Nowak v Data Protection Commissioner
An exam candidate’s written answers, and the examiner’s comments on them, are the personal data of the candidate.
The Irish Supreme Court referred a question to the Court arising out of proceedings between Mr Nowak and the Irish Data Protection Commissioner. Mr Nowak was seeking to obtain his examination scripts from professional examinations which he had sat unsuccessfully.
The Court was required to consider whether the information recorded in answers given by a candidate in their examination script and the comments of the examiner were personal data under Directive 95/46. Endorsing the conclusions reached by the Advocate General, the CJEU determined they were. Mr Nowak’s arguments were endorsed by the Commission and five of the member states. Neither the fact that the answers were handwritten nor the fact that it was an ‘open book’ exam were determinative.
The Court concluded that the written answers given by the candidate constituted information that ‘relates to’ the candidate. The fact that the information which permitted the candidate to be identified was not in the possession of a single person did not prevent the candidate from being ‘identifiable’ for the purpose of the Directive.
So far as the candidate’s answers were concerned, the Court’s analysis is summarised as follows:
- Content – ‘Reflects the extent of the candidate’s knowledge and competence in a given field and, in some cases, his intellect, thought processes, and judgment. In the case of a handwritten script, the answers contain, in addition, information as to his handwriting.’ (our emphasis)
- Purpose – ‘To evaluate the candidate’s professional abilities and his suitability to practice the profession concerned.’
- Effect – ‘The use of that information… is liable to have an effect on his or her rights and interests, in that it may determine or influence, for example, the chance of entering the profession aspired to or of obtaining the post sought.’
Applying the same three considerations the Court determined that the examiner’s comments also constituted the personal data of the candidate. The Court noted that the analysis was not called into question by the fact that the examiner’s comments also constituted the personal data of the examiner.
The consequences – Access and rectification
The Court also noted that the conclusion that the answers and the examiner’s comments were personal data could not be affected by the fact that “the consequences of that classification is, in principle that the candidate has rights of access and rectification.”
The Court was quick to make the point that ‘…the right of rectification … cannot enable a candidate to ‘correct’, a posteriori, answers that are ‘incorrect’.’ It noted that:
‘…assessment of whether personal data is accurate and complete must be made in the light of the purpose for which that data was collected. That purpose consists, as far as the answers submitted by an examination candidate are concerned, in being able to evaluate the level of knowledge and competence of that candidate at the time of the examination. That level is revealed precisely by any errors in those answers. Consequently, such errors do not represent inaccuracy, within the meaning of Directive 95/46, which would give rise to a right of rectification under Article 12(b) of that directive.’
The case illustrates the reach of the subject access rights whilst also illustrating the way in which a single document can contain a variety of categories of data.
In this case the examination script contained three different categories of data:
- The personal data of the candidate (the answers written)
- Mixed personal data of the examiner and the candidate (the examiner’s comments)
- Data which was not personal data (the exam questions)
The candidate’s right to access his personal data is not absolute. The directive does not give the candidate any right to access the exam questions. A decision with respect to disclosure of the examiner’s comments would require a balancing exercise which took account of the examiner’s rights.
The analysis adopted by the CJEU is unlikely to lead to a different outcome under the provisions of the GDPR which comes into force in May 2018.
 provided for in Article 12(b) of Directive 95/46
This briefing is for guidance purposes only. RadcliffesLeBrasseur accepts no responsibility or liability whatsoever for any action taken or not taken in relation to this note and recommends that appropriate legal advice be taken having regard to a client's own particular circumstances.