This is a draft version. Source: adapted notably from the Wikimedia Foundation Governance Wiki, https://foundation.wikimedia.org/wiki/Legal:Requests_for_user_information_procedures_and_guidelines (CC BY-SA 4.0), with changes, including a first adaptation from United States law to Swiss law. Status: proposal, to be adopted. See the detailed disclaimer.

In simple words: sometimes the police, a court or a lawyer asks the platform to reveal private information about a user. This page explains what such a request would need to contain, that very little private information is kept in the first place, that every request would be checked against Swiss law, and that the affected user would be notified whenever possible so they can defend themselves. Nothing here is in force yet: it is a proposal, to be adopted.

Requests for user information procedures and guidelines

These guidelines are intended for parties (such as law enforcement, government agencies or administrative bodies, or civil litigants) who wish to request disclosure of nonpublic information regarding WikiDeal users or their content or activities on the WikiDeal Markets and Portals (collectively, "the Platform"). These guidelines are also made available for WikiDeal users who are curious about the intended internal policies and procedures for dealing with requests for nonpublic user information.

Note on applicable law: the source document that inspired this proposal is built on United States law. The Ynternet.org Foundation ("the Foundation"), which hosts and incubates WikiDeal, is a non-profit foundation under Swiss law, headquartered in Geneva. This first adaptation therefore refers to Swiss law. Every point of this page, and in particular the list of legally valid request forms, is to be reviewed by a qualified Swiss lawyer before adoption.

About the Foundation and the Platform

The Foundation is the non-profit organization that intends to host the Platform and to encourage the development of fair contracts based on freely licensed contract templates and documentation. The Markets and Portals are open and collaborative wiki-based spaces that may be accessed and contributed to by people around the world.

Our values and what they mean for your request

Freedom of expression and access to information are core values of the WikiDeal proposal. User privacy, and sometimes anonymity, is necessary to give life to these values and to protect those that would trust the Platform with their personal information. This means:

Requesting parties would be expected to meet the requirements below (including all legal requirements) when making a request for any nonpublic user information.
Every request received would be examined to ensure its compliance with the requirements below and with the law applicable to the Foundation (which usually means Swiss law, but may include other countries' law where jurisdiction over the Foundation is established).
Absent a credible and imminent threat to life or limb (that is, death or serious bodily injury), the Foundation intends to refuse to disclose nonpublic user information if it believes that it is not legally required to disclose the requested information.
When possible, the Foundation intends to notify users of a request concerning them, so that they have the opportunity to legally challenge it if they do not believe the request is legally valid.

Types of nonpublic information the Foundation may have

Due to the inherent transparency of wikis, most information on the Platform would be public by design. For example, the published content of contract templates, the state of a published contract (signed, completed, in dispute) and the history of edits on public pages would be publicly available. You would not need an account to view this information.

The Foundation intends to collect very little nonpublic information (if any) that could be used to identify its users offline, and intends to retain that information for a limited amount of time. Some of the limited nonpublic information would be collected automatically (such as the IP address of the user's device or their proxy server and user agent information), while other nonpublic information would be optionally provided by the user (such as an email address). A specific category of nonpublic information on this Platform is the private variables of contracts (names, amounts, addresses and similar details entered in a contract): they are private by default and are treated as nonpublic information. Regardless, nonpublic information that includes personally identifying information about any particular user would be kept for a short amount of time. You can learn more about the types of information that would be collected, and how long they would be retained, in the Privacy policy (first draft, under review) and the Data retention guidelines.

Please note that users would be able to use the Platform pseudonymously for its public spaces. Even a user who has registered an account would not be required to provide personally identifying information such as a real name, physical address, date of birth, or phone number for those spaces. If they have provided any of this information, the information held may not correspond to a real person, as the user may have provided fake or pseudonymous information. (The identification requirements applicable to the conclusion of contracts between users are a separate topic, addressed by the Terms of Use and the policies of each Market.)

What would be required from you

The Foundation would only disclose nonpublic user information in accordance with the Terms of Use, the Privacy policy and applicable law, notably the Swiss Federal Act on Data Protection (FADP) and the applicable rules of Swiss civil and criminal procedure.

If you choose to submit a request, it would have to meet the following requirements:

Reasonableness. It must be reasonable for the Foundation to locate and retrieve the information you request. Requests that would be unreasonably burdensome to execute would not be accepted.
Specificity. Your request must be specific as to what particular types of information you are requesting and where it may be located. It must also at least specify the username of the party you are seeking information about (please note that usernames are case-sensitive). General inquiries, requests based solely on real names, or vague or overbroad requests would not be accepted. Please ensure that the requested information is not available through the public interfaces of the Platform.
Relevance. Your request must specify the relevance of the information you are requesting to the investigation or case your request pertains to.
Contact information. You must include your name; your mailing address; your firm or agency's name (unless you are representing only yourself); your direct phone number; your valid firm- or agency-issued email address (unless you are representing only yourself); and, if you represent a law enforcement, governmental, or administrative agency, your badge or identification number.
Timeline. You must include a specific deadline by which the Foundation must respond to your request. With the exception of emergency requests (described below), please bear in mind that a minimum waiting period of 30 business days would generally be needed, so that users can be properly notified and have a reasonable period of time to contest your request if they choose to do so.
Legal validity and enforceability under applicable law. Your request must be legally valid and enforceable under the law applicable to the Foundation, which usually means Swiss law. Subject to review by a qualified Swiss lawyer, this would notably include:
- an order or decision directed to the Foundation, issued by a Swiss court or authority of competent jurisdiction;
- a production or disclosure order issued by a competent Swiss prosecution authority in connection with an official criminal investigation, under the Swiss Criminal Procedure Code;
- a request in Swiss civil proceedings, valid and enforceable under the Swiss Civil Procedure Code;
- for requests originating outside of Switzerland: a request transmitted through the applicable channels of international mutual legal assistance, such as the Swiss Federal Act on International Mutual Assistance in Criminal Matters (IMAC) or an applicable mutual legal assistance treaty, or, in civil matters, the applicable instruments such as the Hague Conventions. Foreign orders that have not been transmitted through these channels are generally not directly enforceable in Switzerland, and disclosing data directly to foreign authorities may even be prohibited under Swiss law (notably Article 271 of the Swiss Criminal Code): such requests would be declined and redirected to the mutual legal assistance channels. The precise handling of each category of foreign request is to be reviewed under Swiss law.

