Do internal annotations on user accounts fall under the GDPR?
<p>In a platform such as Stack Exchange or any other <em>moderated</em> forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may make <em>annotations</em> on an account for the purposes of helping moderation, is the GDPR relevant to said annotations in any way? "Annotation" here simply means any arbitrary text message a moderator or employee may attach to an account for future reference, e.g. to keep track of continued bad behaviour.</p>

<p>Does the account holder have any rights to see said annotations or request their deletion or alteration? In practice that would be counter productive for the moderators as it would inhibit their ability to moderate the platform efficiently.</p>

<p>Would any other sort of metadata, like say, encryption keys generated for and attached to the account, be subject to the same kind of disclosure? If not, why would it be different?</p>

<p>IANAL.</p>

<p>(1) GDPR is certainly relevant.</p>

<p>(2) This is certainly "personal data" under the definition in GDPR article 4.</p>

<p>(3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held</p>

<p>(3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used.</p>

<p>(4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified).</p>

<p>(5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant.</p>

<p>This is <em>exactly</em> the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.</p>

<p>Such account annotations are clearly personal data, and would have to be disclosed as part of a data subject access request.</p>

<p>Personal data is any information relating to an identified or identifiable data subject (cf GDPR Art 4(1)). This means personal data does not only cover PII such as names or contact info, but also any information linked with that information. Account annotations are clearly linked with that account and thus are part of the account holder's personal data.</p>

<p>The Art 15 right to access is <em>not conditional</em>. The data controller must provide all personal data, and has no basis to withhold any personal data. The GDPR overrides any confidentiality policies that the controller may otherwise use.</p>

<p>The GDPR knows the following limitations to the right of access:</p>

<ul>
<li>Per Art 15(4), access to the personal data “shall not adversely affect the rights and freedoms of others.”</li>
<li>Per Art 12(5), a controller can refuse to act on “manifestly unfounded or excessive” requests.</li>
<li>The data subject's identity must be reasonably verified for a request. Where the identity cannot be verified, a request can be declined.</li>
</ul>

<p>Verification that the person making the request is the data subject for that account won't be a problem. Arguing that such a request would be excessive is also highly dubious.</p>

<p>But the rights and freedoms of others do offer a possible argument. For example, this basis has been used in one case to deny access to CCTV recordings from a Metro system, on the basis that disclosing the location of cameras would threaten security and therefore the freedom of other Metro users. But this public security interest would need to be balanced against the data subject's interest to access, which would depend on the data subject's reason for requesting access. To which degree such arguments are acceptable depends primarily on the responsible supervisory authorities.</p>

<p>Here, it might be possible to exclude account notes where those notes involve other data subjects as well. But that would have to be decided on a case by case basis. Neither the complete inclusion nor the blanket exclusion of notes would seem legal. The decision would be down to the data controller's Data Protection Officer.</p>

<p>Similar arguments apply to erasure or rectification of the data, but those rights are more limited than the right to access. Whether a right to erasure exists depends also on the legal basis under which the personal data was collected. In case of legitimate interest, there might be an overriding legitimate interest to keep that data and deny the data subject's erasure request.</p>

<p>Obligatory Disclaimer: Not a lawyer, and not an expert in GDPR law and regulations.</p>

<p>I got curious about this and did some digging. There are certain exemptions to the right to access in specific member states. For the argument here I used the UK as the relevant member state because that's where SE's EU liaison is located.</p>

<p>The analysis here cited is from the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/" rel="nofollow noreferrer">Information Comissioner's Office</a>.</p>

<h2>No general exemption for trade secrets.</h2>

<p>Generally, there are no exemptions for the GDPR Article 15 "Right to Access". That means, absent specific other exemptions in national law, every single bit of personal data (meaning: data related to the account) would have to be disclosed, even if the disclosure of such data would prejudice or reveal trade secrets of the data controller. <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016L0943" rel="nofollow noreferrer">The European Trade Secrets Directive (2016/943/EU)</a> specifically does not make an allowance to use it to prejudice data access requests.</p>

<h2>Annotations that contain PI of other users</h2>

<p>On a case-by-case basis, the Data Protection Act of 2018 provides a <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/" rel="nofollow noreferrer">specific exemption</a> for personal data that contains personal data or the identities of other data subject. </p>

<p>In this case that would probably apply to annotations that reference another user, such as "Magisch has conspired with TotallyNotMagisch to promote the MagischWeb Service across their answers". </p>

<p>For such annotations, disclosure could probably be refused on a case-by-case basis based on the right to privacy of the other person.</p>

<h2>Is it even PI?</h2>

<p>This is an interesting one, because from a plain reading of the law, obviously annotations specifically about a user would amount to personal information about that user. However, a recent ECJ decision has made that distinction less clear cut. Recently, in <em>YS, M, and S v Minister for Immigratie, Integratie en Asiel</em> the court held that the results of an agent processing a person's data (a form with recommendations and legal analysis concerning someone's application for residency in the netherlands) was not strictly speaking personal data and did not have to be disclosed as part of a Right to Access Request. </p>

<p>I don't pretend to understand the full context and preliminary decision here, but it seems to me that the question of how much of the results of PI processing is itself PI is still not exhaustively decided in litigation and thus not set in stone. I wouldn't be surprised if further exemptions are carved from the definition for similar situations.</p>

<h2>Broad Language and infringing on the rights of others</h2>

<p>Article 15. 4) states:</p>

<blockquote>
  <p>The right to obtain a copy referred to in paragraph 3 shall not
  adversely affect the rights and freedoms of others.</p>
</blockquote>

<p>I have no idea how that affects what I wrote above, and couldn't find any court decisions or challenges from that angle, but I would infer from this that in specific situations where a request is made in obviously bad faith with intent to damage or harass moderators making the annotation or moderators in general, this could be invoked to deny specific parts or whole annotations from disclosure on a case-by-case basis. </p>

<p>Further, it would probably be possible to argue that revealing specific annotations could negatively impact and damage the governance of stack exchange and the volunteer work of its moderators.</p>

<p>I'm not sure how far that goes and again haven't found any legal analysis pertaining to it but it seems like something to consider at the end.</p>

gdpr