20

I just recently learned about the automated service provided by Stack Exchange for handling GDPR Data Access Requests. So, of course, I tried it out, and indeed promptly received a 13 megabyte zip file (reference code GDPR-P20210515-3112) supposedly containing all data SE has about me.

However, while the data I received is quite interesting, it does not seem to actually be complete. In particular:

  • The /chat folder only includes, for each of the three SE chat servers I've used (chat.stackoverflow.com, chat.stackexchange.com and chat.meta.stackexchange.com), files named ActiveRooms.json, Events.json, User.json, Votes.json and (for chat.meta.stackexchange.com only) Schedule.json. None of these files seems to contain chat messages that I've written. In fact, searching the entire zip archive for known substrings from my past chat messages turns up no results.

    For a specific example, this chat message (posted by me in 2016 and still clearly present on SE servers) contains the substring "Wednesday here for 45 minutes". This string does not appear in any of the JSON files included in the archive I received.

  • Also, the /jobs directory that's (according to readme.txt included in the archive) supposed to contain "Your personal data associated with activity on Stack Overflow’s Jobs site (for candidates) and Stack Overflow Talent (for employer accounts)" is entirely missing from the archive I received, even though I've used SO Jobs actively in the past and Stack Exchange clearly still retains data about my activity there.

    In particular, I searched the entire archive for some phrases from my past job applications and from messages in my Jobs inbox and found none of them in the archive. (My Developer Story and job preferences do seem to be included, but they're under /qa/stackoverflow.com for some reason.)

  • Also, while the job preferences dump does contain the filename of my saved resume, an actual copy of the resume doesn't seem to be included, even though the archive claims to contain "a copy of all your personal data associated with your account." While I'm not a lawyer or an expert on the GDPR, it seems to me that the least SE should do, if they don't want to include the resume itself in the data archive, would be to clearly indicate e.g. in the readme file that they're storing it (no, just having a filename buried in a huge JSON dump isn't enough) and provide a link to download it.

There might be more things missing, but these are just what I noticed in a few minutes of casual examination. In any case, it's not really my job to try and guess what data SE might have about me beyond what's included in the archive. Rather, it's Stack Exchange's responsibility to comply fully with all valid GDPR subject access and data portability requests.

FWIW, I don't think any of these omissions are deliberate or malicious — it would be pretty silly for SE to e.g. provide me with detailed information about when I've entered and left each chat room and which messages I've starred, but leave out the obvious and easily discoverable data about what I've posted in chat. It seems much more likely to me that these omissions are simply caused by bugs, perhaps due to changes made to how SE stores this data since the GDPR data access service was implemented.

But they still should be fixed.

(Also, while you're at it, could you please fix the zip file generator to use normal slashes instead of backslashes after the site part in the file names? That would make the archive much easier to browse on non-Windows systems.)


Ps. Just to make this a formal request, I am hereby invoking my rights to data access and data portability, as granted to me as a citizen of an EU member state by the EU GDPR, and requesting that Stack Exchange, Inc. provide to me without undue delay:

  • a copy of any personal data and other supplementary information relating to me that they possess, including
  • a copy in a commonly used machine-readable structured format of any personal data that I have provided to them, either explicitly or as a result of using their services, including but not limited to any recorded website usage and search history, and specifically including the missing data identified above.

This request has also been sent (with minor amendments) to privacy@stackoverflow.com (Jira ticket # PRIVACY-1474).

10
  • Just to be sure: your jobs account is linked to your current account? – Luuklag May 15 at 22:50
  • Also, it is questionable if chat messages are data as protected by GDPR. Times could be, as work schedules (which could place a person at a certain place at a certain time) are such gdpr data. – Luuklag May 15 at 22:51
  • 6
    @Luuklag Personal data is any information relating to an identifiable person. OP's chat messages clearly relate to OP, and OP is clearly identifiable. It is not necessary that the personal data itself is identifying, but it can also be linked data. Furthermore, chat messages are clearly information that OP has provided to an information society service, so that they are covered by the right to data portability. – amon May 16 at 7:18
  • 7
    I've opened a bug report with the community engineering team to look into this ASAP. – Juice May 17 at 11:42
  • 1
    Quick update. We are investing the missing Jobs information. Chat content does not contain message content by design. There's no way for us to guarantee that we're not handing out message content that could contain the PII of another user. – Juice May 17 at 18:28
  • 4
    @Juice Re: chat messages – Does that apply even if we're talking about exclusively chat messages sent by the requesting user? The given reason just sounds odd to me, since I would think you'd be able to use the same argument for comments or even posts; you'd never be able to 100% guarantee that some user-inputted text field doesn't have PII of another user, right? – zcoop98 May 17 at 18:34
  • @zcoop98 That applies to all chat messages. Sorry, I'm just the messenger on this one, so I can't answer any further as to why or why not it's that way. – Juice May 17 at 19:27
  • @Juice Thanks for coming back with an answer at least, I appreciate it! – zcoop98 May 17 at 19:49
  • 5
    @Juice - but the messenger can take the reply back with them to those who provided the explanation, can't they? :) After all, proper attribution in posts requires one to add information about other users in the body of the post. The same goes for comments - usernames, etc. I can only second zcoop98 here - it doesn't make sense that chat messages are treated as a special case. – Oleg Valter May 17 at 19:56
  • 7
    @Juice: I'm also rather confused by the claim that chat "message content that could contain the PII of another user." Sure, technically that's true. But we're talking about chat messages sent by me, so surely they cannot contain any PII that I wouldn't already have access to? Also, chat messages are (generally) public, so isn't any PII in them already out there anyway? And I also don't see what makes chat messages special — surely the same concerns apply to Q&A posts and comments too? I'd very much appreciate an answer to these questions from whoever provided you with that explanation. – Ilmari Karonen May 18 at 10:23

You must log in to answer this question.

Browse other questions tagged .