The rather big deal for me is that when i edit a Wikimedia project there is a privacy policy, and next to that there is a policy that only people who identified themselfs to the foundation can handle non-public date. I guess that there this is the case also. So wouldn't it be more secure and inside the Wikimedia policies when it would be send to OTRS and that trusted identified users can handle those? I do see a big concern, cuz I send my passport somewhere for Wikipedia... If something happens it would make Wikimedia responsible, because I send it to them (to a Dutch adress) So do we want a policy that works but could endanger the Foundation because they are still responsible. 2011/7/9 Gerard Meijssen <gerard.meijssen(a)gmail.com> works.. if foundation -- Kind regards, Huib Laurens WickedWay.nl Webhosting the wicked way. _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l

Hello, I want to know if there is a privacy concern on the Dutch Wikipedia. The short story: When you got blocked on the Dutch Wikipedia for socking you can remove the block by sending a copy of your passport to a user thats trusted by the community. After he checks your passport or all the passports involved if you have a shared connection the block will be removed. The user where you have to send it to isn't indentified by the foundation and you have to send it by snailmail not to OTRS. The foundations privacy policies does that allow this to happen? -- Kind regards, Abigor

David Gerard, 09/07/2011 12:46: only copy While Beria is technically right (probably), I agree with David. Gerard Meijssen, 09/07/2011 10:06: copy of works.. Gerard is right as well. This system makes sense and could work as an extension of those occasions when a trusted user says "oh, but I met both User:Whatever and User:AllegedSockpuppet in person at that wikimeetup, I grant you they really exist!", but probably there shouldn't be any "official" page, policy or guideline suggesting people to send private data like Huib described. Nemo _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l

Like what David pointed out, it may be more of a problem when it is not clearly stated that the person receiving the letter is not a WMF staff or officially authorised personnel. People *may *think that they are dealing with official personnel but when they find out that they aren't, it may cause dispute. But anyway there isn't much information in this thread to tell. Best, [[User:Bencmq]] / Benjamin Chen _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l

On 10 July 2011 10:55, Huib Laurens <sterkebak(a)gmail.com> wrote: The relevant paragraph appears to be http://nl.wikipedia.org/wiki/Wikipedia:Sokpop#Ontsnappingsclausule The Google translation is "In order to be unblocked, the person behind the corresponding IP address is a letter (paper) to a community trust staff." Does it actually mean "staff" in Dutch? Does it imply *in any way* that the person to contact is officially sanctioned to deal with private information? http://nl.wikipedia.org/wiki/Wikipedia:Blokkeringsmeldingen#Ontsnappingscla… The Google translation for this one appears to quite definitely be trying to imply official status. Does it carry such implications in the original Dutch? It doesn't matter if Huib was blocked for good reason. This still looks very like a privacy disaster in the making, and the Foundation, and particularly the staff relating to privacy concerns, need to look into it very closely. - d. _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l

> Just to be clear: the alternative situation was, and would probably be, > that > people who currently can choose to use this clause, would simply be blocked > forever without a way of getting unblocked.

That's the approach most projects take... and anyway copies of identity documents don't prove very much at all.

Do they have notaries in the Netherlands?  Why not simply ask them to mail a notarized statement that "I am Foo at such an address and request an ublock so I may edit as Bar"? I still am not sure if this is something I would completely endorse, but at least it would be meaningful and not so easily forged.

The next question becomes....and what does this "trusted person" do with the information? If it is destroyed promptly, then there's really not much point; if it is retained, I'd like to see how this meets local and EU privacy policies.

On 10 July 2011 21:28, Peter Gervai <grinapo(a)gmail.com> wrote:

We're not saying it's illegal.

We're saying it's grossly unfit for Wikimedia and laughs at the privacy policy.

However, you say that pointing out that something ridiculously bad is ridiculously bad is "impolite". So I guess that makes it all okay then.

Does it? Where is the evidence for this? I'm not being hasty in forming a firm judgement here - other than to say it doesn't, on the face of it, seem like a good idea for a project to be doing this. confined it could be a good thing to have. Indeed, if. But again, no word or evidence of such things so far. I do think this is a serious problem that needs investigating: - The argument that this is essentially an optional function is not really appealing, and is easily said by those who are not blocked. Saying "if you want to edit send a stranger your identity" does not sit comfortably with me. (this is just my personal view, but I include it for completeness) - Saying this is disconnected from Wikipedia/the Foundation is a red herring - it is organised via the website, so for any user utilising this service it looks to some extent "official". The Foundation have a reasonable duty of care to its users and at this point they are not able to properly audit or oversight the handling of personal details. - The whole idea is a "false flag" anyway because identity is beyond trivial to fake. So, it is not about identity, but about some slightly high barrier of action for an individual to take - the idea being it filters out the more casual bad guys. In which case; a more suitable alternative to identity could be used. Perhaps a hand written letter asking for an unblock? That seems much better system. - EU data protection laws *explicitly* apply to the handling of personal data by private individuals. And as an enabling medium Dutch Wikipedia could easily also be considered a controller within the scope of the law (they are intentionally very broad). This means if the data does end up being misused then it will be a major blow; hence it seems sensible to require some investigation of this process. -- As an addendum to that the process described on the Dutch Wikipedia at the very least need to comply with EU directives. For example the person processing the data must reveal his name and address (I realise that is likely to happen, but I see no clarity on the matter and no oversight to ensure this occurs) and the details of *precisely* what will be done with the data need to be published (and kept to) -- We need to establish (prefferably with a lawyer) to what extent this process is considered necessary or relevant; because if it is one or neither then it is non-compliant. There is also an extended risk here; something simple like an admin unblocks the account of "Bram van Rijn" and, when unblocking him, says "There you go Bram, enjoy editing!". Something simple and innocent is now non-compliant. For that reason people handling identity in a capacity relating to Wikipedia, even semi-officially, need to be well vetted. I have argued this before several times in relation to other such things on English Wikipedia, and I realise my view may be stronger than the majorities. But in this case it appears not even a cursory check is being undertaken. Tom _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l

I'm thinking more of whether or not it is retained, and precisely how it is retained. Is it kept in a locked box somewhere? Sitting on someone's desk? Accessible to other individuals?

On 10 July 2011 10:55, Huib Laurens <sterkebak(a)gmail.com> wrote: The relevant paragraph appears to be http://nl.wikipedia.org/wiki/Wikipedia:Sokpop#Ontsnappingsclausule The Google translation is "In order to be unblocked, the person behind the corresponding IP address is a letter (paper) to a community trust staff." Does it actually mean "staff" in Dutch? Does it imply *in any way* that the person to contact is officially sanctioned to deal with private information? http://nl.wikipedia.org/wiki/Wikipedia:Blokkeringsmeldingen#Ontsnappingscla… The Google translation for this one appears to quite definitely be trying to imply official status. Does it carry such implications in the original Dutch? It doesn't matter if Huib was blocked for good reason. This still looks very like a privacy disaster in the making, and the Foundation, and particularly the staff relating to privacy concerns, need to look into it very closely. - d. _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l

The relevant paragraph appears to be http://nl.wikipedia.org/wiki/Wikipedia:Sokpop#Ontsnappingsclausule The Google translation is "In order to be unblocked, the person behind the corresponding IP address is a letter (paper) to a community trust staff." Does it actually mean "staff" in Dutch? Does it imply *in any way* that the person to contact is officially sanctioned to deal with private information?

http://nl.wikipedia.org/wiki/Wikipedia:Blokkeringsmeldingen#Ontsnappingscla… The Google translation for this one appears to quite definitely be trying to imply official status. Does it carry such implications in the original Dutch?

It doesn't matter if Huib was blocked for good reason. This still looks very like a privacy disaster in the making, and the Foundation, and particularly the staff relating to privacy concerns, need to look into it very closely.

high-quality, and nuance and implications are the issue, which is why I was asking Dutch speakers what it actually meant. The original Dutch reads: "Om gedeblokkeerd te worden, moet(en) degene(n) die achter het betreffende IP adres zitten een brief sturen (papier) naar een door de gemeenschap vertrouwde medewerker. Deze kan via de emailfunctie links in het kader "hulpmiddelen" van zijn overlegpagina gemaild worden en zal dan een postadres verstrekken. In die brief moeten zij hun identiteit kenbaar maken, dit onderbouwen met een (kopie van een) geldig identiteitsbewijs, beloven om voortaan onder één account te zullen werken, aangeven met welke gebruikersnaam dat zal zijn (of een nieuwe kiezen) en een werkend emailadres opgeven. Wijs bij het blokkeren de betreffende gebruiker op deze clausule en blokkeer de emailfunctie van de oorspronkelijk aangemaakte account niet mee. Deze clausule geldt uiteraard niet voor ingelogde vandalen die doorgaan via sokpopperij met hun activiteiten."