The EU Court of Justice (CJEU) has ruled that a candidate’s exam script is ‘personal data’, as it constitutes information that is linked to him or her. The CJEU held that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in the Data Protection Directive 95/46/EC (the Directive) reflects the aim of the EU legislature to assign a wide scope to the concept, potentially encompassing all kinds of information provided that it ‘relates’ to the data subject. As the GDPR contains a similar definition of ‘personal data’ to that in the Directive, namely “any information relating to an identified or identifiable natural person”, the CJEU’s broad interpretation of the concept of personal data will continue to apply post-25 May 2018 when the GDPR comes into force.
Background – A recap
This case, Nowak v Data Protection Commissioner (20 December 2017) (C-434/16), arose as a result of the Institute of Chartered Accountants of Ireland (CAI) refusing a request by an accountancy student, Peter Nowak, for a copy of a script of his failed exam. The CAI concluded that the exam script did not contain ‘personal data’ and therefore did not fall within the scope of data protection law. Nowak submitted a formal complaint to the Irish Data Protection Commissioner (DPC), who also determined that the exam script was not personal data, and that the complaint was bound to fail as it was frivolous and vexatious.
Nowak appealed to Circuit Court, which upheld the DPC’s decision. Further appeals were made to the High Court and the Court of Appeal, which also deferred to the DPC’s judgment. At the Supreme Court, the DPC relied on the Opinion by the Advocate General in YS and Others (2014) (C-141/12 and C-372/12) that: “Only information relating to facts about an individual can be personal data. Except for the fact that it exists, a legal analysis is not such a fact. Thus, for example, a person’s address is personal data but an analysis of his domicile for legal purposes is not”. The Supreme Court sought a ruling from the CJEU as to whether the written answers provided by a candidate at an exam, and any examiner’s comments with respect to those answers, constitute personal data (see our discussion of the Supreme Court’s judgment here).
The CJEU held that written answers provided by a candidate and any comments made by the examiner with respect to those answers constitute information relating to that candidate, and are therefore ‘personal data’. The Court stated that to rule otherwise would have the effect of entirely excluding that information from the obligation to comply with the data protection principles and safeguards, and the rights of access, rectification and object of the data subject. The Court concluded, in particular, that:
- An exam candidate is a natural person who can be identified, either directly through his name, or indirectly through his identification number, these being located either on the exam script or cover sheet. It is of no relevance whether the examiner can identify the candidate at the time when he or she is correcting and marking the script.
- As held in Breyer (2016) (C-582/14) in order for information to be treated as ‘personal data’ there is no requirement that all the information enabling the identification of the data subject be in the hands of one person. It was undisputed that, in the event that the examiner did not know the identity of the candidate when he/she was marking the exam script, the CAI had the information needed to identify the candidate through his identification number.
- The use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in the Directive is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject. That condition is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person.
- The written answers submitted by a candidate at an exam constitute information that is linked to him or her as a person. The content of those answers reflects the extent of the candidate’s knowledge and competences in a given field, and in some cases, his intellect, thought processes, and judgment. The purpose of collecting those answers is to evaluate the candidate’s professional abilities and suitability to practice the profession concerned.
- The examiner’s comments also constitute information relating to the candidate, as they reflect the opinion or assessment of the examiner on the individual performance of the candidate in the exam, and on his or her knowledge and competencies in the field concerned.
This decision, once again, shows the CJEU’s broad interpretation of the concept of ‘personal data’. It serves as a warning to organisations of the expansive scope of data protection law, and to ensure they are prepared to comply with the stricter data protection rules set out in the GDPR.