Training modules/dashboard/slides/30106-exceptions-1


Under the access to nonpublic information policy, functionaries are permitted at their discretion, but not required, to disclose PI in certain defined circumstances. These exceptions are summarized below and in the next slide.

If you disclose nonpublic information under exceptions (ii), (iii), (iv), or (v), tell WMF at within 10 days. In addition, in the event of an emergency, such as a threat of violence, we strongly advise contacting and immediately.

(i) Between functionaries to fulfill functionary duties

Functionaries may disclose PI to other community members with the same access rights in order to fulfill duties outlined in an applicable policy.

You do not need to inform within 10 days if you disclose PI under this exception.


User:Rory, an oversighter on English Wikipedia, shares a small amount of PI on a private wiki that is restricted to oversighters, in order to get help with a request he received.

(ii) To service providers in order to enforce blocks

Functionaries may disclose PI to service providers, carriers, or other third parties to assist in either:

  1. the targeting of IP blocks; or
  2. the formulation of a complaint to relevant internet service providers.

You do need to inform within 10 days if you disclose PI under this exception.


User:Rory, a steward, confirms that a site-banned user is evading her block and continuing to violate community policies and the Wikimedia Terms of Use. Rory discloses the user’s IP address in a complaint to the relevant internet service provider and informs of the disclosure within 10 days.

(iii) To law enforcement, in cases where there is an immediate and credible threat to life or limb

WMF’s Support & Safety team recommends immediately forwarding serious threats to and Our trained Support & Safety team can then make its own evaluation and determine whether to disclose PI to law enforcement.

However, if you wish to disclose PI to law enforcement yourself, please note that there are three requirements in such cases. A threat must be:

  1. to life or limb;
  2. immediate; and
  3. credible.

You do need to inform within 10 days if you disclose PI under this exception, and we strongly suggest informing and immediately.

Example 1

User:Rory, a steward, discovers that a user made a bomb threat on a talk page. He immediately notifies and about the situation. WMF’s Support & Safety team takes things from there. Rory did not need to personally contact law enforcement or disclose PI.

Example 2

Rory discovers a user page on which the owner recently posted that they intend to commit suicide. Rory believes the threat is credible. He discloses the user’s IP address, email address, and real name (if available) to law enforcement. He also immediately notifies and about the situation and the action he has taken.

Example 3

Rory discovers that a user on a talk page has threatened to throw eggs at another user’s house. Rory does not disclose the user’s IP address, email, or real name to law enforcement because the user has not threatened anybody’s life or limb. Instead, Rory chooses to warn the user or block them for harassment. Depending on the circumstances, Rory may want to report the incident to local law enforcement without disclosing the threat-maker’s IP address, email address, name, or any other PI.