Policies/en/Access-to-Nonpublic-Personal-Data: Difference between revisions

(7 intermediate revisions by the same user not shown)

Line 1:

''Source: adapted from the Wikimedia Foundation Governance Wiki, https://foundation.wikimedia.org/wiki/Policy:Wikimedia_Foundation_Access_to_Nonpublic_Personal_Data_Policy (CC BY-SA). Status: proposal, to be adopted.''

{{KidsIntro|Sometimes we need to keep certain information private to keep everyone safe. This page shows our plan for who gets to see this hidden info and how we hope to make sure they are super trustworthy.}}

{{ExpertIntro|This document outlines our intended policy for managing access to nonpublic personal data. It establishes a proposed framework for granting access rights, emphasizing our intent to maintain strict confidentiality and the general direction of our data governance model.}}

''This is a draft version. Source: adapted notably from the Wikimedia Foundation Governance Wiki, https://foundation.wikimedia.org/wiki/Policy:Wikimedia_Foundation_Access_to_Nonpublic_Personal_Data_Policy (CC BY-SA 4.0), with changes. Status: proposal, to be adopted. See the [[Policies/en/Disclaimer|detailed disclaimer]].''

'''In simple words:''' a few trusted community members can see private information about other users, for example to fight fake accounts or protect the platform. This page proposes the conditions to obtain that access (minimum age, a valid email address, a signed confidentiality agreement) and the rare situations where this private information may be shared with someone else.

Line 47:

Line 49:

For illustrative purposes only, some examples of Designated Community Members include: email response team administrators, email response team members, and stewards. This Policy does not apply to users whose rights only include the ability to view standard deleted revisions. This Policy also does not apply to Ynternet.org Foundation employees or contractors who act in their professional capacity because they are already subject to other confidentiality agreements that are as or more protective than this Policy.

'''Exceptions.''' The Ynternet.org Foundation may, at its sole discretion, provide Nonpublic Personal Data to groups of community members who are not covered by this Policy and to groups of Designated Community Members under terms outside of this Policy ("exceptions"). Such exceptions must be reviewed by the Ynternet.org Foundation's Legal department; approved exceptions are listed publicly. In individual cases, "exemptions" may be granted to users who would otherwise be unable to be granted NDA status due to user age or known domicile in a jurisdiction that blocks access to the ~~WikiDeal platform~~. Such individual exemptions must also be reviewed by the Legal department, but approved exemptions are not listed publicly in consideration of community member privacy.

'''Exceptions.''' The Ynternet.org Foundation may, at its sole discretion, provide Nonpublic Personal Data to groups of community members who are not covered by this Policy and to groups of Designated Community Members under terms outside of this Policy ("exceptions"). Such exceptions must be reviewed by the Ynternet.org Foundation's Legal department; approved exceptions are listed publicly. In individual cases, "exemptions" may be granted to users who would otherwise be unable to be granted NDA status due to user age or known domicile in a jurisdiction that blocks access to the Marketplaces. Such individual exemptions must also be reviewed by the Legal department, but approved exemptions are not listed publicly in consideration of community member privacy.

Line 87:

Line 89:

'''(e) Submission timeline.'''

Any community member who has been granted access rights at the time this Policy becomes effective must meet the requirements of Sections (a) – (c) of this Policy within ninety (90) calendar days of the date this Policy becomes effective. The Ynternet.org Foundation may, at its sole discretion, extend the compliance period for individual community members as needed.

Any community member who has been granted access rights at the time this Policy becomes effective must meet the requirements of Sections (a) to (c) of this Policy within ninety (90) calendar days of the date this Policy becomes effective. The Ynternet.org Foundation may, at its sole discretion, extend the compliance period for individual community members as needed.

Any community member who has not met the requirements of ~~Section~~ (a) – (c) of this Policy by the deadline above should anticipate having their access rights revoked until they have submitted the required information.

Any community member who has not met the requirements of Sections (a) to (c) of this Policy by the deadline above should anticipate having their access rights revoked until they have submitted the required information.

== Use and disclosure of nonpublic information ==

Designated Community Members provide valuable services to the Platform and its users – they fight vandalism, respond to helpdesk emails, ensure that improperly disclosed private data is removed from public view, confirm license permissions, investigate sockpuppets, improve and debug software, and much more. But Designated Community Members' use of access rights is limited to certain circumstances and contexts. This section elucidates the situations in which access rights may be used and Nonpublic Personal Data may be disclosed to third parties.

