In December 2017, the CJEU gave a ruling which has widespread applicability to examination appeals in schools and in colleges across the EU.
Mr. Nowak was hired by PWC in June 2006 and had signed an open-ended employment contract with the firm to work as a trainee accountant in the business advisory services department. It was a term of his employment that he successfully complete three examinations required to become a fellow member with Chartered Accountants Ireland (CAI). Having passed two of those exams, Mr. Nowak had failed the exam for Strategic Finance and Management Accounting, which was an open-book exam.
He repeatedly sat this exam four times and was unsuccessful at each and every subsequent attempt. Mr. Nowak attempted to challenge the results and this was rejected by the Irish Institute of Chartered Accountants, which had set the examinations. In May 2010, Mr. Nowak submitted a data-access request pursuant to Section 4 of Irish Data Protection Acts, 1988 and 2003 requesting all his personal data held by CAI.
Section 4 (1) of the Data Protection Act, 1988 states (a) Subject to the provisions of this Act, an individual shall, if he so requests a data controller in writing
(i) be informed by the data controller whether the data kept by him include personal data relating to the individual, and
(ii) be supplied by the data controller with a copy of the information constituting any such data,
It should be noted that there is no such provision contained in the Data Protection Act, 2018 and that Article 15 of the General Data Protection Regulation must be relied upon at present.
Where the CAI had complied with the request in June 2010, they refused to disclose his exam scripts to him citing that the scripts did not constitute ‘personal data’ within the meaning of the Data Protection Act, 1988 (as amended)
Despite making a complaint to the Office of the Data Protection Commissioner (now the Data Protection Commission) the Data Protection Commissioner identified no contravention of the relevant Acts.
Mr. Nowak in exercising the domestic legislation appealed the decision to the Circuit Court, which, in a written judgment, also found no basis for his appeal and rejected his appeal against the Data Protection Commissioner. Mr. Nowak’s further appeals were dismissed by the High Court and the Court of Appeal (the latter in a an ex tempore judgment).
Nevertheless, Mr. Novak applied for and obtained leave to appeal to the Supreme Court. Although minded to uphold the views of all three courts below that examination scripts do nto contain personal data, , the Supreme Court recognised that the issue was not clear and made a reference to the CJEU seeking clarification whether an examination script can constitute “personal data” within the meaning of Directive 95/46/EC (the “Directive”)
Article 2(a) of the Directive defines personal data as meaning ‘any information relating to an identified or identifiable natural person’. Under the same provision, ‘an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;’
CJEU Ruling
The CJEU held that that written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data under Article 2 of the Directive.
The Court rejected (paragraph 30) the Data Protection Commissioner's submission as to the relevance of whether an examiner can or cannot identify the candidate at the time when he/she is correcting and marking the examination script. It referred to Advocate General Kokott in her opinion at point 26 where she had differentiate between exams questions and that of a survey questionnaire, where the answers of a survey, unlike the answers in an examination, are understood to remain anonymous.
Recalling that the concept of 'personal data' in EU law is wide and varied, the CJEU focused on whether written answers provided by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute information relating to that candidate, as required by the definition of 'personal data' in Article 2(a) of the Directive. It accepted Mr Nowak's argument, which was supported by most of the Member States (save Ireland and Poland) and the Commission, that written answers submitted by a candidate at a professional examination, as well as the comments of the examiner with respect thereto, constitute information that is linked to him or her as a person (see paragraphs 30 to 46)
.
In this regard, the CJEU stated at paragraph 49:
“Accordingly, if information relating to a candidate, contained in his or her answers submitted at a professional examination and in the comments made by the examiner with respect to those answers, were not to be classified as ‘personal data’, that would have the effect of entirely excluding that information from the obligation to comply not only with the principles and safeguards that must be observed in the area of personal data protection, and, in particular, the principles relating to the quality of such data and the criteria for making data processing legitimate, established in Articles 6 and 7 of Directive 95/46, but also with the rights of access, rectification and objection of the data subject, provided for in Articles 12 and 14 of that directive, and with the supervision exercised by the supervisory authority under Article 28 of that directive.”
The Court further stated that, where the data subject is entitled to erasure of their data under the Directive, that right does not extend to affording the exam candidate the right to correct a posteriori an answer or to remove an answer from such an exam. The CJEU recalled, however, that "the protection of the fundamental right to respect for private life means, inter alia, that any individual may be certain that the personal data relating to him is correct and that it is processed in a lawful manner" (at paragraph 57)
And at paragraph 62, the CJEU concluded:
“In the light of all the foregoing, the answer to the questions referred is that Article 2(a) of Directive 95/46 must be interpreted as meaning that, in circumstances such as those of the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data, within the meaning of that provision”.
Conclusion
Despite the fact that the judgment in C-434/16 Nowak was delivered pre-GDPR, the principles under consideration in Nowak remain broadly the same under the new GDPR regime. This is, in effect, referenced by the CJEU in paragraph 59 of its judgment. Educational institutions should be cognisant of their obligations, in light of Nowak, in considering any student data access requests for examinations scripts.