Update

[charmian]

Regarding this comment which I linked in an earlier post.

The person who made the comment has responded, explaining their remarks, in a comment to that post.

To summarize it, the person says that they heard from a volunteer that the volunteer looked up someone's history of support requests in the course of investigating a support request that the user did not feel was adequately dealt with. However, this does not seem to me to necessarily indicate any kind of abuse of power.

Also, to reiterate something: all public posts (unless I make it technically impossible to do so, like turning off comments) are open to comments from anyone (that is, unless you're a spammer/leaving OT/inappropriate comments).

Comments

[azurelunatic]

The ability to easily find the records of a person's interactions with Support is only granted to senior volunteers and above, and it's separate from the ability to view requests in private categories.

I'm not sure, off the top of my head, exactly what level gets the ability to view support history, but it's not just any random who wanders in and starts answering requests.

As a part of normal operations, people who are answering requests may toss a link up and say "Can you check to see if they have any other requests about this same issue open?" or something of the like, and someone with the ability to find them will gladly look through, and provide the links to other related requests, or other simultaneous requests, with other relevant information, to anyone who's helping. So while the ability to search is restricted, the public results of the search are shared with people helping out in the course of their work.

Some jargon that may not be transparent to a non-Support person:

A "closed" support request is one where someone, either the user or an administrator, has come and marked the request as resolved. This is done by the user when it's resolved, by an administrator when it looks resolved but the user hasn't returned to declare it resolved after a reasonable amount of time. This does not affect the privacy of the request.

A "locked" support request is a slightly different beast. There are certain support requests where the user and the people answering the request get into a back-and-forth that does not resolve easily; if someone gets too argumentative, there is the capability for an administrator to close the request such that it cannot be re-opened by the user. This is potentially still public, depending on whether this support request is in a public category or a private category; in the context of support requests, "locked" has absolutely nothing to do with privacy, but I see how someone could get confused.

"Private categories" are basically areas of the support board that are not public; as JD said, you can tell a request is in this when there is the yellow information bar at the top that says this is not publicly visible. You can see these if:
a) you are the person who opened it, logged in
b) you are logged out, and you have the security code that is only sent to the person whose request this is (private category requests where it's known that someone's been sharing that link get closed with no further information shared in that request, for privacy reasons)
c) you have actually been granted the priv to view that particular private board, in which case you have a signed NDA on file, and you do not discuss those requests with someone who doesn't have same, like JD said.

I do not have the privs to view any private boards.

[pne]

a) you are the person who opened it, logged in

For requests submitted via the web page, this is easy to determine. For requests submitted via email, as far as I know you are allowed to see it if the email address the request came from is the same as the currently validated address of the account that's trying to view the request.

(I ran into this when I couldn't see requests I had sent to support@ [especially support review requests] because I was sending them from pne@lj; once someone told me - or I found out somehow - about the email matching, I submitted them from my validated email address instead, and then I could see them while logged in as pne even without the security code. I presume I would have been able to see them while logged in as another account of mine, too, if that account also had the same, validated, email address.)