In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may make annotations on an account for the purposes of helping moderation, is the GDPR relevant to said annotations in any way? "Annotation" here simply means any arbitrary text message a moderator or employee may attach to an account for future reference, e.g. to keep track of continued bad behaviour.

Does the account holder have any rights to see said annotations or request their deletion or alteration? In practice that would be counter productive for the moderators as it would inhibit their ability to moderate the platform efficiently.

Would any other sort of metadata, like say, encryption keys generated for and attached to the account, be subject to the same kind of disclosure? If not, why would it be different?


4 Answers 4



(1) GDPR is certainly relevant.

(2) This is certainly "personal data" under the definition in GDPR article 4.

(3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held

(3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used.

(4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified).

(5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant.

This is exactly the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.

  • 3
    How about the conflict this creates with being able to maintain the service? If moderators annotate accounts with "probably sock puppet account of XYZ" and such, and the account holder can see this information and know to avoid using their sock puppet accounts as they've been "found out"… that makes this kind of moderation more or less impossible. That's just "tough luck"?
    – deceze
    Commented Jun 26, 2019 at 14:31
  • 3
    This analysis is not convincing.
    – SergeyA
    Commented Jun 26, 2019 at 15:52
  • 1
    @AndrewMorton Not if they start using other, as of yet undetected accounts.
    – deceze
    Commented Jun 26, 2019 at 19:04
  • 2
    When a patient requests his/her mental health records, the professional treating it can sanitize it. Both to protect the professional evaluation notes ("when I ask him about his school years he is vague, maybe he is lying about what he tells") and to protect other stakeholders privacy ("I have had an interview with the patient's mother and she says that he always has behaved strangely..."). IIRC there is clause explaining that GDPR rights cannot be used to violate the rights of other people.
    – SJuan76
    Commented Jun 26, 2019 at 19:20
  • 4
    Consent is extremely unlikely to be the basis for this kind of information, it's much more likely to be legitimate interests. Disclosure would likely to be refused on the lawful grounds that this would adversely affect the rights and freedoms of others.
    – deep64blue
    Commented Jun 26, 2019 at 19:28

Such account annotations are clearly personal data, and would have to be disclosed as part of a data subject access request.

Personal data is any information relating to an identified or identifiable data subject (cf GDPR Art 4(1)). This means personal data does not only cover PII such as names or contact info, but also any information linked with that information. Account annotations are clearly linked with that account and thus are part of the account holder's personal data.

The Art 15 right to access is not conditional. The data controller must provide all personal data, and has no basis to withhold any personal data. The GDPR overrides any confidentiality policies that the controller may otherwise use.

The GDPR knows the following limitations to the right of access:

  • Per Art 15(4), access to the personal data “shall not adversely affect the rights and freedoms of others.”
  • Per Art 12(5), a controller can refuse to act on “manifestly unfounded or excessive” requests.
  • The data subject's identity must be reasonably verified for a request. Where the identity cannot be verified, a request can be declined.

Verification that the person making the request is the data subject for that account won't be a problem. Arguing that such a request would be excessive is also highly dubious.

But the rights and freedoms of others do offer a possible argument. For example, this basis has been used in one case to deny access to CCTV recordings from a Metro system, on the basis that disclosing the location of cameras would threaten security and therefore the freedom of other Metro users. But this public security interest would need to be balanced against the data subject's interest to access, which would depend on the data subject's reason for requesting access. To which degree such arguments are acceptable depends primarily on the responsible supervisory authorities.

Here, it might be possible to exclude account notes where those notes involve other data subjects as well. But that would have to be decided on a case by case basis. Neither the complete inclusion nor the blanket exclusion of notes would seem legal. The decision would be down to the data controller's Data Protection Officer.

Similar arguments apply to erasure or rectification of the data, but those rights are more limited than the right to access. Whether a right to erasure exists depends also on the legal basis under which the personal data was collected. In case of legitimate interest, there might be an overriding legitimate interest to keep that data and deny the data subject's erasure request.


Obligatory Disclaimer: Not a lawyer, and not an expert in GDPR law and regulations.

I got curious about this and did some digging. There are certain exemptions to the right to access in specific member states. For the argument here I used the UK as the relevant member state because that's where SE's EU liaison is located.

