Code of Conduct and Incident Privacy

[gregsdennis]

Context: JSON Schema is trying to create a Code of Conduct process.

Apparently at some point it was suggested that we use a GitHub repo to record CoC incidents, their discussion, and their remediation. Additionally, a Slack channel could be created to facilitate faster discussion.

I'm not sure who would have access to these things, but having a single place for discussion all incidents seems like it would violate the privacy of previous incidents.

For example, if I'm involved in a CoC incident, then I need to be able to discuss the incident with the CoC Panel in a secure environment. Later if another person is involved in a CoC incident, they should get a separate environment to discuss their incident. If both of our incidents are discussed in the same place, then the other person has access to the private details of my incident.

This tells me that each incident should have a dedicated private Slack channel, and we cannot collect these into a single GitHub repo where all participants have access to every issue/discussion.

The question for this space is how privacy concerns like these are handled in other projects.

cc: @Relequestual @benjagm

[ljharb]

In my experience discussions are done by email or on a video call, and summarized in the github repo/slack channel (where only CoC panel would have access). I'm not sure why being involved in an incident - as the reporter or the transgressor - needs an additional private space for discussion.

[gregsdennis]

I'm not sure why being involved in an incident - as the reporter or the transgressor - needs an additional private space for discussion.

As you mentioned email and/or video calls, those are examples of the exact private spaces I'm talking about. Some private space must exist for Panel members to discuss the incident with both or either party.

[ljharb]

Oh sure - but generally I'd expect the panel to discuss those on a live video call with or without the reporter or any transgressors as appropriate.

[gregsdennis]

So it sounds like you're expecting that these (the shared Slack channel and GitHub repo) are for CoC Panel members only, while discussion with the involved occurs using other communication avenues that are private to each. Is that right?

Is there any concern about current CoC Panel members having access to incidents that predate their tenure? (I imagine they'd need to be able to access previous decisions as records of precedent.)

[ljharb]

Yes, I wouldn't expect to ever grant access to reporters or transgressors.

I think it should be assumed (perhaps explicitly communicated, though) that new CoC members have access to view all past CoC information as well. If they don't have that trust, then they probably shouldn't be on the CoC panel in the first place :-)

[tobie]

I think it should be assumed (perhaps explicitly communicated, though) that new CoC members have access to view all past CoC information as well. If they don't have that trust, then they probably shouldn't be on the CoC panel in the first place :-)

Recommendations we have received from the LF's subject matter expert is to have a slack channel per incident, notably in order to manage situations where there's a conflict of interest (e.g. same employer, etc.).

[Relequestual]

I think it should be assumed (perhaps explicitly communicated, though) that new CoC members have access to view all past CoC information as well. If they don't have that trust, then they probably shouldn't be on the CoC panel in the first place :-)

Recommendations we have received from the LF's subject matter expert is to have a slack channel per incident, notably in order to manage situations where there's a conflict of interest (e.g. same employer, etc.).

Right, but there needs to be some sort of CoC panel accessible log of events in order to determine if there is a repeat offender or not.

So for discussion of a specific single ongoing incident, sure, a private slack channel per incident. But for a final decision log, a private repo seems appropriate.

[gregsdennis]

@Relequestual Does the event log need to be GitHub? Have we explored other tool possibilities, or are we deciding to go with this because it was suggested (if so, why was it suggested)?

[ljharb]

It needs to be somewhere public and auditable - why wouldn't github be the obvious choice?

[gregsdennis]

What's the content of the event log? If it's public, wouldn't privacy be an issue?

[ljharb]

Not public; only visible to CoC panel members, present and future.

[tobie]

Duplicate of #1256.