11

According to Stack Overflow's rules, we can't delete our own questions and answers under some circumstances. Even we delete it, it won't delete permanently as I know.

As I understand about GDPR, GDPR allows you control of your data.

I think, if a user write question or answer, it is their data. Am I wrong? So will Stack Overflow give option to delete questions and answers permanently?

Or am I misunderstood the concept of GDPR and it won't effect for Stack Overflow?

7
  • Ubermeta dupe: Brace yourselves: The GDPR is coming!. Has been featured for quite some time...
    – Erik A
    Jun 1, 2018 at 8:50
  • @ErikvonAsmuth Thanks, but seems like it don't have a answer for my specific question or I could not find it Jun 1, 2018 at 8:55
  • 3
    Your posts are still licensed to SO under a CC license. GPRD provisions may cover the anonymization of these posts, but not its removal (since you've licensed them to SO, you are no longer in control of those). IANAL nor play one on TV.
    – yivi
    Jun 1, 2018 at 9:09
  • 3
    I'm not sure why voting on this question seems to indicate controversy, it seems like a pretty reasonable thing to ask. While the main announcement was a bit long-winded, we pretty clearly said that we couldn't hope to address all questions there. I consider this as much of an engineering curiosity as I do a question about the GDPR (even if you didn't realize that it was when asking)
    – Tim Post
    Jun 1, 2018 at 13:55
  • 1
    @Tim and OP: voting may be affected by things like the title not reflecting the content at all, the question containing broad and likely incorrect statements like GDPR allows you control of your data. and if a user write question or answer, it is their data. and not showing a link or any knowledge about that ubermeta post. If someone edits it into shape, voting might change.
    – Erik A
    Jun 1, 2018 at 15:00
  • 1
    @ErikvonAsmuth But they preface that with "As I understand". They are very clear about the fact that they aren't certain they have this correct. It doesn't make sense to edit out their misunderstanding since that's why this post exists in the first place.
    – BSMP
    Jun 1, 2018 at 15:31
  • @BSMP Not really imo. It's just noise. The question essentially boils down to Can I delete my own questions and answers now, and surrounding that question with misconceptions makes both the question and the answers longer and more complicated than they need to be.
    – Erik A
    Jun 1, 2018 at 16:27

2 Answers 2

22

This is not a bad question, and certainly one that SO's legal counsel will have considered (and continue to consider) in depth!

As a layperson, I don't think there will be a problem, though.

if a user write question or answer, it is their data.

Yes, but for one, it is not personal and/or personally identifying data, which is what the GDPR is all about.

A Stack Overflow question is typically devoid of any data of that kind - and if it's in there, it's by accident and needs to be edited out.

I think SO will be fine by having facilities for

  • Editing personal information out of posts (and revisions) quickly

  • Disassociating/anonymizing all or specific posts from your account

  • Looking up what data they have collected about you

  • Requesting info about, and the removal of, some of the data they have about you (e.g. preferred tag predictions, ad preferences) but not your posts

But even if SO posts were personal data, the GDPR doesn't mean you can always tell everyone to delete data they have about you willy nilly! That would be completely insane. Imagine you could tell a credit agency to remove information about a bankruptcy you had. Or an airline to delete records of past misbehaviour on their flights.

While they usually need to tell you beforehand about the data collection now, at the threat of massive fines and even personal liability of executives and data protection officers, businesses can still collect and retain data about you, whether you agree or not, if they have a legitimate interest in doing so.

Given that you license your contributions on SO under a CC license, Stack Overflow would probably be easily able to prove a legitimate interest in continuing to publish your posts, whether you like it or not, because it is the core of their business, and you entered into an irrevocable license agreement signing away some rights over your content.

Imagine an extreme situation: an author writes an autobiography, licenses it to a publishing house and receives money in return, but five years later requests the book be scrapped and all the existing books destroyed because they contain personal information under GDPR.

That wouldn't work, for very obvious reasons.

(That said, it's been my opinion for 9 years now that they need to make the fact that contributions are licensed under CC-Wiki MUCH clearer. I'd bet 99% of people posting on the site have no idea what license they're publishing under.)

I'm not a lawyer, nor a GDPR expert.

