In December 2017 the Second Chamber of the Court of Justice reached a decision in the well-known case of Peter Nowak against the Data Protection Commissioner. The case started with a request for a preliminary ruling under Article 267 TFEU from the Supreme Court in Ireland. The key issue was the uncertainty of whether the result of an exam may or may not be considered a certain type of personal data.
To be specific, Mr Nowak was a trainee accountant who attempted to pass all necessary Irish accountancy exams. He passed all necessary entry level and three second level examinations prescribed by the CAI – Irish Institute of Chartered Accountants. He, however, failed the exam for Strategic Finance and Management Accounting, which was an open-book exam. As he was repeatedly (four times) unsuccessful in passing this exam he tried to challenge the results. Having been rejected, in May 2010 he submitted a data access request according to Section 4 of Irish Data Protection legislation and asked the Institute of Chartered Accountants for all his personal data held by CAI.
CAI provided him with 17 various documents in June 2010 but refused to release his examination script because it allegedly did not contain any personal data. Mr Nowak repeatedly communicated with the Data Protection Commissioner and tried to obtain the examination script. The Commissioner stated that these documents, in general, do not constitute personal data. Further communication between Mr Nowak and the Commissioner soon afterwards ceased, as the Commissioner informed Mr Nowak that there was no substantive contravention of the data protection legislation and that there would be no further investigation of the complaint. Every other filing of Mr Nowak towards the Commissioner in this matter was set aside as frivolous.
Subsequently, Mr Nowak brought an action against those decisions before the Circuit Court. The opinion of both the Circuit Court and the High Court (being the court for appeal) was the same – the examination script does not contain any personal data. The case ended up in the Irish Supreme Court, which later referred to the Court of Justice with a question for a preliminary ruling if, within the meaning of Directive 95/46, an examination script (i.e. information recorded in/as answers given by a candidate during a professional examination) could involve personal data.
It is clear, that Article 2(a) of the Directive 95/46 defines personal data as meaning ‘any information relating to an identified or identifiable natural person’. Under the same provision, ‘an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’.
Mr Nowak, the Czech, Greek, Hungarian, Austrian and Portuguese governments and also the European Commission stated, that written answers submitted by a candidate at a professional examination constitute information that is linked to him or her as a person. Firstly, the content of those answers reflects the extent of the candidate’s knowledge and competence in a given field and, in some cases, his intellect, thought processes and judgment. In the case of a handwritten script, the answers contain also the information about his handwriting. Secondly, the purpose of collecting those answers is to evaluate the candidate’s professional abilities and his suitability to practice the profession concerned. Finally, because the use of that information may result in the candidate’s success or failure at the examination concerned, the information has an effect on his or her rights and interests and may determine or influence also the chance of entering the profession aspired to or of obtaining the sought position.
As stated by the Advocate General in Section 24 of her Opinion, the aim of any examination is to determine and establish the individual performance of a specific person. In contrast, for example, a representative survey aims to obtain anonymous information, which is not related to any person.
Another observation made by the Court was that any individual must be allowed to verify that his personal data are correct and processed in a lawful manner. Therefore, his answers in the test and the examiner’s comments be disclosed for the review of, in particular, their accuracy.
On those grounds, the Court (Second Chamber) ruled:
“Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that, in circumstances such as those of the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data, within the meaning of that provision.”
To conclude, this decision is well-founded and helped to clarify the status of exam answers as personal data. As already mentioned, they indeed may have a huge impact on an individual´s life and career and reflect the individual performance of a specific person. This conclusion will be relevant even after 25 May 2018, when a significant overhaul of the privacy rules (GDPR) will come into force because its definition of personal data essentially remains intact.
On the other hand, this judgement further expands this definition of personal data, which is already extremely broad and significantly complicates the functioning of all public authorities and corporations processing such data. This may cause legal uncertainty due to (a) overlap with freedom of information laws applicable in may EU countries and personality rights in civil law jurisdictions or (b) privacy expectations and copyright of other affected persons, such as the examiner in this case.