Data Protection Moot Court 2023 is over and here is how it went

by Klaudia Kwiatkowska

The DPMC in Short
In 2023, the third edition of the Data Protection Moot Court (DPMC) took place. The DPMC is a competition for law students and recent graduates who participate in a fictional procedure before a supervisory authority within the meaning of Articles 4(21) and 51 of the General Data Protection Regulation (GDPR). The goal of the DPMC is to cultivate interest in data protection law and serve as an additional educational tool. The competition challenges the participants to engage in research of legal standards, develop arguments and articulate legal reasoning in their assigned roles.

The DPMC was created by Mariana Rissetto and Marie-Catherine Wagner from the Department of Innovation and Digitalisation in Law at the University of Vienna, Marco Blocher from noyb and Martin Baumann. They brought together their work experience and passion for data protection to create an exciting opportunity for students and graduates wishing to pursue a career in this field. What started in 2021 as a moot court only for students from Austrian law schools has since become an international event. Turns out that not only students from the European Union (EU) are interested in improving their knowledge on the GDPR – this can be attested by the large number of participants from different corners of the world, including Brazil, United States, United Arab Emirates and Azerbaijan. Together with the competition grew the DPMC team. Last edition was organized by Mariana, Marie-Catherine and Marco joined by Paul Reisinger (OLG Wien), Klaudia Kwiatkowska (Department of Innovation and Digitalisation in Law, University of Vienna) and Léa Caner (University of Edinburgh).

The Set-up and the Rules of the Competition
The DPMC is conducted fully in English and takes place online. This allows students and graduates from all around the world to sign up and practice their GDPR knowledge as well as other legal skills. Remote participation keeps the costs for participants to a minimum and is more environmentally friendly and accessible. The DPMC has a written and oral phase. The teams act as legal representatives of either the data subject or the controller of a fictional case scenario. Depending on the team assignment, the written part consists of writing a complaint to a supervisory authority (data subject teams) or a reply to the complaint (controller teams). In the next step, the respective data subject and controller teams participate in an oral hearing where they present their legal arguments before a jury. The jury members are data protection law experts from legal practice, academia, civil society organizations and the Austrian data protection authority. The rules and procedure are governed by the Rule Book which is updated every year and sets out the criteria for acceptance, written and oral contributions, as well as grading criteria for juries, among others. 

The 2023 Edition
For the 2023 edition of the DPMC, participants could apply in teams of three and bring their own coach. The competition took place between September and December 2023. In total, there were 36 participants (in 12 teams) from 10 countries and different universities who took part in the moot court. In an introductory meeting, the teams were assigned their roles – either data subject or controller. The case that the teams were presented with tackled, among others, automated decision-making, and lawfulness of processing. In the next weeks, the teams were working on their written submissions in order to compete in the oral hearings in December. The finale hearing took place on 18 December 2023. After an excellent oral hearing, involving opening statements, questions by the grand jury and a rebuttal, the winning team was selected. 
Participants of the 2023 edition of the DPMC showed remarkable creativity in solving the case and navigating complex issues surrounding data protection. They presented detailed knowledge of the GDPR as well as related case law and other upcoming EU legal instruments, such as the AI Act.

The winners
Although the performance level was overall high, the jury managed to select those who did outstandingly well throughout the written and oral phases of the moot court. The Best Team Award went to three students from the Ukrainian Catholic University, representing the controller. The award for the Best Written Submission went to participants from Lund University, Baku State University and Université Lumière Lyon-2 who were one of the teams represented the data subject. Based on the scores from the oral hearing round, a student from the Tallinn University of Technology won the Best Speaker Award. For their excellent performances, the winners were awarded prizes, which include subscriptions to data protection law journals and privacy training courses. DPMC 2023 was sponsored by the University of Vienna Faculty of Law, Fieldfisher, TWP Rechtsanwälte and Eyecoon Privacy Training Center Vienna.

The organizing team would like to thank the sponsors and jury members for their financial and in-kind contributions to this endeavour. Also, we congratulate the teams who did a great job in dealing complex GDPR issues. Thank you! 

Next edition
The organizers of the DPMC are already working on preparing the next edition. More information and updates can be found on the official DPMC website and LinkedIn account. 

Website: https://dataprotectionmoot.univie.ac.at/
LinkedIn: https://www.linkedin.com/company/data-protection-moot-court/