With the impending deadline for GDPR implementation, questions have been popping up on Stack Overflow about compliance. These are generally closed as not strictly about programming with the recommendation that the OP ask legal questions on Law.SE; however, several OPs have objected that at least some of these questions are basically "system-level" questions. That being said, do people here agree with that? If there are some otherwise-acceptable questions on this (or similar) topics, would it be appropriate to have them migrated here? If so, when would they be considered acceptable questions here?
asked Apr 13, 2018 at 13:25
-
related discussion at MSO: Where to process GDPR questions– gnatApr 13, 2018 at 14:23
Add a comment
|
3 Answers
The issue with lots of these questions is, they often need interdisciplinary knowledge, some from law and some from software engineering. Our community here does not have a clear consensus where to draw the line, when a question is still on-topic and when not. Some guys here will vote to close whenever a question has a slight smell of "law" in it, others will be happy to answer you as long as there is "enough software engineering" in it.
So when you think your question falls into that category and the expertise of a software engineer is needed to answer it, then the only reliable way to find out is to ask it here and see how well it is received. The worst thing which could happen is you get some downvotes and the question gets closed, but with one or two upvotes these downvotes will be more than balanced, and hey, these are virtual points on some internet site, not your bank account.
If you need the expertise of a lawyer, the correct place to go is Law Stack Exchange, after consulting their Help Center to ensure the question is well written and meets their guidelines.
If the question is about requirements engineering, software system architecture, or software system design, it's likely to be on-topic here. Consult our Help Center to see what types of questions are permitted.
If you aren't sure, you should be specific about what question you want to ask and bring it up on Meta.
answered Apr 13, 2018 at 16:39
Having a high level understanding of applicable legal requirements is necessary for software engineering. Therefore, I would consider questions about high-level GDPR concepts to be on topic. A lot of that regulation is common sense, and can be confidently answered by a software engineer.
However, there are also a lot of details in what specific phrases mean, how different requirements mesh with each other, and how this relates to other laws. A software engineer cannot generally answer that, and you will have to involve qualified legal counsel at some point.
For example, I answered a recent GDPR question “do I need to offer an opt-out from analytics to users of my app?” Anyone with a basic understanding of the GDPR should be able to answer that (yes, users must be able to opt out from data processing. Actually, you might have to ask for consent first (opt-in), which must be easy to revoke). The comments then gave rise to a specific sub-question (is “then don't use the app” sufficient opt-out when relying on article 6(1)(f)?). The exact interpretation of the GDPR is clearly off topic here, and all a software engineer can do at that point is point at a lawyer.
In practice, I think there are few GDPR questions that will be on topic. So it wouldn't be helpful to advertise Software Engineering as a place for GDPR questions. This is remarkably like our policy on open-source licensing questions. High-level concepts are technically on topic, but most questions get closed because the details of various licenses are out of scope.
