12

It's long been the case that when a user requests their account be deleted, all of their contributions are dissociated from their name. This would ordinarily be considered a violation of the CC BY-SA license, which requires that attribution be retained unless the contributor specifically requests that it be removed.

To ensure that the attribution removal remains legal, the normal form for requesting one's profile on a single site be deleted, /users/delete/current, has the following text:

Your questions and answers will remain on the site, but will be disassociated and anonymized (the author will be listed as "user[user ID]") and will not indicate your authorship even if you later return to the site.

This means that when a user requests their profile on one site be removed, they're also simultaneously requesting that their attribution be removed from all posts, which thus makes the removal allowed.

However, the form to request one's entire network account and personal data be removed under the GDPR, /legal/gdpr/request, contains no such text indicating that one's also requesting under the license to have their attribution removed from all their network contributions. This also removes attribution just like the above, but it could be a violation of the license since the user wasn't notified that they're requesting it.

The account deletion FAQ was recently edited by a staff member to officially endorse making a GDPR request as a means to quickly request one's entire network account be removed, so it's not a rare form used only by those well aware of the system.

Can the fact that attribution will be removed from all posts also be added to the GDPR erasure request form? I propose editing the description for the erasure option to:

Permanently erase the personal data associated with your account or email address, and attribution from all your contributions.

As a side note, the normal form's text only says that attribution removal is only being requested for questions and answers - however, attribution is also removed from other content, such as comments, edits, and chat messages (if the chat profile qualifies for automatic deletion on profile removal - see the relevant section of the account deletion FAQ). This should be changed to "content" or "contributions". Let me know if I should post that as a separate question.

14
  • 5
    While I agree it would be better to explicitly state that the user's GDPR erasure request constitutes a request for dissociation from their content, I disagree that the current process is currently an actual violation of the CC BY-SA license. The license does not have a specific format for the "request" for removal of attribution. IMO, a general GDPR based request to remove all personal data can't be reasonably interpreted as anything other than removing the personal data which is necessary for attribution, thus obviously and inherently constituting a dissociation request.
    – Makyen
    Commented Mar 2, 2022 at 1:44
  • 4
    Overall, yes, a change here would be good and beneficial, but let's save the "you're violating the license" arguments for times where the license is actually being violated, or at least where it's more clear there's an actual, or at least probable, violation.
    – Makyen
    Commented Mar 2, 2022 at 1:50
  • @Makyen - So more of an implied or implicit consent of the disassociate of the license in relation to their profile since the only way to comply with the complete removal of their profile is to perform the disassociation of their contributions to the profile that has been requested to be completely deleted
    – Ramhound
    Commented Mar 2, 2022 at 1:51
  • @Makyen A username could be a pseudonym (like mine), and so wouldn't constitute personal data (e.g. a real name). The SE legal team has clarified that the current procedure of changing the username to an anonymized user code constitutes removing the attribution. One proper expectation a user could hold when filling the form is that while all their personal data (including real name) will be removed, their pseudonym will be retained, like how account deletions were handled a decade ago. Commented Mar 2, 2022 at 1:55
  • When it comes to pedantic reports about legal things, I still think it's important to report them because it can happen that a certain unscrupulous party capitalizes on said minutia to put SE into legal trouble. As an example, a missing comma in a law cost a company five million dollars Commented Mar 2, 2022 at 1:58
  • @Ramhound The user is using a big stick, the GDPR, to request and require that all their personal information be removed. How can that not be a request to remove the personal information necessary for attribution under the CC BY-SA licenses? The other way to interpret it would be that the GDPR, which is law, once the erasure request is made supersedes and invalidates the attribution requirement, and only the attribution requirement, in the CC BY-SA license, because the data is required to no longer be available.
    – Makyen
    Commented Mar 2, 2022 at 2:00
  • 2
    @Sonic: You're mistaken; the EU's definition of personal data is extremely broad and allows for both direct and indirect identification. If your pseudonym could reasonably be combined with other data to uniquely identify you, then it may be personal data under the EU's definition. Legally, it is unwise to leave it in place if the user requests the removal of all PII.
    – Kevin
    Commented Mar 2, 2022 at 2:01
  • Finally, this says "possible license violation", not "definite...". I've retagged my question as a possible-bug (synonym of support) and as a feature-request. Commented Mar 2, 2022 at 2:01
  • @Kevin So then even the "user[user ID]" names are still considered PII? Commented Mar 2, 2022 at 2:03
  • @Sonic: Not if they delete all of the other data that they could otherwise have combined with that user ID to identify you.
    – Kevin
    Commented Mar 2, 2022 at 2:05
  • 1
    @SonictheSaveUkraine-hog I very explicitly stated that I felt a change to explicitly state that the user's posts will be dissociated would be good. What I'm objecting to here is the hyperbole that the current wording constitutes a license violation. We have, and have had, enough major issues where there are actual legal problems, we don't need to go blowing things up into legal fights when it's a stretch for them to be that (in this case, a significant stretch, IMO).
    – Makyen
    Commented Mar 2, 2022 at 2:08
  • @Makyen Is the side note a true concern? Commented Mar 2, 2022 at 2:32
  • @SonictheSaveUkraine-hog I'm not sure what you're asking. My concern is that banging the drum that "SE is violating the CC BY-SA license", even as a "could be a violation" is something we should try to do only when we're fairly confident that it's likely there's an actual license violation. IMO, this isn't that time. I'd rather have "regulars" on the site only "cry wolf" when it's more likely that there's a wolf around. That sort of cry is raised often enough by people who don't regularly participate, but who are upset, such that there's already negative sensitivity to hearing it.
    – Makyen
    Commented Mar 2, 2022 at 3:10
  • 2
    If you're concerned that someone who requested a GDPR erasure might make the claim that they didn't intend disassociation, then it might be reasonable to state that. For example, something like: "While the GDPR erasure is effectively a request for disassociation of all posts, I'm concerned that a user requesting the GDPR erasure won't fully understand it is a disassociation request, unless it's stated explicitly. I wouldn't want to see a user coming back and trying to argue that the CC BY-SA license still requires attribution."
    – Makyen
    Commented Mar 2, 2022 at 3:11

1 Answer 1

8

This has now been changed, the new text reads:

Permanently erase the personal data associated with your account or email address. This action cannot be undone. Your questions and answers will remain on the site, but will be disassociated and will not indicate your authorship even if you later return to the site. Your posts on [Site Name] will be attributed to “userXXXXXX” and your posts on our other sites (if any) will be similarly anonymized.

The last sentence is not shown if the user is logged-out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .