-29

I came across a Meta answer with comments that made me wonder whether there is a policy on what private information Moderators are allowed to reveal under what circumstances.

This policy should at the very least obey the laws of relevant countries, e.g., GDPR for people in the EU.

The revelation of private information makes me wonder whether this would be a violation of GDPR, if OP was in the EU at the time of posting.

The relevant exchange is:

OP: Thank you for the clear explanation. That is helpful and I appreciate it. Having said, I think it's wholly inappropriate for you to post the text of a "in need of moderator intervention" flag in a public forum. Perhaps I'm wrong, but I don't think this text is part of the public-facing data of this site and users do not expect to see their posts held up for public discussion by those with moderator privileges.

Moderator: @OP We keep flags strictly private, unless you bring up the issue in public, which you did by posting this question about the same issue which you previously flagged. It's possible I'm wrong about your question here releasing us from that privacy, but that's how I interpreted your question.

I don't think any EU lawyer would constitute posting a question as explicitly releasing the Stack Overflow moderator from that privacy.

It could be that in the US the concepts are different. But given that Stack Overflow also operates in the EU, it would be good if there was a clear guideline to make global moderators aware of what constitutes release and what not.

I'm not trying to make this about the individuals at all here. This is just the inspiration. To that end, I am not linking to the question even though it may reduce usefulness. The private part was later edited out by another moderator. But the comment still stands as is. So clarity on the general point would be helpful.

Update:

Response to highly upvoted comments that entirely miss the point that I'm not claiming with certainty that this particular case would violate GDPR (I'm not a lawyer). In fact the comment is a case in point for the creation of a policy as the policy would help clarify what is and isn't considered personal data.

Here's the comment:

What Private Information has been exposed here? PII has a specific definition, and none of what you quote is close to PII. TL;DR: Keeping something private does not mean that the information is private in data terms, or that it is Private Identifiable Information (PII) (which is presumably what you are referencing here).

I think confuses US/EU terminology here. GDPR doesn't only cover things that identify you, but any information that is related to an identifiable person. The information made public is clearly related to an identifiable person.:

The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates has four common variants based on personal or personally, and identifiable or identifying. Not all are equivalent, and for legal purposes the effective definitions vary depending on the jurisdiction and the purposes for which the term is being used. [a] Under European and other data protection regimes, which centre primarily on the General Data Protection Regulation (GDPR), the term "personal data" is significantly broader, and determines the scope of the regulatory regime. https://en.wikipedia.org/wiki/Personal_data

The valid question is: does the text of the message the user submitted fall under GDPR protection? I'm not a lawyer, but to me it's not obvious that it isn't. This post is about the question in general, whether there is a policy. Such a policy would help clarify what is or isn't covered. And avoid this discussion.

Update 2: People seem to misunderstand my point and think I'm asking a legal question. No, this is just one way to motivate why it's an interesting question to discuss. Core points to discuss:

  • Is there a written policy?
  • If not, should there be a written policy?
  • Even if not, what is the unwritten policy?
  • What should the policy be?
27
  • 16
    What Private Information has been exposed here? PII has a specific definition, and none of what you quote is close to PII.
    – Thom A
    Mar 8 at 9:44
  • 8
    Not to mention that the Moderator specifically states "unless you bring up the issue in public"; if the OP has brought up the subject themselves, in a public place, then they have already given implicit consent for the subject matter to be discussed. If this wasn't the case, any posts created to discuss flags would need to be closed, deleted, and redacted per your interpretation.
    – Thom A
    Mar 8 at 9:45
  • 5
    TL;DR: Keeping something private does not mean that the information is private in data terms, or that it is Private Identifiable Information (PII) (which is presumably what you are referencing here).
    – Thom A
    Mar 8 at 9:47
  • 3
    Did the flag contain any information that is actually protected by GDPR? The flag text itself, imho, isn't.
    – BDL
    Mar 8 at 9:49
  • I updated the question with responses to @Larnu. The comments are actually a point in case: it would be helpful to know what information falls under GDPR protection and what doesn't. I don't have the answer. But the policy would take the question from one to argue about to one with clear facts from professionals (lawyers). One can still discuss that, but it would be a start. Mar 8 at 9:59
  • 2
    " it would be helpful to know what information falls under GDPR protection and what doesn't." That isn't a question for meta, @CorneliusRoemer . Law would be a better site, but I suspect that "What information is covered under GDPR?" might be a little broad; it's a non-simple subject.
    – Thom A
    Mar 8 at 10:01
  • 2
    That's still defined under GDPR regulation and isn't a question for meta. Mar 8 at 10:04
  • 1
    "information related to me" is very broad. Whether or not this specific action was correct requires context. Also, that's 2 very different questions in one.
    – Cerbrus
    Mar 8 at 10:20
  • 9
    Are moderators even subject to the rules/requirements of GDPR? Wouldn't those apply only to the company, of which moderators are not agents or representatives? Are you bound by GDPR in your interactions with other individuals on this site? Those musings aside... If you're really trying to ask about the circumstances under which moderators will reveal the text of flags, which is presumed confidential (seen only by the flagger and moderators), then ask only that question. Leave out the red-herring references to GDPR, PII, personal data, etc.
    – Cody Gray Mod
    Mar 8 at 10:24
  • 1
    @CodyGray the way I understand it, the site is subject to GDPR rules. This includes actions from site representatives. A moderator/owner/admin/poweruser/whatever can not legally share another user's PII without explicit consent. If that were to happen, those that run the site need to intervene. If they don't, there'd be grounds for legal action. Now whether someone would try to enforce that is a whole different discussion.
    – Cerbrus
    Mar 8 at 10:26
  • 1
    @CodyGray Due to the moderation position you have access to data which falls under the GDPR. I would be surprised when the agreement between a mod and the company doesn't include the protection of private information, including PII, due to the requirement for the company to protect that data. So by that mods are subject to the rules/requirements of GDPR.
    – Tom
    Mar 8 at 11:40
  • 2
    If the database were public, you might've been somewhere near correct. But it's not, and you're making massive leaps in logic to imply something bad was happening, in a situation where we have no context.
    – Cerbrus
    Mar 8 at 11:57
  • 6
    "It is possible to identify the user who submitted the flag" the user has already been identified, it's the OP who is asking about the flag. A moderator can't expose the identity of a user when the user has already exposed themselves. A moderator won't provide details of the flag unless the user makes themselves known.
    – Thom A
    Mar 8 at 13:17
  • 3
    @CorneliusRoemer: I didn't close-vote, but without knowing the OP's flag text, it's unclear to me whether we are discussing an actual issue here or not. I think this is also the reason why the discussion in the comments drifted into a direction that you didn't intend to go...
    – honk
    Mar 8 at 17:11
  • 5
    @CorneliusRoemer While updating the question you may want to clarify your position on why you believe comments are not covered by CC by-SA license as any content contributed to the site. Also that whole thing probably should be asked separately without any GDRP... Maybe "To what degree flag messages are private and what are rules around publishing" Mar 8 at 17:39

