GDPR and the WMF

[Eric Corbett]

I hesitate to start a new topic, but I do so to encourage anyone from Europe who has ever been foolish enough to edit Wikipedia under their real name to submit a subject access request (SAR) under the terms of the General Data Protection Regulation (GDPR) to the Wikimedia Foundation, to find out exactly what information the WMF stores about them without their permission or knowledge.

I have done so myself, and have been told that there are certain "complexities" that will require more than the permitted 30 days to comply with. I will not speculate as to what those "complexities" might be.

[Randy from Boise]

I hesitate to start a new topic, but I do so to encourage anyone from Europe who has ever been foolish enough to edit Wikipedia under their real name to submit a subject access request (SAR) under the terms of the General Data Protection Regulation (GDPR) to the Wikimedia Foundation, to find out exactly what information the WMF stores about them without their permission or knowledge.

I have done so myself, and have been told that there are certain "complexities" that will require more than the permitted 30 days to comply with. I will not speculate as to what those "complexities" might be.

Them not wanting to get sued by turning over their internal discussions about you?

RfB

[Eric Corbett]

I hesitate to start a new topic, but I do so to encourage anyone from Europe who has ever been foolish enough to edit Wikipedia under their real name to submit a subject access request (SAR) under the terms of the General Data Protection Regulation (GDPR) to the Wikimedia Foundation, to find out exactly what information the WMF stores about them without their permission or knowledge.

I have done so myself, and have been told that there are certain "complexities" that will require more than the permitted 30 days to comply with. I will not speculate as to what those "complexities" might be.

Them not wanting to get sued by turning over their internal discussions about you?

RfB

I'm not going to sue anyone for anything, far too expensive.

The courts must decide whether the data the WMF holds about me and every other editor without our knowledge or agreement is in breach of data protection laws, once we know what exactly what that data is.

[eagle]

I am sure that the knee jerk reaction to GDPR would be to amend NOLEGALTHREATS to say that anyone who makes a GDPR request is blocked while it is pending. Of course this would not be allowed under the GDPR.

Perhaps Mr. Fram or other people on the T&S SanFranBan list should make similar requests.

[Carcharoth]

Could you expand on why invoking NOLEGALTHREATS would not be allowed under the GDPR? (I too hope it wouldn't, but I'd want to be able to refute that argument if I came across it.)

[eagle]

Could you expand on why invoking NOLEGALTHREATS would not be allowed under the GDPR? (I too hope it wouldn't, but I'd want to be able to refute that argument if I came across it.)

This is a multistep process. If someone makes an SAR, and it is legitimate (e.g., the requestor is within the scope as connected to an EU member), there must be a response within 30 days. The GDPR sets out a framework and imposes duties upon the record holder to process legitimate SARs.

Suppose the person making the legitimate SAR is not satisfied with how the request is being processed. There are legitimate ways to seek redress under the GDPR, and if the WMF blocked the requestor for doing so under NOLEGALTHREATS, that would be further proof that the WMF was not processing the request correctly. A policy to block a legitimate requestor would be the equivalent of a policy requiring a $1 million fee for processing the SAR.

However, if the requestor goes outside the legitimate ways to seek redress (for example, by filing a civil suit in California, or by picketing the WMF office with a sign saying "I am going to sue you.") then the WMF could block the editor under NOLEGALTHREATS.

Ultimately, it is up to the EU to decide after-the-fact what is legitimate, and the WMF and the community must make decisions knowing that they will be second guessed.

[Pudeo]

I was under the impression that GDPR compliance is mostly enforced by complaining to the European Data Protection Supervisor and national data privacy ombudsmen, not straight lawsuits.

[Osborne]

Yeah, GDPR is a legit data request, not a legal threat. Who would apply NLT, and what would be the message of that?

[ReaperEternal]

Wikipedia:No legal threats (T-H-L) is intended to prevent editors utilizing chilling effects to get their way in a content dispute. For example, threatening to sue people who revert you will get you blocked.

GDPR is a legal request for information about you--it is not a lawsuit against other editors, so the no legal threats policy does not apply.

Personally, I'd be curious as to what types of information the WMF is keeping about you....

[Osborne]

proper reasoning.

[Eric Corbett]

Personally, I'd be curious as to what types of information the WMF is keeping about you....

... and for how long and for what purpose.

[Poetlister]

The problem is still how to enforce European law against an organisation in California. If there are servers in the EU they can be seized presumably, but that wouldn't bother the WMF too much. Blocking all WMF sites within the EU might work, though that would matter less after Brexit.

[Neil]

The problem is still how to enforce European law against an organisation in California. If there are servers in the EU they can be seized presumably, but that wouldn't bother the WMF too much. Blocking all WMF sites within the EU might work, though that would matter less after Brexit.

