[Foundation-l] Release of squid log data

[Luna]

The repeated mention of a non-disclosure agreement indicates to me that most
everyone involved in this conversation knows, at the most basic level, that
we're talking about releasing private data.

Have our readers agreed to release this information? Are they aware that
their private browsing habits will be subject to third-party review? Why
don't we announce this in the sitenotice, and see what our readers think
about it?

The privacy policy is quite explicit: "Wikimedia will not sell or share
private information, such as email addresses, with third parties, unless you
agree to release this information, or it is required by law to release the
information." There is no exception for "but it's really cool," nor "they
asked nicely," nor even "they said it's totally still private, signed a
contract and everything."

If we alter the privacy policy every time we feel like releasing (or
selling) information, we might as well not have a privacy policy at all.

Yes, research is important. Yes, our goal is to spread and increase the sum
of human knowledge. But privacy of private data is currently written into
policy as being *important*, and I haven't yet seen a compelling reason to
change that.

This should not be a casual decision. The information security of our
editors and readers should be an utmost priority.

-Luna