2 Answers 2

18

There is information that moderators have to keep private by the terms of the moderator agreement.

This is explained in the privacy policy it's basically identity data - your email address, password, your IP addresses etc.

Moderators have a duty to keep that information private and if they access that data for another user then that access is logged and they may need to explain why they accessed that data.

Some of this is the kind of identity information that is covered by legislation such as GDPR i.e. information that may identify you such as your date of birth, your location etc.

Then there is information moderators choose to keep private because airing dirty linen in public generally doesn't get good results. That's generally flags, deleted comments etc. If someone wants to discuss what happened to their flags or why their comments were deleted etc and they create a Meta post then moderators can discuss that and why they reached the decision that they did given that the poster has indicated that they want to discuss that subject. Disgruntled posters often post half-truths and Moderators then tell us what really happened.

16

Does the text of the message the user submitted fall under GDPR protection?

No, the submitted text by itself, does not.

If the user were to put their own PII in that message, then that specific part of the text would need to be redacted if the message were to be made public, but other than that, no.

If a user brings up a flag they submitted in a public place, then they're giving implicit permission for the contents of that flag to be made public.

11
  • "No, the submitted text, by itself does not." Are you sure? I explained why the term PII isn't necessarily the right one for GDPR. The user didn't bring up the flag in a public place, they didn't mention the flag. They just broached the broad topic. Implicit permission is a tricky field. What qualifies you to make these statements with such certainty? It could be that you are an EU privacy lawyer but I don't know. Mar 8 at 10:06
  • 2
    What point is there to you asking questions on Meta if you're just going to dismiss and disagree with every explanation you're given? If I wasn't sure, I wouldn't have written this answer.
    – Cerbrus
    Mar 8 at 10:07
  • 1
    What makes you so sure? Even if I disagreed with every explanation this wouldn't be a problem if every explanation was wrong. But I haven't even disagreed with every explanation. What makes you sure that this doesn't fall under GDPR? Mar 8 at 10:12
  • Because flag contents, by themselves, isn't PII. It's not protected under the GDPR.
    – Cerbrus
    Mar 8 at 10:13
  • 6
    These flags being private is a design feature. It's not a legal requirement.
    – Cerbrus
    Mar 8 at 10:17
  • 1
    This is a good point! However, by implementing this feature, the user expectation is changed. Mar 8 at 10:23
  • 8
    And nothing about that has anything to do with the GDPR.
    – Cerbrus
    Mar 8 at 10:24
  • 4
    Yup, bad user expectations is a pertinent issue.
    – E_net4
    Mar 8 at 10:44
  • @Cerbrus So you are saying that Twitter admins should be able to post my DMs? Because DMs being private is a design feature not a legal requirement? Mar 8 at 11:45
  • 6
    @CorneliusRoemer: If you are concerned (and you have legal standing), you should sue in the appropriate EU court, since the courts are where legal questions are decided. It doesn't matter what our (or your) opinion is. Mar 8 at 11:57
  • 6
    @CorneliusRoemer don't strawman me. That's not what I was saying or implying. I already answered your question in the last paragraph of this answer.
    – Cerbrus
    Mar 8 at 12:00

Not the answer you're looking for? Browse other questions tagged .