European countries and the EU as an organisation have enforced their laws with American companies / organiations on many occasions. The most pertinent example being Google Is Fined $57 Million Under Europe’s Data Privacy Law.

[Poetlister]

The problem is still how to enforce European law against an organisation in California. If there are servers in the EU they can be seized presumably, but that wouldn't bother the WMF too much. Blocking all WMF sites within the EU might work, though that would matter less after Brexit.

European countries and the EU as an organisation have enforced their laws with American companies / organiations on many occasions. The most pertinent example being Google Is Fined $57 Million Under Europe’s Data Privacy Law.

Yes, but Google has a lot of staff and assets within the EU and makes a lot of money from people in the EU advertising.

[GoldenRing]

Yes, but Google has a lot of staff and assets within the EU and makes a lot of money from people in the EU advertising.

Article 27 of the GDPR requires any data controller/processor outside the EU to nominate legal entity (person or corporation) as their representative within the EU for data protection purposes, essentially so that the EU has someone in its territory they can hold responsible. It would be interesting to know if the WMF has done so. It would be difficult for them to argue that they meet the exceptions.

[Ming]

Yes, but Google has a lot of staff and assets within the EU and makes a lot of money from people in the EU advertising.

Article 27 of the GDPR requires any data controller/processor outside the EU to nominate legal entity (person or corporation) as their representative within the EU for data protection purposes, essentially so that the EU has someone in its territory they can hold responsible. It would be interesting to know if the WMF has done so. It would be difficult for them to argue that they meet the exceptions.

If one feels that one can ignore the law, then surely one would extend this to such an "obligation".

[Eric Corbett]

Yes, but Google has a lot of staff and assets within the EU and makes a lot of money from people in the EU advertising.

Article 27 of the GDPR requires any data controller/processor outside the EU to nominate legal entity (person or corporation) as their representative within the EU for data protection purposes, essentially so that the EU has someone in its territory they can hold responsible. It would be interesting to know if the WMF has done so. It would be difficult for them to argue that they meet the exceptions.

I can tell you that they haven't, and that WMF UK claims to be completely independent of the WMF.

[Eric Corbett]

If one feels that one can ignore the law, then surely one would extend this to such an "obligation".

The WMF has undoubtedly been ignoring the law until now at least.

[Vigilant]

If one feels that one can ignore the law, then surely one would extend this to such an "obligation".

The WMF has undoubtedly been ignoring the law until now at least.

What's keeping you from calling them out and getting your GDPR data from them?

[Eric Corbett]

If one feels that one can ignore the law, then surely one would extend this to such an "obligation".

The WMF has undoubtedly been ignoring the law until now at least.

What's keeping you from calling them out and getting your GDPR data from them?

Do you mean WMF UK?

I have, and as I said above their claim is that they are entirely independent of the WMF, and hold no data about any Wikipedia editors.

[Vigilant]

If one feels that one can ignore the law, then surely one would extend this to such an "obligation".

The WMF has undoubtedly been ignoring the law until now at least.

What's keeping you from calling them out and getting your GDPR data from them?

Do you mean WMF UK?

I have, and as I said above their claim is that they are entirely independent of the WMF, and hold no data about any Wikipedia editors.

So send a SAR to the WMF.

[Eric Corbett]

If one feels that one can ignore the law, then surely one would extend this to such an "obligation".

The WMF has undoubtedly been ignoring the law until now at least.

What's keeping you from calling them out and getting your GDPR data from them?

Do you mean WMF UK?

I have, and as I said above their claim is that they are entirely independent of the WMF, and hold no data about any Wikipedia editors.

So send a SAR to the WMF.

I did, a month ago now.

I said right at the start that "I have done so myself, and have been told that there are certain 'complexities' that will require more than the permitted 30 days to comply with. I will not speculate as to what those 'complexities' might be."

[Poetlister]

So send a SAR to the WMF.

I did, a month ago now.

I said right at the start that "I have done so myself, and have been told that there are certain 'complexities' that will require more than the permitted 30 days to comply with. I will not speculate as to what those 'complexities' might be."

The complexities are that they have no intention of complying and are confident that you have no legal remedy against them.

[Eric Corbett]

So send a SAR to the WMF.

I did, a month ago now.

I said right at the start that "I have done so myself, and have been told that there are certain 'complexities' that will require more than the permitted 30 days to comply with. I will not speculate as to what those 'complexities' might be."

The complexities are that they have no intention of complying and are confident that you have no legal remedy against them.

We'll see. I may not, but others have.

[SixOClock]

Sounded like you got a response from this. What did you get?

[Eric Corbett]

Sounded like you got a response from this. What did you get?

I got a list of the data the WMF routinely keeps on all editors plus copies of emails that contained discussions about me, some quite heavily censored, I suppose because they were libelous.

