Policies/en/Access-to-Nonpublic-Personal-Data: Difference between revisions

''Source: adapted from the Wikimedia Foundation Governance Wiki, https://foundation.wikimedia.org/wiki/Policy:Wikimedia_Foundation_Access_to_Nonpublic_Personal_Data_Policy (CC BY-SA). Status: proposal, to be adopted.''

* When the community members need to stop damage to the WikiDeal Sites (such as [[#serviceproviders|assisting in the targeting of IP blocks]]);

'''Because we value the community members who take on this critical role in the safeguarding of the WikiDeal Sites and its users and want to protect their privacy, we promise to:'''

WikiDeal Sites (the "Sites") are the product of a global community of volunteer contributors and editors. This dedicated group of individuals not only writes and curates content on the Sites, they also help ensure the safety of the Sites and its users as well as compliance with applicable policies. To manage this immense task effectively, certain community members are entrusted with access to limited amounts of nonpublic personal information regarding other users ("Nonpublic Personal Data"). For example, a community member who has "checkuser" rights could use those rights to investigate whether a single user is using multiple accounts in a manner inconsistent with WikiDeal policies. The purpose of this "Access to Nonpublic Personal Data Information" policy (the "Policy") is to:

'''Exceptions.''' The Ynternet.org Foundation may, at its sole discretion, provide Nonpublic Personal Data to groups of community members who are not covered by this Policy and to groups of Designated Community Members under terms outside of this Policy ("exceptions"). Such exceptions must be reviewed by the Ynternet.org Foundation's Legal department; approved exceptions are listed publicly. In individual cases, "exemptions" may be granted to users who would otherwise be unable to be granted NDA status due to user age or known domicile in a jurisdiction that blocks access to the WikiDeal platform. Such individual exemptions must also be reviewed by the Legal department, but approved exemptions are not listed publicly in consideration of community member privacy.

Any community member who has been granted access rights at the time this Policy becomes effective must meet the requirements of Sections (a) – (c) of this Policy within ninety (90) calendar days of the date this Policy becomes effective. The Ynternet.org Foundation may, at its sole discretion, extend the compliance period for individual community members as needed.

Any community member who has not met the requirements of Section (a) – (c) of this Policy by the deadline above should anticipate having their access rights revoked until they have submitted the required information.

Designated Community Members provide valuable services to the Sites and its users – they fight vandalism, respond to helpdesk emails, ensure that improperly disclosed private data is removed from public view, confirm license permissions, investigate sockpuppets, improve and debug software, and much more. But Designated Community Members' use of access rights is limited to certain circumstances and contexts. This section elucidates the situations in which access rights may be used and Nonpublic Personal Data may be disclosed to third parties.

All Designated Community Members may only use their access rights and the subsequent information they access in accordance with the policies that govern the tools they use to gain such access. For example, community members with access to the CheckUser tool must comply with the global CheckUser Policy, and, unless they are performing a cross-wiki check, they must also comply with the more restrictive local policies applicable to the relevant Site. Similarly, community members with access to the Suppression tool may only use the tool in accordance with the Suppression Policy. When a Designated Community Member's access to a certain tool is revoked, for any reason, that member must destroy all Nonpublic Personal Data that they have as a result of that tool.

In the course of keeping the Sites and its users safe, Designated Community Members must sometimes disclose Nonpublic Personal Data to third parties. Disclosures of Nonpublic Personal Data are limited to:

While Designated Community Members may disclose Nonpublic Personal Data to third parties under the circumstances described above, they are under no obligation by the Foundation to do so. Please note, however, if a Designated Community Member chooses to disclose in a situation covered by (ii), or (iv), or if they are required by law to disclose to law enforcement, administrative bodies, or other governmental agencies, they must secure written approval from the Ynternet.org Foundation by sending the Foundation's designated disclosure contact (address to be defined) an explanation of the proposed disclosure at least ten (10) business days prior to such anticipated disclosure.

In the event that a Designated Community Member receives a request for Personal Data from law enforcement regarding an immediate and credible threat of bodily harm, as described above in (iii), and the Designated Community Member chooses to disclose Personal Data, they are permitted to do so without pre-authorization, however that Designated Community Member should immediately contact the Foundation's designated disclosure contact (address to be defined) with an explanation of the disclosure. If the Designated Community Member chooses not to disclose Personal Data in response to an emergency request from law enforcement, that Designated Community Member should immediately contact the Foundation's designated emergency contact (address to be defined) with details of the request so that it can be evaluated for possible Foundation disclosure.

All other formal and informal requests for user Nonpublic Personal Data (i.e. those not covered by one of the situations described above or those not acted upon by a community member with access rights), including subpoenas, from law enforcement, government agencies, attorneys, or other third parties should be directed to the Ynternet.org Foundation's Legal department (contact address to be defined).

Complaints about infringements of this Policy may be submitted to the Ombuds Commission (an oversight body to be defined for WikiDeal). Breaches may result in conduct warnings or removal of advanced rights. Consistent with the Office Actions Policy, the Foundation may take such actions with or without recommendation from the Ombuds Commission, but barring extraordinary circumstances the Foundation will generally defer to appropriate community governance mechanisms for enforcement rather than take direct action.

== Related documents and subpages (to be migrated) ==

The following documents are referenced by this Policy and are to be migrated in a later block:

* Underage exemptions (subpage of this Policy)

* Exceptions to this Policy (subpage of this Policy)

* Privacy Policy

* Data Retention Guidelines

* Confidentiality agreement for nonpublic information

* CheckUser Policy and local CheckUser policies

* Suppression Policy

* Office Actions Policy