By making the privacy policy so generic, you've made it bind you a lot less. That's the opposite of what you want in a privacy policy.
- A privacy policy should describe your current practices: how you're currently using people's data.
- A privacy policy allows us to give meaningful consent for your data processing, and therefore we need to know what you're doing with our data; therefore you can't add things to your privacy policy describing things we don't know about. If it's in the privacy policy before a product / feature announcement, that's not consent.
- Personal data shall be:
- processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
- collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
- accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
- The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
- The privacy policy is opaque, arguably violating 1(a) ('transparency').
- I have no way of knowing whether Stack Overflow is compliant with 1(b) ('purpose limitation').
- If the Privacy Policy is to believed, Stack Overflow is blatantly violating_ 1(c) ('data minimisation'), 1(e) ('storage limitation') and 1(f) ('confidentiality'); given the various inaccuracies elsewhere in the document, and my generally high opinion of Stack Overflow, I believe¹ the Privacy Policy is simply wrong about what Stack Overflow's real actions and policies are.
¹: To be pedantic, Stack Overflow's actions aren't perfect: from looking at the GDPR subject access request data, it seems like Stack Overflow is associating a tiny bit more analytics data with users than is strictly necessary. However, it's little enough that I don't care, I don't see how it's abusable, and it's probably kept for recovering stolen accounts or something. Plus, it's exactly the data the old privacy policy said they kept.
Major issues (summary)
- Moderators aren't given permission to use some of the mod tools; neither is Stack Overflow, except with an excessively broad reading of the ambiguities. Since moderators have to adhere to the privacy policy, does that mean we can't use them any more?
- What, why, when data is collected, what it's used for and who it's shared with are listed separately, so we can't know what's being used for what, shared with whom.
- “Technical” data has an unknown scope, and an unknown purpose.
- In “cookies and other technologies”, you never say what the other technologies are, nor what you use them for.
- “Unique device identifier” could mean several of many things.
- General vagueness; grammatical issues to the point of meaningless, in a couple of cases.
- So much “for example” and “such as” and “e.g.”. You're not telling us what we need to know.
- A blanket permission to perform all statistical analysis. (Later on, statistical analysis “for business purposes” – which seems more specific, but actually isn't.)
- “Legitimate interest” examples that can't be justified under legitimate interest, like marketing personalisation.
- Things in the privacy policy that don't apply to Stack Overflow:
- Things that, by law, I can't even consent to.
- A 16-years-old age limit (it's 13 elsewhere).
- The GDPR “invoking your rights” procedure in the Privacy Policy (email [email protected] for everything) is different to the real procedure (use https://stackoverflow.com/legal/gdpr/request for the three things on that form, and [email protected] for everything else).
Good bits
There is some good stuff, though:
Information from Developer surveys, questionnaires, research and feedback programs
We collect information through questionnaires, surveys and feedback programs to help improve our products and give us insights. We may also conduct similar research for advertisers and our marketing partners. We ask you for your consent to use this information when you participate in these programs and events.
While “advertisers and our marketing partners” sets my hair on end, you're going to ask consent in-the-moment! This is how you should do it! That's the better-than-the-industry-standard Stack Overflow I know.
You should not include any financial information or other information that you do not wish to make public when using our Public Network, which is a public website. We do not collect such information. It is your responsibility to keep such information safe and secure.
You didn't need to include this, but it was relevant. Good job. (I think.)
If we transfer any personal information in pursuing such a business transaction [e.g. audits], we will always ensure that strict confidentiality measures are in place to protect your privacy interests.
:-)
Developer Survey
This section is too big to quote, but it's great too. (Not sure how much it's changed from before, because the diff is useless.)
Advertising on our Network
It's nice to get insight into this. While I don't like everything here (I don't like the state of modern online advertising), you're actually explaining what's going on, so that I know what I'm agreeing to – and hence consent for this is valid… probably. I'm not a lawyer.
Employer Branding
I'm guessing this is Collectives? The privacy policy is okay (a little unclear, but it's practically non-normative), but I'm more impressed by the actual implementation-as-described.
It's not Collectives.
Well, impressed after going through this Privacy Policy. It's what I would normally expect from Stack Overflow; you do things properly, most of the time.
When Stack Overflow shares your personal information and other collected information with third party service providers, we require that they use your information only for the purpose of providing services to us and consistent with this privacy policy.
Not sure how consistent this is with third-party advertising, but I love the sentiment.
Event sponsors and partners – we may share your personal data with sponsors of Stack Overflow events and partners whom we hold events with for marketing purposes when you have given your permission for us to do so.
You've said who you're sharing it with, when, and why. All it needs is what “personal data” will be shared, and you're golden!
Questions / critcisms
Technical Data: including internet protocol (IP) address, your login data, traffic data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and platform and other communication data which gives us information about how you accessed our website. Other account information and usage information including your IP address and browser data may be used for diagnosis, security, and Product and Service optimization.
To what extent are these associated with each other? If I'm reading this right, you store enough information to uniquely identify my browser, and my location, and my interaction times, and my login details; if they're in the same table row (or associated with the same timestamp, which is basically the same thing), that's far too much information! I can't think of any way that would help with technical support…
… so why's this called “technical data”? What, exactly, is it being used for?
Analytics information
Stack Overflow uses data analytics to ensure site functionality and to optimize our Product and Service offerings to you. We use web browser and mobile analytics to allow us to understand Network and Apps functionality. In doing so, we record information including, for example, how often you visit the Network, how often you contribute content, Network and Apps performance data, errors and debugging information, and the type of activity you engage in while on the Network or in your use of our Products and Services. We may on occasion share this information with third parties with whom we have contracts for products and services to assist Stack.
- What is “the type of activity you engage in while on the Network”?
- Who are these “third parties”?
Marketing and sales information
We collect details of the services you receive and your preferences; information about your device or the software you use, e.g., its IP address, technical specification and uniquely identifying data; cookies and similar technologies we use to recognize you, remember your preferences and tailor the content we provide to you – our cookie policy contains more details about how we use cookies.
Too vague, sorry. There are some issues, e.g., it's not concrete, technical specification and uniquely meaningful words; punctuation and similar problems so I can't actually follow the sentence properly – my profile contains more details about how I'm interpreting the HTML.
Device and browser information received automatically
When you visit the Network or use our Apps, Stack Overflow automatically receives and records information from your browser or mobile device, such as your Internet Protocol (IP) address or unique device identifier.
What's a “unique device identifier”? A euphemism for browser configuration fingerprinting? A cookie you set? The serial number on the bottom of my laptop, learnt by asking the local unicorns really nicely?
Location information
When you use the Stack Overflow Network, and certain of our Products and Services, we collect location information about you, including your IP address, your location, browser information, and how you came to the Stack Overflow Network.
I am aware that location information includes “[my] location”. But you're not collecting my location; you're collecting some information that you're deducing my location from. (At least, I really hope that Stack Overflow isn't going to start requesting GPS traces…) What is that information?
I'm guessing it refers to the location field of the user profile, otherwise this doesn't make sense:
You may revoke our permission to collect some of this data, including your location and browser information through your Account Settings, but this may limit functionality in some cases.
Although I still don't know how to limit collection of my “browser information” (whatever that means); how can I do this?
We share this information with certain third-parties (e.g., talent recruiters, payment processors, and advertising providers) in order to provide you with our Products and Services.
Again with the “e.g.,”! I know at least one category not present: moderators have access to some of this information some of the time. Who else? GDPR says you need to give an exhaustive list of purposes, unless the ones not listed fall under one of the special exemptions (and even then you really should). “e.g.” is not generally sufficient for consent.
We collect information about the actions you take when using the Services. This includes your interactions with content, like voting, saving, hiding, and reporting. It also includes your interactions with other users, such as following. We collect your interactions with communities, like your subscriptions or moderator status.
… What? This doesn't describe Stack Overflow at all. What is going on here? (Is it copied and pasted from Reddit?)
Pages you view or search for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), your engagement with certain variable/dynamic elements of a page, and methods used to browse away from the page.
If this is “technical data”, then I'd really like to know what it is being used for.
Information collected from cookies and similar technologies
This section provides no information about the “similar technologies”. What are they? How are you using them, and why?
We may receive and process information about your location. For example, with your consent, we may collect information about the specific location of your mobile device (for example, by using GPS or Bluetooth).
That's an example? I didn't know the Stack Exchange app was even getting updates. It's also a little troubling that “with your consent” is under the “for example” section; does consent apply to all of the location data processing?
If you choose to connect with us through a social media platform, we may, through the social media platform connection, collect additional information from you, such as your usernames, profile picture, contact information, contact list, and the profile pictures of your contacts.
Sorry. I cannot consent to this. Literally; the law does not permit me, even though I understand exactly what it says. Does that mean I have to leave?
Information from third parties to help us to combat fraud, provide Services or that relates to your interactions, including your communications between individuals, organizations, prospects and other stakeholders acquired from companies that collect combined information and share it with us.
Under what circumstances will you be communicating with other companies about me? This is seriously concerning me; I've given Stack Overflow information that I would not trust other companies with, and I don't know of any mechanisms to revoke your access to that information. (Come to think of it, I should know about those mechanisms, shouldn't I?)
We may combine the information we collect about you from the various sources described above.
Nope. No blanket “combine information”. How are you combining it? Some of this information, you're not allowed to combine without explicit consent! But it seems like you intend to do it anyway; why else would you (attempt to) give yourself the power to do so?
For statistical analysis (e.g., on the use of our websites).
Virtually everything you can do with data is statistical analysis. This is carte blanche to do whatever you want! I don't think I can even consent to that.
To operate and improve our websites and services.
What does this mean? (It probably has a legal meaning, given how many companies use it, but I don't know what that meaning is.)
To provide improved website and product experience and communications informed by your product subscriptions and/or data collected.
Again, what does this mean? “improved experience” is fairly vague.
Where it is in our legitimate interests, including our commercial interests or a third party’s legitimate interest in using the personal information. Examples include when we analyze what content has been viewed on our Network and apps, so that we can understand how they are used and improve our content; carrying out marketing analyses to better understand your interests and preferences so that we can make our marketing more relevant to your interests and preferences. This includes when we promote our own products and services.
That's not how this works. Legitimate interest only goes so far when talking about marketing analyses, and given the amount of data you wrote about collecting above? You aren't allowed to use all of it. So what data do you use under this basis?
We do not use your personal data on the basis of legitimate interest for activities where individuals’ interests override our interests.
How are you making this decision? (If you were clearer elsewhere, I wouldn't need to know this.) Do you even know what my interests are?
We use your information to provide and improve our Products and Services, for identification, verification, to provide support, for online and offline marketing, including through third party tools such as Google Analytics, and for general research and analytics reporting. We gain insights into which of our Products and Services you are using most, what you’re interested in, and to better enable you to use and access our Products and Services. For example, we provide an API with information that has already been made publicly available by users to enable users to more easily access and use our services. We have a legitimate interest in enabling and customizing your experience of our Product and Services offerings.
If “online and offline marketing” means what I think it means… No way do you have a legitimate interest in tying my online identity to a real-world one, or even to anything I do off the Stack Exchange network. I have formally objected via [email protected].
(Yes, I know you're not doing anything of the sort; I'm feigning outrage because you could. You're giving yourselves the power to do so, and who knows who'll be working at Stack Overflow in five years' time?)