[Carcharoth]

Sounded like you got a response from this. What did you get?

I got a list of the data the WMF routinely keeps on all editors plus copies of emails that contained discussions about me, some quite heavily censored, I suppose because they were libelous.

Were those emails internal to the WMF or from something like the ArbCom mailing list? It is fascinating to learn what the WMF think they are obliged to disclose under GDPR. How far back can such requests go? Did you have to give a range of dates in your request, or did you ask for everything they had?

[Eric Corbett]

Were those emails internal to the WMF or from something like the ArbCom mailing list? It is fascinating to learn what the WMF think they are obliged to disclose under GDPR. How far back can such requests go? Did you have to give a range of dates in your request, or did you ask for everything they had?

I asked for everything, no date range. The information I got back was:

Annex 1: General information regarding the processing of your information
Annex 2: Emails from the archives of the English Wikipedia Arbitration Committee mailing list
Annex 3: Personal information contained in additional emails of the English Arbitration Committee mailing list
Annex 4: Personal information contained in the logs of the CheckUser tool relating to User: Eric Corbett

I suppose it might come as a surprise to some arbitrators to learn that their secret deliberations maybe aren't so secret after all.

[Carcharoth]

Were those emails internal to the WMF or from something like the ArbCom mailing list? It is fascinating to learn what the WMF think they are obliged to disclose under GDPR. How far back can such requests go? Did you have to give a range of dates in your request, or did you ask for everything they had?

I asked for everything, no date range. The information I got back was:

Annex 1: General information regarding the processing of your information
Annex 2: Emails from the archives of the English Wikipedia Arbitration Committee mailing list
Annex 3: Personal information contained in additional emails of the English Arbitration Committee mailing list
Annex 4: Personal information contained in the logs of the CheckUser tool relating to User: Eric Corbett

I suppose it might come as a surprise to some arbitrators to learn that their secret deliberations maybe aren't so secret after all.

Thank you. I think this is a good thing. But I do think more people should be aware of this.

I would like to raise this in a suitable location on Wikipedia. May I quote you there?

[Eric Corbett]

Were those emails internal to the WMF or from something like the ArbCom mailing list? It is fascinating to learn what the WMF think they are obliged to disclose under GDPR. How far back can such requests go? Did you have to give a range of dates in your request, or did you ask for everything they had?

I asked for everything, no date range. The information I got back was:

Annex 1: General information regarding the processing of your information
Annex 2: Emails from the archives of the English Wikipedia Arbitration Committee mailing list
Annex 3: Personal information contained in additional emails of the English Arbitration Committee mailing list
Annex 4: Personal information contained in the logs of the CheckUser tool relating to User: Eric Corbett

I suppose it might come as a surprise to some arbitrators to learn that their secret deliberations maybe aren't so secret after all.

Thank you. I think this is a good thing. But I do think more people should be aware of this.

I would like to raise this in a suitable location on Wikipedia. May I quote you there?

Of course.

[Beeblebrox]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

[Eric Corbett]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

[Beeblebrox]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

Really? That's surprising. Care to prove it?

[Eric Corbett]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

Really? That's surprising. Care to prove it?

How would you suggest I prove it to your satisfaction? Would that even be possible?

Are you worried about something that might incriminate you in some way?

[Beeblebrox]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

Really? That's surprising. Care to prove it?

How would you suggest I prove it to your satisfaction?

Share some of the emails about you? If it's your data that was released to you surely you can share what was uncovered, and I can't imagine you'd pass up a chance to publicly embarrass arbcom.

I mean, given the number of times your name must have been discussed over the years there's got to be some pretty juicy stuff in there.

[Eric Corbett]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

Really? That's surprising. Care to prove it?

How would you suggest I prove it to your satisfaction?

Share some of the emails about you? If it's your data that was released to you surely you can share what was uncovered, and I can't imagine you'd pass up a chance to publicly embarrass arbcom.

I mean, given the number of times your name must have been discussed over the years there's got to be some pretty juicy stuff in there.

What's in it for me, given that I don't give two hoots for what you do or don't believe?

[Eric Corbett]

I'm not going to enter into any discussion with the likes of Beeblebrox about whether or not I'm telling the truth about the results of my GDPR subject access request; I know what the truth is, and I also know that nothing I can say will convince him that I'm not making this up.

So I will make this offer. If he can come up with someone we both know and trust I am prepared to forward the entire document on to that person, provided they are agreeable. I will add that contrary to his childish supposition I have no particular interest in embarrassing ArbCom; it's more than capable enough of doing that itself without my help.

[Vigilant]

Chase me, chase me!

[Poetlister]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

It's difficult to be sure of that. THey might well have withheld some, and it wouldn't be obvious.

