The case started in August 2021 with a complaint that de Paço was upset about the Portuguese and English language versions of the articles about him. The first judicial pass went well. But that’s where the good news ends. The next level of Portugal’s court system decided the lower court was wrong about everything, which means that — for now — the person wanting to memory hole past allegations at least temporarily has the upper hand. The Portuguese court ruled against them on 13 July, and demanded that the Foundation turn over personal data about multiple users who worked on the article.
Obviously, Wikimedia is not just going to hand over user info just because this court weirdly decided it’s the guy who just wants people to stop making (apparently) factual allegations against him. Not only would this surrender of info go against Wikimedia’s own standards, it goes against European law, which does not align with this strange decision by Portugal’s appellate-level court.
If Wikipedia wants to be resilient against these sort of demands for information, they shouldn’t store user information at all, no emails, no IP addresses, nothing.
They could allow people to register on the site using OAuth, yubikeys, and make edits through tor. It would make fighting spam a little harder but hopefully the OAuth barrier would keep that from getting abused.
But the point still stands if a website has the capability of revealing its users, it will be compelled to reveal that information.
Iirc it’s possible to edit Wikipedia articles without an account. In this case they publish your IP instead of a username.
Some user information is necessary for many users. E.g. email for password resets and notifications (discussions, …).
I do agree that all personal information should be optional, but I don’t know whether that’s the case atm. Logging IP’s is probably important for preventing spam and misuse. E.g. a german politician made the news a few years back because the IP who edited their article came from their office.