Statistical analysis to help us manage our business, e.g., in relation to our financial performance, customer base, product range or other efficiency measures
Is this what the “statistical analysis” thing from earlier was? “Statistical analysis to help us manage our business” is narrower in scope, and while I still don't know what it means, it'd be good if you could tighten up the previous mention.
Also, is this statistical analysis just with non-identifying information (or, if analysing identifying information, such that the output of the statistical analysis cannot be interpreted in a way that includes identifying information)? If so (which I'm pretty sure it is in practice), please tighten that up too.
Where's the statistical analysis that moderators do? Unless “statistical analysis for business purposes” is ridiculously broad on a technicality (everything a business does is business purposes… maybe write “business administration purposes” or something?), mods aren't allowed to use some of the mod tools under this new privacy policy.
Updating and enhancing customer records
Updating, okay. Enhancing? What does that mean? (If this only applies to Teams etc. customers, I don't care.)
You haven't defined “customer”. Who is a customer?
Cookies and Similar Technologies
Still don't know what “Similar Technologies” are.
We will get consent through our online consent management portal, or via other consent mechanisms before we can use your personal data in this way.
As I (and others) have said before, your “online consent management portal” is not particularly consentful. Is this a commitment to fixing it?
We also offer conversion pixels so advertisers can track conversions that happen within 30 days of an ad being served.
What is “track”, here? I can't work out how you would track this, so I can't work out how you're doing it, nor what data that entails.
We use Google Ads to display personalized ads to users. You can find out more or opt out by visiting Google's help center.
GDPR violation. Such things should be opt-in only. Unless this is part of the consent toaster, of course, but that only talks about cookies, so I assume not.
The way that Microsoft Advertising works is clearly described, and appears to be fine. They're right next to each other. This suggests that there is a problem with Google Ads.
WHO DO WE SHARE YOUR PERSONAL DATA WITH?
Which “personal data” are you sharing with which people? That's the important part, and it's missing.
Advertising partners – When you visit or interact with our websites, e.g., when you use the Public Network, we and authorized third parties will, with your permission, place certain cookies on your device and your account activity as described in more detail within our cookie policy.
You'll do what to my “account activity”? (I think you a word or two.)
We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with contractual obligations which ensure adequate protection for your personal data.
You haven't clearly specified all of these purposes in the privacy policy, despite the broad swathing permissions given to Stack Overflow (not third-parties) by other parts. For instance, you seem to be a bit contradictory (or maybe just unclear) about the purposes for which advertisers may use my personal data; what are they?
We may carry out interest-based advertising through third party services such as Microsoft or Google, as described under Advertising, above. You can opt out of such advertising in the following ways:
GDPR violation. (I know, the state of the advertising industry sucks. Still a GDPR violation, as written.)
Geolocation information based on your IP address, or more specific location information if you authorize your device to provide it to us.
What systems do you actually have that collect specific location information like this? (And does this count passive authorisation, i.e. if the device responds to your API requests without the user's knowledge / consent?)
Inferences we make based on other collected data, for purposes such as recommending content, advertising, and analytics.
What inferences do you make? You have enough information, and the carte blanche, to make a lot of inferences, and you have not tied your hands in any way about this.
The Stack Overflow platform is not intended for children. We do not knowingly offer this or any other Product or Service to anyone under the age of 16.
When did this go up? (Probably GDPR-related, as per Andrew Leach's comment.)
At present, I am unable to meaningfully consent to this change in privacy policy; much as I might like to, my hands are tied.
Yes, in case you were wondering, you have lost the benefit-of-the-doubt from me. It's nothing personal; those I know within the company would be among the first to object to some of the stuff this Privacy Policy lets Stack Overflow do. Nonetheless, you're a large, reasonably old company owned by a multinational conglomerate, and people who'd go to bat for us have been fired before.
HOW WE USE YOUR PERSONAL DATA... Where it is in our legitimate interests, including our commercial interests or a third party’s legitimate interest in using the personal information.