-2

Meet Bob; Bob left some comments on a post on stack exchange and some over zealous moderators decided that they were not needed and so to delete them. Bob wishes to access these comments for the purposes of his own reference. Are these comments a) remaining on SE’s servers, and b) available to Bob under his GDPR right of access?

Improve this question
0

1 Answer 1

Reset to default
6

The answers are "yes" and "yes".

The first "yes" being based on my experience as a moderator: if I can still see the "deleted" comments, then obviously they still exist in SE's data storage.

The second "yes" is based on "Art. 15 GDPR - Right of access by the data subject".

While I have no background on SE's company structure and where each part is located and which juristiction applies, as far as I know SE complies with the GDPR, either because they have to, or because it's easier to, or because it is the right thing to do.

Please note that you have no right to selective access. Companies are well within their right to make the economic decision to automate this and give you a data dump of everything they have on you. It would be up to you to find this specific comment in the data dump of "everything".

They are also not required to do this free of charge, if you ask for this repeatedly.

Improve this answer
7
  • I had always thought that they do generally have to do it for free.
    – Seeking answers
    Oct 27 at 8:51
  • 1
    "The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs."
    – nvoigt
    Oct 27 at 9:16
  • I see. But presumably that doesn’t apply if there has been a change in the data that is held, for example by the addition of new comments since the last request, or even perhaps simply further visits to the site page views.
    – Seeking answers
    Oct 27 at 9:54
  • 4
    Well, the organization has 30 days to repond to your request, so I would personally say getting one every 30 days for free is reasonable for semi-automated processes. However, be prepared that organizations who have not automated this, or whose data retrieval is more complex, or who need to manually check all data they send you as to not infringe other people's rights, will charge you if they deem it "too often". A GDPR request is a right, not a tool to harass someone or cause unnecessary costs.
    – nvoigt
    Oct 27 at 13:29
  • 4
    Because you "presumed" that it was okay to do that. It is not.
    – nvoigt
    Oct 27 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .