Developments In EU Data Protection Law

Through Preliminary References from the Irish Supreme Court to the European Court of Justice

Following from the high-profile 2015 decision of the European Court of Justice (the “CJEU”) in the case of Schrems v The Data Protection Commissioner, the Irish Supreme Court has recently made another data protection-related preliminary reference to the CJEU in Nowak v The Data Protection Commissioner1.

Summary

This was an appeal to the Supreme Court concerning three issues:

Whether a decision of the Data Protection Commissioner (the “DPC”) that a complaint is frivolous or vexatious can be appealed to the Circuit Court under Section 26 of the Data Protection Acts 1988 and 2003 (the “Acts”); If so, what was the standard of appeal to be applied by the Circuit Court; and Whether the decision of the DPC that an examination script does not come within the definition of “personal data” under the Acts was justified. Briefly, in 2009 the Plaintiff failed an accountancy exam set by Chartered Accountants Ireland (“CAI”) and submitted a data access request seeking all “personal data” which CAI held in relation to him. In response to his request, CAI released certain data to the Plaintiff but did not release his exam script. The Plaintiff complained to the DPC, who declined to investigate the complaint on the basis that it was “frivolous or vexatious”.

Proceedings were then instituted by the Plaintiff against the DPC. The Plaintiff argued in particular that the exam was “personal data” as it was a handwritten exam which therefore contained biometric data. He also contended that if an exam result can be personal data, the “raw material” from which the results are derived must also be personal data.

The DPC argued that no appeal lies to the Circuit Court from a determination that a complaint is frivolous or vexatious because that is not a “decision” within the meaning of Section 26 of the Acts. Further, the DPC argued that this was an open book accountancy exam that would not contain any personal information which could possibly identify any exam candidate, and that there was no precedent of any other EU data protection body concluding that an exam script is personal data.

Decision

The Supreme Court found that a decision of the DPC that a complaint is frivolous or vexatious was subject to appeal under Section 26 of the Acts, and that the appeal should adopt the Orange Communications Ltd v. The Director of Telecommunications Regulation and...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT