[Wikimedia-l] Re: Local enforcement of the Universal Code of Conduct

Dear Wikimedia Foundation Trustees and all, The Universal Code of Conduct (UCoC) has been in force for some time. The Enforcement Guidelines have now been endorsed by the community. But as with any new document, shared understandings and clarifications must develop over time. Until then, practical enforcement is anything but routine. Here is an example. Section 3.1 of the UCoC states that the following is harassment: *Disclosure of personal data (Doxing): sharing other contributors' private information, such as name, place of employment, physical or email address without their explicit consent either on the Wikimedia projects or elsewhere, or sharing information concerning their Wikimedia activity outside the projects.* As you are no doubt aware, a Wikimedian and a non-Wikimedian co-author recently published an academic essay criticising aspects of the English Wikipedia's Holocaust coverage. In their essay, the authors mention the legal names and the places of employment of two longstanding Wikipedia contributors who, as WMF Trust & Safety will confirm, have suffered years of egregious harassment because of their Wikimedia participation. I understand this has included threats to their children, calls to their workplace asking for them to be fired, etc. Given this history, the authors' decision to share precise information about these contributors' workplaces in their academic essay struck me as ill advised. It is hard to justify on scholarly grounds – the Holocaust topic area is unrelated to the academic positions held by these two Wikipedians. And surely it must have occurred to the authors that providing information on their workplaces might exacerbate the harassment they are already experiencing, of which the authors were well aware. Needless to say, neither of the two contributors gave their consent to having their names and workplaces shared in the essay, which criticises them severely – and in at least some cases very unfairly. Given that explicit consent is what the UCoC requires for sharing of personal information, sharing details of these Wikimedians' workplaces – especially in the context of harsh and inflammatory criticism of their editing, and a long history of prior harassment suffered by these contributors – struck me as a bright-line violation of UCoC Section 3.1, specifically: *Disclosure of personal data (Doxing): sharing other contributors' private information, such as name, place of employment, physical or email address without their explicit consent either on the Wikimedia projects or elsewhere, or sharing information concerning their Wikimedia activity outside the projects.* The reason I am mentioning this here is that the English Arbitration Committee, which opened an arbitration case soon after publication of the essay, appears largely to have taken a different view to date, preferring to apply the most charitable interpretation of a local English Wikipedia policy instead of the UCoC definition.[1] Local policy on English Wikipedia says that sharing a contributor's personal information (on Wikipedia) is not harassment if said contributor has voluntarily posted their own information, or links to such information, on Wikipedia at some time in the past.[2] In this specific case, one of the two contributors once, over a decade ago, posted a link to a Dramatica page containing their name and a previous place of employment (different from their current place of employment as shared in the essay). I understand they tried later on to have that edit oversighed but were refused. The other contributor is open about their legal name and workplace on Wikipedia. As we can see, the English Wikipedia's local policy is not aligned with the UCoC. The UCoC – which we are told defines a minimum standard that takes precedence over any and all local policies and must not be ignored or circumvented – demands that Wikimedians wanting to share other contributors' personal information obtain "explicit consent" from the contributors concerned. "Explicit consent" is generally considered to be a much higher standard than implied consent.[3] "Explicit consent" is telling an author, "Yes, it is fine for you to mention my name and workplace in your essay." And unlike local policy, the UCoC says that it covers conduct outside of Wikimedia spaces as well. It says it applies to – *all Wikimedia projects, technical spaces, in-person and virtual events, as well as the following instances:* *Private, public and semi-public interactions* *Discussions of disagreement and expression of solidarity across community members* *Issues of technical development* *Aspects of content contribution* *Cases of representing affiliates/communities with external partners* On the face of it, "public interactions" and "expressions of disagreement" would seem to include writings a Wikimedian publishes about another contributor in a journal, a newspaper, a blog, etc., or statements they make about them in press interviews. ArbCom on the other hand appears to have taken the view that the UCoC only applies to places "like Wikimedia listservs, affiliate zoom calls, and Wikimedia in-person events. But that doesn't include peer reviewed papers." So, the question I am now unclear about is: Are Wikimedians communicating about Wikipedia outside of Wikimedia spaces – from academic journals, newspapers and TV interviews to blogs and discussion forums – bound by the UCoC (and specifically Section 3.1) or not? Very specifically, are they permitted to share contributors' private information such as their workplace address in these various venues, without obtaining explicit consent to do so? Clarification would be very welcome. I feel we do need some guidance as to what the words in the UCoC are intended to mean in practice, and how much leeway local projects should have in interpreting its intent. Regards, Andreas [1] https://en.wikipedia.org/wiki/Wikipedia:Arbitration/Requests/Case/World_War… [2] https://en.wikipedia.org/wiki/Wikipedia:Harassment#Posting_of_personal_info… [3] See e.g. the GDPR-related explanation here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-…