In the case of Mr. Nowak v. the Irish Data Protection Commissioner (IDPC), the Irish Supreme Court referred to the European Court of Justice (CoJ) for a preliminary ruling with regard to the question of whether a handwritten examination script constitutes personal data within the meaning of Article 2(a) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive). Mr. Nowak was a trainee accountant who had successfully undertaken a number of examinations set by the Institute of Chartered Accountants of Ireland (CAI), except for one open book exam. After repeated attempts, Mr. Nowak decided to submit a data access request under Irish data protection legislation seeking all personal data held by the CAI. The CAI released various documents, but declined to release his examination script on the basis that it had been advised by the IDPC that the script did not constitute personal data. Thus, Mr. Nowak brought an action against this decision before the Irish courts, who referred to the CoJ. In reaching its conclusion, the Advocate General (AG) discussed various considerations:
- An examination script constitutes a documentary record that shows that the individual has taken part in a given examination, and shows how they performed. Consequently, an examination script incorporates information about the candidate, and is in that sense a collection of personal data.
- That personal connection is also reflected in the fact that individuals often include their most important examination results in their CVs, which reflects their personal performance.
- A candidate does not have to accept that their script be disclosed to third parties or published without their permission, again reflecting the personal connection.
- Moreover, answers that are handwritten (as is the case at subject) contain additional information about the examination candidate. A handwritten sample could for example be used as evidence to determine whether another text was also written in the examination candidate’s writing. It may thus provide indications of the identity of the author of the script, i.e. lead to the identity of the data subject.
In conclusion, the AG is of the opinion that a handwritten examination script capable of being ascribed to an examination candidate constitutes personal data within the meaning of Article 2(a) of the Directive. It is worth noting that the AG pointed out that even though the Directive will shortly be repealed by the General Data Protection Regulation (GDPR), which will enter into force on May 25, 2018, the latter will not affect the concept of personal data. Therefore, the opinion of the AG is also of importance for the future application of the EU’s data protection legislation. A ruling by the CoJ is expected to take place in the autumn of this year, after which the case will be referred back to the Irish Supreme Court. For the full text of the opinion, click here.