Designated Community Members provide valuable services to the Platform and its users: they fight vandalism, respond to helpdesk emails, ensure that improperly disclosed private data is removed from public view, confirm license permissions, investigate sockpuppets, improve and debug software, and much more. But Designated Community Members' use of access rights is limited to certain circumstances and contexts. This section elucidates the situations in which access rights may be used and Nonpublic Personal Data may be disclosed to third parties.

Line 122:

Line 124:

In the event that a Designated Community Member receives a request for Personal Data from law enforcement regarding an immediate and credible threat of bodily harm, as described above in (iii), and the Designated Community Member chooses to disclose Personal Data, they are permitted to do so without pre-authorization, however that Designated Community Member should immediately contact the Foundation's designated disclosure contact (info@wikideal.net) with an explanation of the disclosure. If the Designated Community Member chooses not to disclose Personal Data in response to an emergency request from law enforcement, that Designated Community Member should immediately contact the Foundation's designated emergency contact (info@wikideal.net) with details of the request so that it can be evaluated for possible Foundation disclosure.

All other formal and informal requests for user Nonpublic Personal Data (i.e. those not covered by one of the situations described above or those not acted upon by a community member with access rights), including ~~subpoenas~~, from law enforcement, government agencies, attorneys, or other third parties should be directed to the Ynternet.org Foundation's Legal department (info@wikideal.net).

All other formal and informal requests for user Nonpublic Personal Data (i.e. those not covered by one of the situations described above or those not acted upon by a community member with access rights), including court orders and similar legal process, from law enforcement, government agencies, attorneys, or other third parties should be directed to the Ynternet.org Foundation's Legal department (info@wikideal.net).

== Violations ==

Complaints about infringements of this Policy may be submitted to the Ombuds Commission (an oversight body to be defined for WikiDeal). Breaches may result in conduct warnings or removal of advanced rights. Consistent with the Office Actions Policy, the Foundation may take such actions with or without recommendation from the Ombuds Commission, but barring extraordinary circumstances the Foundation will generally defer to appropriate community governance mechanisms for enforcement rather than take direct action.

Complaints about infringements of this Policy may be submitted to the Ombuds Commission (an oversight body to be defined for WikiDeal). Breaches may result in conduct warnings or removal of advanced rights. Consistent with the [[Policies/en/Office-Actions-Policy|Office Actions Policy]], the Foundation may take such actions with or without recommendation from the Ombuds Commission, but barring extraordinary circumstances the Foundation will generally defer to appropriate community governance mechanisms for enforcement rather than take direct action.

Complaints about inappropriate actions taken under an exception to this Policy should be evaluated by the appropriate community governance mechanisms. Complaints may also be referred to the Foundation for review under the Office Actions Policy. If a complaint concerns the Privacy Policy's relevant section, then the Ombuds Commission may also review.

Line 133:

Line 135:

Complaints about Designated Community Members infringing confidentiality obligations or expectations that exist outside of this Policy and its exceptions should be evaluated by the appropriate community governance mechanisms. While the Foundation may not be a party to those confidentiality agreements or expectations, major breaches of community trust may result in loss of the Foundation's trust through application of the Office Actions Policy.

== Related documents and subpages ~~(to be migrated)~~ ==

== Related documents and subpages ==

The following documents are referenced by this Policy ~~and are to be migrated in a later block~~:

The following documents are referenced by this Policy:

* Underage exemptions (subpage of this Policy)

* [[Policies/en/Access-to-Nonpublic-Personal-Data/Underage-Exemptions|Underage exemptions]] (subpage of this Policy)

* Exceptions to this Policy (subpage of this Policy)

* [[Policies/en/Access-to-Nonpublic-Personal-Data/Exceptions|Exceptions to this Policy]] (subpage of this Policy)

* Privacy Policy

* [[Policies/en/Privacy-Policy|Privacy Policy]]

* Data Retention Guidelines

* [[Policies/en/Data-Retention-Guidelines|Data Retention Guidelines]]

* Confidentiality agreement for nonpublic information

* [[Policies/en/Confidentiality-Agreement-for-Nonpublic-Information|Confidentiality agreement for nonpublic information]]

* CheckUser Policy and local CheckUser policies

* CheckUser Policy and local CheckUser policies (to be migrated)

* Suppression Policy

* Suppression Policy (to be migrated)

* Office Actions Policy

* [[Policies/en/Office-Actions-Policy|Office Actions Policy]]

[[Category:Migration June 2026]]