Absent a credible and imminent threat to life or limb (that is, death or serious bodily injury), the Foundation intends to refuse to disclose nonpublic user information if it believes that it is not legally required to disclose the requested information.

Emergency requests

If you believe there is a credible and imminent threat to life or limb (that is, death or serious bodily injury) to any person, and that the Foundation may have information necessary to prevent the threat from being fulfilled, you may request an emergency disclosure. The precise legal basis for voluntary emergency disclosures under Swiss law (notably the justification grounds of the Swiss Federal Act on Data Protection) is to be reviewed under Swiss law.

In addition to the requirements set forth above, emergency requests should also include (to the extent you are legally permitted to disclose) the following:

a subject line including the phrase "EMERGENCY DISCLOSURE REQUEST";
the specific information you are requesting and how it is necessary to prevent the threat from being carried out;
the identity of the individual(s) or group(s) of individuals under threat;
the nature of the emergency;
why you believe it is imminent;
links to specific content containing relevant information (if any);
any other information you believe will aid in the evaluation of your request; and
a declaration, made in good faith, that to the best of your knowledge the information you have submitted is true and accurate. (Swiss law does not provide the United States mechanism of a declaration "under penalty of perjury"; false statements to authorities and abuse of legal process remain punishable under Swiss law.)

The decision to grant a request for emergency disclosure would lie solely with the Foundation. After evaluation of your request for emergency disclosure, if there is a good faith belief that there is a credible and imminent threat to life or limb, the information necessary to prevent such harm could be provided (if the Foundation has it and can recover it).

If you have an emergency request, please email it to info@wikideal.net with the subject line indicated above, to ensure speedy processing.

Child safety

Any discovered instances believed to be child sexual abuse material, including information brought to attention through requests for nonpublic user information, would be reported to the competent authorities, in line with the proposed policy on combating online child exploitation. If your request has already been reported to a competent authority or relates to a case being handled by one, please include the case or report information in your request.

How to contact us

You may send your request via email to info@wikideal.net.

Please provide a clear and concise subject line, such as "DISCLOSURE REQUEST - [CASE NAME] - DEADLINE: [DATE]". If you are sending an emergency request (as defined above), please include "EMERGENCY DISCLOSURE REQUEST" in the subject line.

A postal service address for formal legal requests is intended to be published at adoption. While requests would be accepted by these methods for convenience, neither the Foundation nor its users would waive any legal rights or defenses based on this accommodation. If you are seeking testimony from the Foundation or its staff, officers, contractors, or board members, the applicable rules of Swiss procedure on the examination of witnesses would apply; such requests cannot be served by simple email.

Notifying users of your request

The Foundation believes in transparency about when requests are made for users' nonpublic information. This means that the user(s) affected by your request would be notified of it, and that the receipt and resolution of requests would be reported in aggregate form in a transparency report.

When a request is received, the affected user(s) would be notified, with a copy of the request, at least 10 calendar days before the requested information is disclosed, provided that (1) contact information is available for the affected user(s); (2) disclosing the request will not create or increase a credible threat to life, limb or other serious crime; and (3) the Foundation is not otherwise prohibited by law or by an order of a court or authority of competent jurisdiction from doing so. If information about a request cannot be provided to affected users for one of these reasons, it would be provided to the affected users for whom contact information is available within a reasonable period after the threat or legal restriction has ended.

If you are requesting disclosure of nonpublic user information that you believe requires confidentiality, please provide a legally valid and enforceable confidentiality or sealing order from a court or authority of competent jurisdiction, or identify the legal provision that prohibits notification. Please note that notice of such an order or provision must be received before the date the Foundation notifies the user, for confidentiality to be considered.

Upon notification, the affected user(s) would generally be given at least 10 calendar days before the requested information is disclosed (assuming the request is found to be otherwise valid), during which time the affected user(s) may attempt to legally challenge the request. If, prior to the disclosure, the Foundation receives notice from the affected user(s) that they intend to challenge the request, no information would be delivered until that legal challenge is resolved.

The Foundation's right to challenge your request

The Foundation would reserve the right to challenge the scope or validity of your request, on behalf of any affected user, whether or not the affected user chooses to pursue their own legal challenge.

Cost reimbursement

The Foundation would reserve the right to seek reasonable reimbursement of the costs of responding to your request, where permitted by applicable law.

Policies/en/Requests-for-User-Information