The above question has recently been referred by the Irish Supreme Court to the Court of Justice of the European Union (the “CJEU”) for clarification.
The context to this referral arose in circumstances where a student of The Institute of Chartered Accountants Ireland (the “CAI”), Mr Nowak sought a copy of his exam script from the CAI, via a subject access request.
Pursuant to the Data Protection Acts 1988-2003 (“the Acts”), a “subject access request” permits an individual to request a copy of their personal data from an organisation. What exactly an individual will be entitled to in these circumstances, depends on which information held by that organisation could constitute “personal data”.
Under the Acts, personal data is essentially data from which a person is capable of being identified. In that regard, Mr Nowak’s position is that his exam script constitutes personal data as it contains his biometric data in the form of handwriting. However, when this matter was initially referred to the Office of the Data Protection Commissioner (the “ODPC”) and then subsequently to the Circuit and High Courts, all were of the view that exam scripts do not contain any information from which an individual is capable of being identified and as such, cannot amount to personal data.
This matter now awaits further clarification from the CJEU as to whether the scope of what is understood to be “personal data” will be broadened to include exam scripts. If the CJEU agrees with Mr Nowak’s view, this will have implications for educational bodies and institutions, which will thereafter be under an obligation to furnish candidates with copies of their exam scripts, if requested to do so pursuant to a subject access request. We will issue a further update following clarification from the CJEU.