated processing thing is applicable too.

To the objection that messages might contain personal data of other users: I don't really see this as a concern. GDPR only allows to deny the requests of art. 15 and 20 in case of adverse effects on the rights and freedoms of others (art. 15 par. 4, art. 20 par. 4). Given that the messages were written by the OP, all information inside those have already been -- at some point of time -- known by them. Furthermore they are all already public and could be scraped from the site, even by third parties. Given that, I can't see how giving the OP formal access to them could be in any way adverse.

Therefore I think SE should give access to these data in the GDPR dump too. Especially, as it is in their own interest too, as the OP could, if they wanted to, complain to any EU supervisory authority (which could possibly impose administrative fines) or even sue SE in their local jurisdiction (Finland iirc), possibly even for (non-)material damages... 🙃

4
  • 1
    This data is all publicly available, so what prevents one from going to fetch it themselves if they really want to?
    – Luuklag
    Jun 30 at 11:46
  • 8
    @Luuklag that is true but that is not something GDPR considers. There is no The controller is exempt from article 15 par 3 if the data can be scraped by the requester ...
    – rene
    Jun 30 at 11:56
  • 10
    In fact, it [the public availability of the data] provides an additional point in favour of listing chat messages in response to a GDPR request. It feels like someone in legal just can't accept they were wrong. Jun 30 at 11:58
  • 7
    I believe the original reasoning revolved around data in mod-only chat rooms. Mods frequently include data in their messages not related to them in their private discussions. A moderator should not be able to receive a dump of all data about other people they've ever posted in those rooms, especially if they are no longer a moderator (which is why sent mod messages are excluded for mods as well). But that sounds like something that should be easily solvable by just excluding chat rooms marked as "mod-only" from the export.
    – animuson StaffMod
    Jul 2 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .