How to add a new decision

The easiest way to submit a new case to our wiki, is the GDPRhub Submission Form:

Create an account with GDPRhub
Log in with your Account
Fill out the GDPRhub Submission Form
Click submit
Once you have submitted a case, you can edit the page like any other wiki page

For more details, see below...

Guide on all GDPDhub Submission Form Elements

Here you can find a guide on how to summarize decisions for the GDPRhub.

If you have questions or suggestions you can always contact us.

Choose the Right Form

There are three versions of the form:

One for DPA Decisions (Data Protection Authorities)
One for Court Decisions
One for CJEU Decisions (Court of Justice of the European Union)

Note: There is no form for other types of bodies, but you can usually use the Court form and maybe edit the details in the final wiki page. Our team is happy to help you there.

Enter all Meta Information

The correct meta information is key to enable readers to find your summary. Please take care to be very precise, as many elements require each digit to be correct, so that your summary shows up in the right category.

Jurisdiction

Jurisdiction: it only allows EU Member States, EEA Member States, the "European Union", Switzerland and the UK.

Authority or Court

DPAs: All details of all relevant DPAs are already in our system. You just have to choose the right authority.
Courts: When addition local courts, please take special care to enter the right details:
- Abbreviation ("Abbr."): This should be the short form the Court as used in the Member State (for example the "Kammergericht" in Berlin is abbreviated as "KG Berlin")
- Name: The full name of the Court as used in the Member State (for example "Kammergericht Berlin")
- English Name: The English (usually descriptive) name of the Court to make foreign readers understand what type of court this was. Some Member States have official English names (e.g. Germany) with other Countries you have to translate the name yourself. If your Court has an English name (e.g. the Irish High Court) you just enter the same name twice.

National Case Number or Name

National Case Number: Most Member States have some form of case numbering. Just enter the relevant number here. If in doubt, maybe check how the other cases from your country were formatted. You can check for example by clicking on your jurisdiction.
Case Name: Some Member States use case names, in these cases enter the case name instead of the number.

Note: If the case was not published or you do not know the details (e.g. because there is only a press statement by the DPA) then you can enter a descriptive case name (e.g. "Austrian Postal Service").

ECLI

Some Member States also add the European Case Law Identifier (ECLI) to decisions. If that is present, you should add it here.

Applied Law(s)

GDPR Article: Choose the GDPR Articles and the sub-paragraph that are relevant for your case.
- You can add multiple articles. Always add all relevant Articles (e.g. Article 6(1)(a) and 4(11) GDPR in a case concerning the requirements of consent).
- Always use the most specific sub-paragraph (e.g. Article 6(1)(a) GDPR for consent and Article 6(1) GDPR if there was no legal basis at all).

EU Law: If any other EU law was relied on, add the Article and name of the law and a link
- Follow the Format "Article 1(2)(a) Directive 2021/1234" for the name
- Add a link (e.g. to EurLEX) for the relevant law
National/Other Law: You can add other relevant national laws (e.g. a national Data Protection Act).
- Follow the common national short citation (the text has to go in a small box)
- Add a link (e.g. to the national legal database) for the relevant law

Type of Decision, Outcome & Fine

For DPAs you can add the type of decision, the outcome and the fine. Just choose the relevant value form the drop-down options. This allows us to e.g. later compare fined or find cases where a DPA has upheld complaints or fined controllers on certain issues.

Date Decided or Date Published

Whenever possible, add the "date decided" in the box.
If there is no information about the date a case was decided, you can at least add the data a case was published, or the relevant source was published.

Parties

Some cases say who the parties were. If so, you should add the name. You may also add the URL of the party, as this can help readers to understand the context or type of controller better. When the parties are abbreviated (e.g. "A versus B") you can add "A" and "B" as names.

Original Source

You can add one or more sources for the decision. Choose the most official version and ideally a PDF (easier to auto-translate). If you are not sure, you can add multiple sources.

Name: (Short) name of the source (e.g. "BAILII" for the British and Irish Legal Information Institute)
Language: The language of the original source
URL: The link to the original source

Appeals & Reference Information

Lower Decision

Was this an appeal? Choose yes, if this case was an appeal from a lower court or from any other decision.
Original Decision: If this was an appeal, add the details (Court, Case Number or Name and Link) as described above.

Higher Decision

Appeal Status: Choose the appeal status from the drop down. Choose "unknown" if there is no clear indication yet.
Superior Decision: If there is (already) a superior decision, add the details (Court, Case Number or Name and Link) as described above.

Reference Information

Reference: Only when you choose to summarize a CJEU decision, you can add the details on the referring court and the case of that court.

Note: If there is some form of national reference, appeal within a body (e.g. an appeals board) always treat this an an appeal between two bodies and explain the procedure under the national law in the case description.

Case Summary

The main text you should write is the actual case summary. It has three mandatory elements (facts, holding and short summary) and the option to add a comment. We also try to add a machine translation of the whole decision so that readers that are more interested can verify your summary and get more details.

Facts

The facts should be a short summary of the factual background of the case.

Some general rules:

Focus on the factual elements that are necessary to understand the case and the holding. Irrelevant facts can be omitted.
Try to be very detailed on the relevant details (for example the exact wording of a consent clause that was disputed) but skip irrelevant parts.
Ensure that the facts are summarized in a way that people from other countries can understand them (for example explain that "MegaDB Limited" is a data broker even when most readers in your jurisdiction may know that.

Holding

The holding is the "legal principle to be drawn from the decision". It is the rational for the decision on the core dispute of the case. In many decisions there may be multiple holdings or connected holdings.

A simple example for a holding could be:

"The Court held that consent is not informed (Article 4(11) GDPR), when a data subject did not know about the specific recipients."
"The DPA held that even the probability of political affiliations constitutes data revealing political opinions under Article 9(1) GDPR."

Try to avoid texts like the following:

"The DPA held that the GDPR was violated." - This does not tell the reader what provision which provision was violated.
"The consent was not valid" - This does not tell the reader why it was invalid.

Short Summary

The short summary is used for two purposes: (1) It is shown on the top of the page, to allow readers to quickly determine if the case is relevant and (2) it is used for promoting your summary (e.g. on social media). You can check the last summaries as a short text in videos on our @GDPRhub twitter account.

Therefore the short summary should follow these guidelines:

They should be 100 to 250 characters (as long as a tweet). You may go over that limit if absolutely necessary.
Highlight the core holding (like "probability of political affiliation falls under Article 9 GDPR")
Highlight fines and other crucial outcomes.

Try to avoid the following:

General statements like (like "X violated the GDPR") as this gives readers very little information. Focus on the main "take away" that you identified in the holding.
Company names (like "Creditinfo Lánstrausti hf.") unless the company is generally known in Europe (like "Amazon"). Just say "a controller" (when the type of company is irrelevant) or "a credit ranking agency" (specific type of company).
You do not need to highlight the Country.

Comment

Especially when a ruling is questionable, at odds with other decision or plainly against the law, you should note that in the comments to put the decision into context for the reader. You may also refer and link to other cases here and give the reader extra context or alternative views. This section also allows you to express your own view and criticize the decision.

Raw Text of Decision

In some cases we can automatically recognize the text of the original decision (PDFs and some databases). If this is not possible, we kindly ask you to copy/paste the text of the decision into this box. Our system will then translate the decision and display an English machine translation at the bottom of the case summary.

Name me!

Some of our contributes want to be named on GDPRhub and in the GDPRtoday newsletter. You can check the box in the form any add your name (or nickname) to be shown in the case summary (bottom of the table on the right) and in the GDPRtoday newsletter.

Note: The GDPRhub wiki will always show the user name or IP address of any editor. If you do not want to edit the wiki anonymously for the public (see GDPRhub:Privacy policy for details of what the system stores internally) create an account any use a random user name.

Submit and Review Your Summary

Once you have submitted your summary, you will be redirected to the final Article.

You can use the normal mediawiki functions to edit and change your decision, if you are not happy with the result.

Thank you for your support! ❤️