Skip to content

CoC record keeping must abide by privacy policy #1523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

CoC record keeping must abide by privacy policy #1523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
68e3f80
Clarify that the record keeping requirements of the CoC Policy must a…
tobie Jul 30, 2025
1d8e503
Minimize changes
tobie Jul 30, 2025
2a448cb
Clarify that record keeping must include information (not just comms)
tobie Jul 30, 2025
4e0f3d6
Add CoC Team as a resource for projects self-handling CoC reports
tobie Aug 2, 2025
a40fd72
Add addressing questions raised by projects to CoC Team responsibilities
tobie Aug 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions conduct/COC_POLICY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ The number and relevant details of the reported incidents, escalation requests,

## Record keeping

A record of all communications related to an incident report, escalation request, or appeal must be kept.
A record of all information and communications related to an incident report, escalation request, or appeal must be kept, while ensuring that the requirements of OpenJS’s [privacy policy][] are met.
Copy link
Contributor

@joyeecheung joyeecheung Aug 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
A record of all information and communications related to an incident report, escalation request, or appeal must be kept, while ensuring that the requirements of OpenJS’s [privacy policy][] are met.
A record of adequate and necessary information and communications related to an incident report, escalation request, or appeal must be kept, while ensuring that the requirements of OpenJS’s [privacy policy][] are met.

From what I can tell the wording changes don't really address the questions in #1522 - the privacy policy doesn't say anything specific about CoC handling, and it tries very hard to limit data collection when it goes anywhere near GDPR Article 9 (see Event Administration and Analytics), so it still leaves the judgement to the moderators. If I was a moderator I still would not be able to draw from the privacy any conclusion if I ran into "sensitive political opinion shared during the handling of a CoC incident about nationality discrimination", and I needed to decide whether sharing a full export of chat history about it would lead to a violation of the policy.

I think the primary difference I can tell from what this document says and what GDPR says is that GDPR 5 says:

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

but this document uses:

all information and communications related to...

The privacy policy is very vague about how much information is retained, and it seems to be intentionally avoiding words like "all"/"every" which may counter GDPR 5. I think borrowing the wording from GDPR and use "adequate, relevant and necessary" instead of "all" would probably help moderators feel less compelled to go beyond what the GDPR or the privacy policy safegaurd them to do.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So the idea here is that it is not for the CPC to decide what should be in the privacy policy but for the Board/ED, with this policy just referencing it. I like your below suggestion to provide a contact point in case of doubt here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also think it would be useful to clarify whether the privacy policy needs to be more specific about CoC incident record keeping of if the language it contains is enough. Tracking here: #1528.

Copy link
Contributor

@joyeecheung joyeecheung Aug 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reading the GDPR I noticed that there might have been another thing missing from the policy - GDPR 12 and 13 requires the controller to be transparent about the data collection in several different aspects https://gdpr.eu/article-13-personal-data-collected/ - I think in practice this means when collecting the personal data, the moderator needs to inform those who might be sharing personal data that the data collected would be subject to this privacy policy. AFAICT that's probably rarely done at the moment - or not that many people know about the privacy policy in the first place. What happens more commonly AFAIK is that moderators would redact whatever inappropriate to share and get consent from people sharing the information before they forward it to someone else.


## Confidentiality

Expand Down Expand Up @@ -97,7 +97,8 @@ Projects may opt-in to enforce the code of conduct themselves provided they meet
6. Publicly document their decision-making process for responding to incident reports.
7. Document the foundation's escalation and appeal process alongside the code of conduct.
8. Participate in good faith in the [escalation](#escalation) and [appeal](#appeals) processes.

9. Raise questions or concerns arising during management of an incident report with the CoC Team.

## Moderation

Each project is free to implement moderation processes appropriate for the size and scope of the project provided these processes abide by the code of conduct and by this policy.
Expand All @@ -110,19 +111,21 @@ The CoC Team is empowered to manage escalation requests of incident reports mana

If the CoC Team finds that the escalation request has merit, the CoC Team may decide to take over the management of the incident report or refer the issue to the Cross Project Council which may request changes to the existing management process.

Projects are expected to participate in good faith in the escalation process and to share all the information related to the incident report with the CoC Team. The CoC Team is expected to consider project and community needs during the escalation process and may involve the Cross Project Council if necessary and project leadership if appropriate.
Projects are expected to participate in good faith in the escalation process and to share all [records][] related to the incident report with the CoC Team. The CoC Team is expected to consider project and community needs during the escalation process and may involve the Cross Project Council if necessary and project leadership if appropriate.

## Appeals

Harmed individuals and accused individuals have thirty (30) days after a response was provided to appeal to the CoC Team a decision made in response to an incident report. Decisions may only be appealed on the grounds that the documented process was not properly followed or that it did not meet the requirements of this policy. If the CoC Team finds that the appeal has merit, it may decide to override the decision that was previously made.

If the initial report was already managed by the CoC Team, a different set of CoC Team members should be chosen to manage the appeal process. The CoC Team may choose to involve external people if needed.

If the appeal follows an incident report managed by a project, the project is expected to participate in good faith in the appeal process and to share all the information related to the incident report with the CoC Team. The CoC Team is expected to consider project and community needs during the appeal and may involve the Cross Project Council if necessary and project leadership if appropriate.
If the appeal follows an incident report managed by a project, the project is expected to participate in good faith in the appeal process and to share all [records][] related to the incident report with the CoC Team. The CoC Team is expected to consider project and community needs during the appeal and may involve the Cross Project Council if necessary and project leadership if appropriate.

Appeals do not delay or block the execution of decisions communicated in the response.

[CoC]: https://code-of-conduct.openjsf.org/
[Charter]: https://github.com/openjs-foundation/cross-project-council/blob/main/CPC-CHARTER.md
[CoC Team Charter]: https://github.com/openjs-foundation/cross-project-council/blob/main/conduct/COC_TEAM_CHARTER.md
[incident management processes]: https://github.com/openjs-foundation/cross-project-council/blob/main/conduct/COC_PROCESS_FOR_INCIDENT_MANAGEMENT.md
[privacy policy]: https://privacy-policy.openjsf.org/
[records]: #record-keeping
1 change: 1 addition & 0 deletions conduct/COC_TEAM_CHARTER.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ The CoC Team's responsibilities are to:
- Handle code of conduct [incident reports][incident report].
- Handle code of conduct [escalation requests][escalation].
- Handle code of conduct [appeals][appeal].
- Address or escalate questions and concerns raised by a project that is handling an incident report.
- Keep the CPC up to date on cases requiring the CPC's attention.
- Provide regular transparency reports to the CPC.
- Uphold this charter, the [code of conduct][CoC], and the [code of conduct policy][CoC Policy].
Expand Down