The Supreme Court has asked the Court of Justice of the European Union (CJEU) to determine whether an exam paper can be considered as personal data. The question arises out of an attempt by a student at the Institute of Chartered Accountants Ireland (CAI), Peter Nowak, to access his exam paper under the Data Protection Acts.
In 2009, after failing an exam, Nowak sought to challenge the result and submitted a data access request to CAI seeking all personal data. CAI released 17 items, but not his exam script, stating that it does not constitute personal data and is therefore not within the scope of the Data Protection Acts.
Nowak made a complaint to the Data Protection Commissioner (DPC), who advised that exam scripts “would not generally constitute personal data“. In refusing to investigate further, the DPC held that Nowak’s complaint was “frivolous and vexatious“. It is interesting to note that UK legislation expressly excludes exam scripts from the concept of personal data, but there is no similar Irish provision.
Nowak appealed the decision of the DPC to the Circuit and High Courts, arguing that his exam script does amount to personal data as it contains comments and marks of the examiner and his biometric data in the form of handwriting. Furthermore, he claimed that if data protection legislation treats his exam results as personal data, then it follows that the “raw material” from which the exam results are derived is also personal data. In response, the DPC stated that the exam script merely contains answers to accountancy questions written during an open book exam and as such does not contain any personal information. Both the Circuit and High Courts agreed with the DPC that an exam script does not constitute personal data.
Faced with this complex issue and no clear parameters within which to find a solution, the Supreme Court decided to refer the question to the CJEU. Specifically the CJEU will be asked to address the relevant factors and their respective weight for determining whether an exam script is personal data.
A second issue which runs through this line of litigation is whether there is a right to appeal a DPC decision to not investigate an alleged breach of data protection legislation. Both the Circuit and High Courts held that there is not. However, the Supreme Court found that such a right of appeal does exist.
This case will be an important determinative factor for the scope of the definition of personal data, which to date has been given a very broad interpretation, in particular in the opinion of the Article 29 Working Party.
Follow us on Twitter @WFIDEA
Contributed by Leo Moore