I'm happy to be a stakeholder between Eric and Beeblebrox.

[Beeblebrox]

I didn't mean you had to message me personally, (although you've done so as recently as last week) I don't see what is stopping you from just sharing it publicly right here. What's the problem?

But if you insist on doing it this way, my pick would be Tim/Carrite. I feel like he is generally trusted by everyone around here not to lie on anyone else's behalf.

[Eric Corbett]

I didn't mean you had to message me personally, (although you've done so as recently as last week) I don't see what is stopping you from just sharing it publicly right here. What's the problem?

The problem is that I don't trust you with my private information. Or anything else for that matter.

[Eric Corbett]

Just so we're clear, are you saying that you got copies of every arbcom email ever that discussed you? Because that's what it seems like you are saying.

That's what I'm saying.

It's difficult to be sure of that. THey might well have withheld some, and it wouldn't be obvious.

I'm happy to be a stakeholder between Eric and Beeblebrox.

There's obviously no way I can be certain that the WMF has acted honestly in claiming to reveal all the information they hold about me, I can only take them at their word.

Were they a UK organisation things would be very different.

[Beeblebrox]

Yeah, I'll go ahead and come out and say it: I know that you're full of shit.

There's no way in hell you have what you are claiming to have. There is no personal data about you in an arbcom discussion about your behavior. What you have is every email you sent to the committee, which would have your full email header on it, which is the sort of data they actually are required to turn over. They would be grossly violating a whole bunch of other people's privacy if they really gave you what you say they did. It simply isn't believable.

You ad your cronies have trying ever since your fake retirement to cause as much panic and discord as possible. You succeeded for a moment there, but the mask has slipped and its now clear you have been lying about any number of things, all the way from lies of omission to outright fabrications like this. Make whatever coy half-truth of a reply makes you feel better about it, but until you provide real evidence to back your bullshit I wouldn't expect it to be taken seriousl, even by this crowd.

[Jans Hammer]

Yeah, I'll go ahead and come out and say it: I know that you're full of shit.

There's no way in hell you have what you are claiming to have. There is no personal data about you in an arbcom discussion about your behavior. What you have is every email you sent to the committee, which would have your full email header on it, which is the sort of data they actually are required to turn over. They would be grossly violating a whole bunch of other people's privacy if they really gave you what you say they did. It simply isn't believable.

You ad your cronies have trying ever since your fake retirement to cause as much panic and discord as possible. You succeeded for a moment there, but the mask has slipped and its now clear you have been lying about any number of things, all the way from lies of omission to outright fabrications like this. Make whatever coy half-truth of a reply makes you feel better about it, but until you provide real evidence to back your bullshit I wouldn't expect it to be taken seriousl, even by this crowd.

I think that is unduly harsh if I'm honest. Which I am.

[Eric Corbett]

I think that is unduly harsh if I'm honest. Which I am.

He's just panicking. In fact I doubt I ever sent ArbCom even a single email, never much saw the point in dealing with its corruption. Beeblebrox would feel right at home there.

I've offered to send everything I have to a mutually trusted third party, who can decide whether or not I'm telling the truth, and the offer still stands.

[Beeblebrox]

put up or shut up

[Eric Corbett]

put up or shut up

I'll be quite happy to do exactly that, as I've already said at least twice now.

But not to you.

[Vigilant]

Yeah, I'll go ahead and come out and say it: I know that you're full of shit.

There's no way in hell you have what you are claiming to have. There is no personal data about you in an arbcom discussion about your behavior. What you have is every email you sent to the committee, which would have your full email header on it, which is the sort of data they actually are required to turn over. They would be grossly violating a whole bunch of other people's privacy if they really gave you what you say they did. It simply isn't believable.

You ad your cronies have trying ever since your fake retirement to cause as much panic and discord as possible. You succeeded for a moment there, but the mask has slipped and its now clear you have been lying about any number of things, all the way from lies of omission to outright fabrications like this. Make whatever coy half-truth of a reply makes you feel better about it, but until you provide real evidence to back your bullshit I wouldn't expect it to be taken seriousl, even by this crowd.

SMACKDOWN!
FATALITY!
FINISH HIM!

[Vigilant]

put up or shut up

I'll be quite happy to do exactly that, as I've already said at least twice now.

But not to you.

I'm calling it too.
You're full of shit right to your receding hair line.

[Mason]

I think that is unduly harsh if I'm honest. Which I am.

He's just panicking. In fact I doubt I ever sent ArbCom even a single email, never much saw the point in dealing with its corruption. Beeblebrox would feel right at home there.

I've offered to send everything I have to a mutually trusted third party, who can decide whether or not I'm telling the truth, and the offer still stands.

I volunteer. As far as I'm aware I'm not on bad terms with either of you.