5
  • Yes, but it is not personal and/or personally identifying data, which is what the GDPR is about. This is correct for 99.99%. But I able to identify a few of my coworkers even they use nicknames here. Most of the time, when a user need to ask question, they add the codes to question. So other persons can who works on the same project can identify that it is on their project. Situation is more worst in workplace stackexchange site Jun 1, 2018 at 9:17
  • 2
    @IamtheMostStupidPerson I'm not sure whether that would constitute "personally identifying information" under the GDPR, though. Perhaps nobody does at this point, as the entire regulation is very new and no one knows how it will be applied in detail. Anyway, I've added a paragraph arguing that even if there is such info in posts it doesn't automatically mean they need to honour users' deletion requests
    – Pekka
    Jun 1, 2018 at 9:20
  • 5
    @IamtheMostStupidPerson any nickname is what the user chose to use; we have always offered a deletion option that disassociates your identity / nickname from a post. Jun 1, 2018 at 9:42
  • That is not very accurate. This feature request is on a 6-8 years implementation schedule. Jun 1, 2018 at 11:00
  • @HansPassant The hold up there is what do we do about calculating rolling rate limits and blocks for people with really bad asking / answering histories. I think I have a solution to that, whether it makes our engineering team cringe or not remains to be seen, but it's something I think we need to address. I'm a bit bothered that we haven't made it self-service.
    – Tim Post
    Jun 1, 2018 at 13:52
17

We, fortunately, already had the facilities in place to manage any personal information related to questions / answers and comments.

The content that you contribute (e.g. what you type in the box and submit) is given to us under the CC BY-SA 3.0 license perpetually and irrevocably. We require this because the presence of your contributions could prevent others from having contributed the same thing, meaning the removal of your contributions could leave 'holes' in the topics we cover and it's conceivable that all opportunities to acquire rare knowledge might have passed us by, because you already contributed it.

However, we reserve the right to permanently redact information that isn't critical to the viability of the contribution, and we very quickly comply with requests to remove inadvertent disclosures of proprietary or personal information (well, technically, we reserve the right to delete anything for any or no reason, but I digress).

We also comply with proper requests to remove copyrighted information that users didn't have the rights to contribute in the first place.

Now in the process of this, we also store some metadata about your post at the time it's created, because we need this information in order to be able to establish ownership in order to comply with the terms of our content license. Thus, along with a record of tags that were suggested, time / date, and other proprietary information, we also record your email address. We have a legitimate case to do this, because we must be able to verify any future requests from you to claim or disavow credit for the contribution.

GDPR gives you control over this, and we honor requests to scrub that information, similarly to how we'd scrub it if we determined that a user was not old enough to participate. We'd inform you that if you ever disavowed credit for contributing the knowledge we couldn't re-assign it to you (e.g. through deleting your account), but we'd honor it.

In our case, we were already structured so that we only stored what we had a very legitimate business case to store, and removal of random bits of personal information fortunately didn't result in any real disaster. That makes sense, if you think about it, because we only store enough information to connect you to a profile that displays nearly 100% of your activity to the public by default.

That's just an example, but it's one that shows that we don't like storing any more than we absolutely must, because weird things happen when people go away and you depend too much on what you knew about them.

Now, all products had unique challenges (Talent, Teams, etc), but the vast majority of our 'touches' are to the public Q&A platform. And even given that everything looked straight forward in theory, we had developers working nearly around the clock to make sure we were fully compliant.

The main lasting effect of this is a net good for anyone using the Internet - companies must carefully consider:

Do we have a legitimate business case for collecting this piece of information? Do we have a definite, prescribed use for it? How long do we need to retain it? Who will have access to it? How will it be shared?

... before they set any arbitrary cookie value. That's not just better information practice, that makes people consider better engineering in general, IMHO. That's one of the reasons why we so eagerly embraced it as the de-facto framework for handling information.

5
  • 4
    Fun fact: I once worked for [redacted], where we were required to log every click, every user action (often in multiple places) and when I asked what we needed with all of that, the answer was usually "we don't know yet, it just seems valuable" -- that's the kind of shenanigans I really hope the GDPR brings to an end.
    – Tim Post
    Jun 1, 2018 at 12:22
  • To be fair, Stack Exchange does click and action logging. Not every click, but nevertheless.
    – user4639281
    Jun 1, 2018 at 16:04
  • 1
    @TinyGiant Well, anyone that operates a web server or load balancer does, and those naturally rotate. I'm talking about more .. well .. just kinda creepy, is the best word I have for it, sorts of logging. But I do get your point.
    – Tim Post
    Jun 1, 2018 at 16:35
  • 1
    I was referring to the "GPS" JavaScript function that is triggered when clicking on some UI elements. I'm fairly certain that is just for statistics for the most part, but it is still more than just access logs at the server level.
    – user4639281
    Jun 2, 2018 at 18:48
  • 1
    should scrubbing personal information include anonymising/removing @ mentions? E.g. I think I can identify user4639281 by your previous comment. Nov 6, 2019 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .