I just recently learned about the automated service provided by Stack Exchange for handling GDPR Data Access Requests. So, of course, I tried it out, and indeed promptly received a 13 megabyte zip file (reference code GDPR-P20210515-3112) supposedly containing all data SE has about me.
However, while the data I received is quite interesting, it does not seem to actually be complete. In particular:
/chatfolder only includes, for each of the three SE chat servers I've used (chat.stackoverflow.com, chat.stackexchange.com and chat.meta.stackexchange.com), files named
Votes.jsonand (for chat.meta.stackexchange.com only)
Schedule.json. None of these files seems to contain chat messages that I've written. In fact, searching the entire zip archive for known substrings from my past chat messages turns up no results.
For a specific example, this chat message (posted by me in 2016 and still clearly present on SE servers) contains the substring "Wednesday here for 45 minutes". This string does not appear in any of the JSON files included in the archive I received.
/jobsdirectory that's (according to
readme.txtincluded in the archive) supposed to contain "Your personal data associated with activity on Stack Overflow’s Jobs site (for candidates) and Stack Overflow Talent (for employer accounts)" is entirely missing from the archive I received, even though I've used SO Jobs actively in the past and Stack Exchange clearly still retains data about my activity there.
In particular, I searched the entire archive for some phrases from my past job applications and from messages in my Jobs inbox and found none of them in the archive. (My Developer Story and job preferences do seem to be included, but they're under
/qa/stackoverflow.comfor some reason.)
Also, while the job preferences dump does contain the filename of my saved resume, an actual copy of the resume doesn't seem to be included, even though the archive claims to contain "a copy of all your personal data associated with your account." While I'm not a lawyer or an expert on the GDPR, it seems to me that the least SE should do, if they don't want to include the resume itself in the data archive, would be to clearly indicate e.g. in the readme file that they're storing it (no, just having a filename buried in a huge JSON dump isn't enough) and provide a link to download it.
There might be more things missing, but these are just what I noticed in a few minutes of casual examination. In any case, it's not really my job to try and guess what data SE might have about me beyond what's included in the archive. Rather, it's Stack Exchange's responsibility to comply fully with all valid GDPR subject access and data portability requests.
FWIW, I don't think any of these omissions are deliberate or malicious — it would be pretty silly for SE to e.g. provide me with detailed information about when I've entered and left each chat room and which messages I've starred, but leave out the obvious and easily discoverable data about what I've posted in chat. It seems much more likely to me that these omissions are simply caused by bugs, perhaps due to changes made to how SE stores this data since the GDPR data access service was implemented.
But they still should be fixed.
(Also, while you're at it, could you please fix the zip file generator to use normal slashes instead of backslashes after the site part in the file names? That would make the archive much easier to browse on non-Windows systems.)
Ps. Just to make this a formal request, I am hereby invoking my rights to data access and data portability, as granted to me as a citizen of an EU member state by the EU GDPR, and requesting that Stack Exchange, Inc. provide to me without undue delay:
- a copy of any personal data and other supplementary information relating to me that they possess, including
- a copy in a commonly used machine-readable structured format of any personal data that I have provided to them, either explicitly or as a result of using their services, including but not limited to any recorded website usage and search history, and specifically including the missing data identified above.
This request has also been sent (with minor amendments) to [email protected] (Jira ticket # PRIVACY-1474).