In a landmark decision the European Court of Justice (ECJ) has ruled that exam scripts constitute personal data. As we previously reported, the Irish Supreme Court had asked the ECJ to determine whether an exam paper was personal data, a question which arose out of a trainee accountant’s attempt to access his exam paper under the Irish Data Protection Acts (DPA).
The EU Data Protection Directive, implemented in Ireland by the DPA, defines personal data as “any information relating to an identified or identifiable natural person”. Under the DPA, individuals have various rights in relation to their personal data, including rights to access it and rectify it in certain circumstances, and organisations which control that data must enable individuals to exercise these rights.
In its ruling, the ECJ said that a candidate sitting a professional examination is a natural person capable of identification either directly by name or indirectly by identification number from the exam script. The question of whether or not an examiner can identify the candidate at the time when the exam script is being marked is irrelevant.
The ECJ further stated that the phrase “any information” in the definition of personal data reflects the EU’s intention that the concept should be interpreted broadly. Such an interpretation would not only include information which is sensitive and private but would also extend to objective and subjective opinions and assessments, provided that these were linked to an individual by reason of their content, purpose or effect. The ECJ found that written examinations submitted by a candidate at a professional examination would fall within this expansive interpretation.
As a result, the ECJ found that candidates could potentially exercise their personal data rights in relation to their written answers in a professional examination and also to the examiner’s comments regarding those answers. However, the ECJ pointed out that these rights would not extend to the examination questions themselves as they would not constitute personal data. Further, there would be practical limitations to the exercise of such rights, for instance the right of rectification might apply to situations where examinations scripts had been mixed-up, but would not enable a candidate to retroactively correct incorrect answers.
The decision is a reminder of the sweeping nature of data protection legislation. It is particularly relevant in light of the GDPR which will apply across the EU from 25 May 2018 and which provides for top-level fines of up to €20m or 4% of total worldwide annual turnover in circumstances where organisations breach individuals’ personal data rights.
For a more detailed analysis and expert insights on the incoming GDPR, we invite you to register here for PrivacySource, William Fry’s dedicated GDPR website.
Contributed by: Barry Connolly and David Cullen
Follow us on Twitter @WFIDEA and @WilliamFryLaw