The analysis here cited is from the Information Comissioner's Office.

No general exemption for trade secrets.

Generally, there are no exemptions for the GDPR Article 15 "Right to Access". That means, absent specific other exemptions in national law, every single bit of personal data (meaning: data related to the account) would have to be disclosed, even if the disclosure of such data would prejudice or reveal trade secrets of the data controller. The European Trade Secrets Directive (2016/943/EU) specifically does not make an allowance to use it to prejudice data access requests.

Annotations that contain PI of other users

On a case-by-case basis, the Data Protection Act of 2018 provides a specific exemption for personal data that contains personal data or the identities of other data subject.

In this case that would probably apply to annotations that reference another user, such as "Magisch has conspired with TotallyNotMagisch to promote the MagischWeb Service across their answers".

For such annotations, disclosure could probably be refused on a case-by-case basis based on the right to privacy of the other person.

Is it even PI?

This is an interesting one, because from a plain reading of the law, obviously annotations specifically about a user would amount to personal information about that user. However, a recent ECJ decision has made that distinction less clear cut. Recently, in YS, M, and S v Minister for Immigratie, Integratie en Asiel the court held that the results of an agent processing a person's data (a form with recommendations and legal analysis concerning someone's application for residency in the netherlands) was not strictly speaking personal data and did not have to be disclosed as part of a Right to Access Request.

I don't pretend to understand the full context and preliminary decision here, but it seems to me that the question of how much of the results of PI processing is itself PI is still not exhaustively decided in litigation and thus not set in stone. I wouldn't be surprised if further exemptions are carved from the definition for similar situations.

Broad Language and infringing on the rights of others

Article 15. 4) states:

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

I have no idea how that affects what I wrote above, and couldn't find any court decisions or challenges from that angle, but I would infer from this that in specific situations where a request is made in obviously bad faith with intent to damage or harass moderators making the annotation or moderators in general, this could be invoked to deny specific parts or whole annotations from disclosure on a case-by-case basis.

Further, it would probably be possible to argue that revealing specific annotations could negatively impact and damage the governance of stack exchange and the volunteer work of its moderators.

I'm not sure how far that goes and again haven't found any legal analysis pertaining to it but it seems like something to consider at the end.


Well... I will try to make mine a simple one, for in this specific case (IMHO) a long answer with detailed mention to GDPR articles will just confuse everyone.

Any type of Processing of Personal Data (Gathering; Storing; Access; Processing; Sharing) happens under a given "purpose" and "scope" that needs to observe by a documented applicable and arguable Lawful Base.

Therefore, if and where "annotations" (internal or external) contain Personal Data the Data Subject must be informed about that.

If those annotations are vital for the Service being rendered and the Data Subject may oppose to them (which then again it may not even be the case), then the DAta Subject must be informed that opting out/ opposing to the annotation will render the Service undeliverable.

In terms of a DSAR, it is not mandatory to inform the Data Subject about what the annotations read... just the type of Personal Data registered on those and that only if it is not registered somewhere else...

Yet I understand that annotations may contain new Personal Data that derives from processing (e.g. this guy does not like XXXXXX)... in that case you do not need to share what is written with the Data Subject, you may just inform that it is Data which characterizes preferences about topic XXXXX for it is relevant in order to focus information to be conveyed under the scope of the Services.

This is not a complicated topic...

Now the Lawful Base may likelly be Legitimate Interest yet it depends (as always from context, meaning "purpose" and "scope")

  • “In terms of a DSAR, it is not mandatory to inform the Data Subject about what the annotations read” – but if the annotations are personal data (otherwise you wouldn't have to inform the data subject about them) then wouldn't you also have to give the data subject a copy in response to their DSAR? As written, this answer seems to go against the GDPR's actual requirements.
    – amon
    Commented Jun 29, 2019 at 8:45
  • If the annotations do not contain Personal Data... read the entire text please.... Commented Jul 2, 2019 at 9:23
  • 1
    "if the annotations do not contain personal data" - They're annotations attached to a user's account. They are personal data.
    – Magisch
    Commented Jul 12, 2019 at 10:48
  • Magish again, if ther eis no Personal Data it means the anotation does not add to the profiling of the individual, hence it does not matter if they are related or not to the user account. Commented Jul 12, 2019 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .