Talk:Access to nonpublic personal data policy/Archives/2021

Identification

The big blue box at the start of the page says "Provide contact and identification information", and links to a section titled "Identification", but that section does not exist. Does an identification requirement currently exist for holding advanced permissions? If so, it isn't enforced. Can this wording be changed or removed? – Ajraddatz (talk) 08:34, 12 November 2017 (UTC)

See Talk:Access to nonpublic information policy/Noticeboard#Identification. From what I understand, you sign your name and then are added to the noticeboard. No additional identification is required. Would be great to hear confirmation. --Eurodyne (talk) 08:53, 12 November 2017 (UTC)

Ah yes. Incidentally enough, I came here after noticing out of date text on enwiki regarding identification. But when I go here, I found that the outdated text remains here as well. Hopefully the WMF can clarify a bit! – Ajraddatz (talk) 09:24, 12 November 2017 (UTC)

The requirement of identification was removed from this policy in April 2014. What is left is that users need to give their email address (can be under a pseudonym), "certify" that they're of age (accepted as AGF) and provide a signature that can be also made with a pseudonym. The blue box has not been updated regarding the "identifcation information" and twice refers to it, which is very misleading in my opinion. Could it please be updated to better represent the actual policy? -kyykaarme (talk) 10:32, 9 December 2018 (UTC)

I updated it myself three months ago. kyykaarme (talk) 21:34, 23 June 2021 (UTC)

Clarification of the ANPDP

Hi all, posting this on behalf of the Legal team here at the Foundation:

In June 2021, the Legal team encountered an ambiguity with the application of this Access to Non-public Data Policy (ANPDP) for information about which checkusers have run certain checks. We want to clarify that this information typically is confidential under the ANPDP unless local project policy requires checkusers to make it public. ANPDP applies to information that requires a special tool such as checkuser to access. This means that if a person must sign this policy and be given a special role to see personal information such as who ran which checks on an account, that information should remain confidential.

However, local project policy is allowed to require people to disclose data about themselves publicly as part of holding special roles, which could make this information public. For example, a local language policy that requires checkusers to post what checks they run publicly would be permitted and would make that data public and no longer covered by ANPDP. Local policy may NOT require disclosure of another's personal information. For example, a local policy could not obligate checkusers to reveal the result of a check or to post checks run by other users. Kbrown (WMF) (talk) 15:24, 21 June 2021 (UTC)

Policy adjustment on behalf of Legal

Introduction

Due to a need to better protect our community, the Foundation is initiating a policy adjustment that suspends Foundation volunteer NDA recognition to applicants who live in jurisdictions that have blocked access to Wikimedia projects and where there is reason to believe that their domicile associated with their user account is known to others than the individual applicant(s) and the Foundation. This means that all NDA-based access granted to users fulfilling both criteria in the change shall be revoked immediately. Nothing changes for users not fulfilling both criteria.

Can exceptions be granted?

There are some exceptions that may be granted on an individual basis and following a request for review submitted to the Legal department. However, the Foundation recognizes that granting such NDA-based access will put applicants as well as other volunteers relying on the Foundation’s platform at undue risk and will only grant exceptions due to extraordinary need if safety of volunteers is reasonably certain.

When is the policy adjustment effective?

All NDA-based access granted to users who do not meet the new criteria of the adjusted policy is revoked immediately. While we wish we could have pre-announced this change, unfortunately doing so could itself lead to the exploitation of the security gap we are attempting to address to preserve user safety.

Will the policy adjustment be reviewed?

This policy adjustment may be reviewed in future depending on the safety of the community at large.--WMFOffice (talk) 18:02, 23 August 2021 (UTC)

@WMFOffice: Please announce the list of those jurisdictions, so that users based in those jurisdictions can decide not to apply for becoming VRT agents in the first place. 4nn1l2 (talk) 12:38, 24 August 2021 (UTC)

@WMFOffice: Since this is a change to the existing agreement, I would suggest mass-messaging everyone on the current signatory list. GeneralNotability (talk) 19:03, 24 August 2021 (UTC)

Hi everyone. We would like to provide some follow up from the Foundation Legal team regarding the updated policy.

NDA Policy Change

We are extremely grateful for the comments, encouragement and questions that we have received with regards to the NDA policy change. Indeed, keeping the community safe and vibrant is our collective responsibility. We want to acknowledge and appreciate your support and understanding in these unprecedented times.

