Local enforcement of the Universal Code of Conduct - Wikimedia-l

24 Apr 2023

Dear Wikimedia Foundation Trustees and all,

The Universal Code of Conduct (UCoC) has been in force for some time. The
Enforcement Guidelines have now been endorsed by the community. But as with
any new document, shared understandings and clarifications must develop
over time. Until then, practical enforcement is anything but routine. Here
is an example.

Section 3.1 of the UCoC states that the following is harassment:

*Disclosure of personal data (Doxing): sharing other contributors' private
information, such as name, place of employment, physical or email address
without their explicit consent either on the Wikimedia projects or
elsewhere, or sharing information concerning their Wikimedia activity
outside the projects.*

As you are no doubt aware, a Wikimedian and a non-Wikimedian co-author
recently published an academic essay criticising aspects of the English
Wikipedia's Holocaust coverage. In their essay, the authors mention the
legal names and the places of employment of two longstanding Wikipedia
contributors who, as WMF Trust & Safety will confirm, have suffered years
of egregious harassment because of their Wikimedia participation. I
understand this has included threats to their children, calls to their
workplace asking for them to be fired, etc.

Given this history, the authors' decision to share precise information
about these contributors' workplaces in their academic essay struck me as
ill advised. It is hard to justify on scholarly grounds – the Holocaust
topic area is unrelated to the academic positions held by these two
Wikipedians. And surely it must have occurred to the authors that providing
information on their workplaces might exacerbate the harassment they are
already experiencing, of which the authors were well aware.

Needless to say, neither of the two contributors gave their consent to
having their names and workplaces shared in the essay, which criticises
them severely – and in at least some cases very unfairly.

Given that explicit consent is what the UCoC requires for sharing of
personal information, sharing details of these Wikimedians' workplaces –
especially in the context of harsh and inflammatory criticism of their
editing, and a long history of prior harassment suffered by these
contributors – struck me as a bright-line violation of UCoC Section 3.1,
specifically:

*Disclosure of personal data (Doxing): sharing other contributors' private
information, such as name, place of employment, physical or email address
without their explicit consent either on the Wikimedia projects or
elsewhere, or sharing information concerning their Wikimedia activity
outside the projects.*

The reason I am mentioning this here is that the English Arbitration
Committee, which opened an arbitration case soon after publication of the
essay, appears largely to have taken a different view to date, preferring
to apply the most charitable interpretation of a local English Wikipedia
policy instead of the UCoC definition.[1]

Local policy on English Wikipedia says that sharing a contributor's
personal information (on Wikipedia) is not harassment if said contributor
has voluntarily posted their own information, or links to such information,
on Wikipedia at some time in the past.[2] In this specific case, one of the
two contributors once, over a decade ago, posted a link to a Dramatica page
containing their name and a previous place of employment (different from
their current place of employment as shared in the essay). I understand
they tried later on to have that edit oversighed but were refused. The
other contributor is open about their legal name and workplace on
Wikipedia.

As we can see, the English Wikipedia's local policy is not aligned with the
UCoC. The UCoC – which we are told defines a minimum standard that takes
precedence over any and all local policies and must not be ignored or
circumvented – demands that Wikimedians wanting to share other
contributors' personal information obtain "explicit consent" from the
contributors concerned. "Explicit consent" is generally considered to be a
much higher standard than implied consent.[3] "Explicit consent" is telling
an author, "Yes, it is fine for you to mention my name and workplace in
your essay."

And unlike local policy, the UCoC says that it covers conduct outside of
Wikimedia spaces as well. It says it applies to –

*all Wikimedia projects, technical spaces, in-person and virtual events, as
well as the following instances:*

*Private, public and semi-public interactions*
*Discussions of disagreement and expression of solidarity across community
members*
*Issues of technical development*
*Aspects of content contribution*
*Cases of representing affiliates/communities with external partners*

On the face of it, "public interactions" and "expressions of
disagreement"
would seem to include writings a Wikimedian publishes about another
contributor in a journal, a newspaper, a blog, etc., or statements they
make about them in press interviews.

ArbCom on the other hand appears to have taken the view that the UCoC only
applies to places "like Wikimedia listservs, affiliate zoom calls, and
Wikimedia in-person events. But that doesn't include peer reviewed papers."

So, the question I am now unclear about is: Are Wikimedians communicating
about Wikipedia outside of Wikimedia spaces – from academic journals,
newspapers and TV interviews to blogs and discussion forums – bound by the
UCoC (and specifically Section 3.1) or not? Very specifically, are they
permitted to share contributors' private information such as their
workplace address in these various venues, without obtaining explicit
consent to do so?

Clarification would be very welcome. I feel we do need some guidance as to
what the words in the UCoC are intended to mean in practice, and how much
leeway local projects should have in interpreting its intent.

Regards,
Andreas

[1]
https://en.wikipedia.org/wiki/Wikipedia:Arbitration/Requests/Case/World_War…
[2]
https://en.wikipedia.org/wiki/Wikipedia:Harassment#Posting_of_personal_info…
[3] See e.g. the GDPR-related explanation here:
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-…