I came across a Meta answer with comments that made me wonder whether there is a policy on what private information Moderators are allowed to reveal under what circumstances.
This policy should at the very least obey the laws of relevant countries, e.g., GDPR for people in the EU.
The revelation of private information makes me wonder whether this would be a violation of GDPR, if OP was in the EU at the time of posting.
The relevant exchange is:
OP: Thank you for the clear explanation. That is helpful and I appreciate it. Having said, I think it's wholly inappropriate for you to post the text of a "in need of moderator intervention" flag in a public forum. Perhaps I'm wrong, but I don't think this text is part of the public-facing data of this site and users do not expect to see their posts held up for public discussion by those with moderator privileges.
Moderator: @OP We keep flags strictly private, unless you bring up the issue in public, which you did by posting this question about the same issue which you previously flagged. It's possible I'm wrong about your question here releasing us from that privacy, but that's how I interpreted your question.
I don't think any EU lawyer would constitute posting a question as explicitly releasing the Stack Overflow moderator from that privacy.
It could be that in the US the concepts are different. But given that Stack Overflow also operates in the EU, it would be good if there was a clear guideline to make global moderators aware of what constitutes release and what not.
I'm not trying to make this about the individuals at all here. This is just the inspiration. To that end, I am not linking to the question even though it may reduce usefulness. The private part was later edited out by another moderator. But the comment still stands as is. So clarity on the general point would be helpful.
Update:
Response to highly upvoted comments that entirely miss the point that I'm not claiming with certainty that this particular case would violate GDPR (I'm not a lawyer). In fact the comment is a case in point for the creation of a policy as the policy would help clarify what is and isn't considered personal data.
Here's the comment:
What Private Information has been exposed here? PII has a specific definition, and none of what you quote is close to PII. TL;DR: Keeping something private does not mean that the information is private in data terms, or that it is Private Identifiable Information (PII) (which is presumably what you are referencing here).
I think confuses US/EU terminology here. GDPR doesn't only cover things that identify you, but any information that is related to an identifiable person. The information made public is clearly related to an identifiable person.:
The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates has four common variants based on personal or personally, and identifiable or identifying. Not all are equivalent, and for legal purposes the effective definitions vary depending on the jurisdiction and the purposes for which the term is being used. [a] Under European and other data protection regimes, which centre primarily on the General Data Protection Regulation (GDPR), the term "personal data" is significantly broader, and determines the scope of the regulatory regime. https://en.wikipedia.org/wiki/Personal_data
The valid question is: does the text of the message the user submitted fall under GDPR protection? I'm not a lawyer, but to me it's not obvious that it isn't. This post is about the question in general, whether there is a policy. Such a policy would help clarify what is or isn't covered. And avoid this discussion.
Update 2: People seem to misunderstand my point and think I'm asking a legal question. No, this is just one way to motivate why it's an interesting question to discuss. Core points to discuss:
- Is there a written policy?
- If not, should there be a written policy?
- Even if not, what is the unwritten policy?
- What should the policy be?