Background on the NDA Policy Change

As a measure taken to protect the community, the Foundation suspended volunteer NDA access to applicants who live in jurisdictions that have blocked access to Wikimedia projects (currently or recently) and where there was reason to believe that the identity of the individuals using the accounts is known (or easily discoverable by) actors in those regions..

This was necessitated by recent world events, triggered by credible information about a more focused security threat to the Wikimedia community that placed multiple users at risk. The users who were at risk then, and who are still at risk now, are physically located in the jurisdictions we earlier identified.

Before initiating this policy change, the Foundation evaluated several options and strategies to keep these users and the community safe. To help us identify the credibility of the threat and in order to come up with the best course of action to take, the Foundation contracted a security consultant firm that evaluated the threat, authenticated its credibility, and advised immediate action to be taken to keep multiple users safe and reduce the exposure to harm.

While we wish we could have pre-announced this change, doing so could have led to the exploitation of the security threat that the Foundation was attempting to address in order to ensure user safety.

Progress on the NDA Policy Change

At the moment, all NDA-based access granted to users who do not meet the new criteria of the adjusted policy has been suspended. The Foundation may be granting some exceptions on an individual basis after an application for review is submitted to the Legal department.

However, exceptions will be extremely unusual at this time, as granting such NDA-based access may put not only applicants but also other volunteers relying on the Foundation’s platform at undue risk. Therefore, the Foundation is only granting exceptions that have an extraordinary need and if the safety of the volunteers (both the applicant and other users) seems highly secure. Before you apply for the exemption, the Foundation encourages you to bear in mind not only your security, but also that of the community at large. Keeping people safe is key.

Currently, the policy change covers all Wikimedia projects. It is our hope that we will be able to safely review this in future - always mindful of the security of the individuals and the community at large.

During the month of September, the Foundation will work within community processes to remove permissions under the adjusted NDA policy from accounts that can no longer hold those permissions and whose owners have not stepped down voluntarily. Again, we reiterate that this is for the safety of the entire community. -Jrogers (WMF) (talk) 15:39, 31 August 2021 (UTC)

@Jrogers (WMF), NahidSultan (WMF), JSutherland (WMF), and WMFOffice: For clarfication:

1. What does "live in" mean? Does this mean a steward must be temporary deflagged if they visit Mainland China? What about those who stayed in Mainland China for some time, such as one week or one month?
2. Does it affect users from Hong Kong? Wikipedia is currently not blocked there, but one may argue they will be affected by the national security law.
3. Does it affect users from Turkey or Venezuela? What about Iran?
4. What about mainland Chinese citizens living abroad?

--GZWDer (talk) 17:38, 31 August 2021 (UTC)

For the third question, it seems that Mardetanha is from Iran, so I think the policy applies to more than just mainland China. —— Eric Liu_（Talk） 12:37, 1 September 2021 (UTC)

@Jrogers (WMF):So now will these account be global lock in order to that them "voluntarily" resigned? Jonathan5566 (talk) 11:57, 1 September 2021 (UTC)

Yes, we are all locked until "voluntarily" resign to get back our account back Mard (talk) 12:06, 1 September 2021 (UTC)

Can the phrases "NDA recognition" and "NDA access" and "NDA Policy" and "NDA-based access" be de-jargonified? Or at least linked? They are not explained in the glossary. --The Cunctator (talk) 13:37, 14 September 2021 (UTC)

My guess is that NDA = Non-Disclosure-Agreement = Confidentiality agreement for nonpublic information; only people who have signed an NDA get access to non-public personal data (NPPD?); signing an NDA is a necessary but not sufficient conditions for getting NDA access. These are all just common sense guesses. Better that someone finds a meta wiki document to clarify that. Or at least a WMF person could clarify the jargon. Boud (talk) 13:56, 16 September 2021 (UTC) @WMFOffice: - putting an answer in the FAQ below would put the info in an obvious place where people may look. Boud (talk) 14:01, 16 September 2021 (UTC) @Jrogers (WMF): ping. Boud (talk) 15:25, 16 September 2021 (UTC)

/* Semi-protected edit request on 2 October 2021 */ new section

The first bullet currently reads "When the community members needs to stop damage ...", this should read "community members need to stop damage ...". - Adolphus79 (talk) 00:55, 2 October 2021 (UTC)

Done. --WhitePhosphorus (talk) 07:07, 2 October 2021 (UTC)