[Foundation-l] Release of squid log data

Sat Sep 15 17:39:00 UTC 2007

Sue Gardner wrote:
> Erik Moeller wrote:
>   
>> On 9/14/07, Tim Starling <tstarling at wikimedia.org> wrote:
>>     
>>> For a while now, we've been releasing squid log data, stripped of
>>> personally identifying information such as IP addresses, to groups at
>>> two universities: Vrije Universiteit and the University of Minnesota. We
>>> now have a request pending from a third group, at Universidad Rey Juan
>>> Carlos in Spain. They are asking if they can have the full data stream
>>> including IP addresses, and they are prepared to sign a confidentiality
>>> agreement to get it.
>>>       
>> "Wikimedia will not sell or share private information, such as email
>> addresses, with third parties, unless you agree to release this
>> information, or it is required by law to release the information."
>> http://wikimediafoundation.org/wiki/Privacy_policy
>>
>> Under the current policy I would not support it, even if "private
>> information" is somewhat ambiguous: we must err on the side of
>> caution.
>>     
> Yes. The first question is, would providing this data violate the 
> privacy policy, which protects "private information" - often but not 
> always assumed to mean personally-identifiable information. If we 
> consider the squid log data to include potentially 
> personally-identifiable/private information, then we can't release it 
> to a third party. Regardless of how much we trust them, or what they 
> are willing to sign.
>   
Trust and signatures are not enough.  How will they react if a 
government demands the release of private information?  If we determine 
that we will not release it in the absence of a court order, what 
recourse do we have if the acquirers are not willing to resist a 
government order in the courts?  In some jurisdictions there may be no 
such right to challenge such an order.
> If the release does NOT violate the privacy policy, then the question 
> becomes whether it violates existing community standards & practices. 
> I don't know the answer to that. But there has been lots of discussion 
> here, which may suggest there's not a clear consensus view.
>   
There's at least a consensus insofar as appreciating that there are lot 
concerns about this issue that cannot be easily.  The simple fact that 
Tim sought the advice of this list before barging ahead tells us that 
even the proponent of of these acts has his doubts.

Ec