Testing Times: Are Exam Scripts Personal Data? Irish Supreme Court Asks Europe To Decide

The Irish Supreme Court recently handed down a decision in the long-running case of Nowak v. Data Protection Commissioner [2016] IESC 18. The Supreme Court's decision, its first ever data protection ruling, means that the Court of Justice of the European Union ("CJEU") must now decide whether an exam candidate's script constitutes personal data.

Legal saga

Mr. Nowak's long-running legal battle has been heard by four separate rungs of the Irish courts system. It is now set to be heard on the European stage.

Mr. Nowak failed, on three separate occasions, one of the mandatory exams to become a chartered accountant. Mr. Nowak then submitted a request under Section 4 of the Irish Data Protection Acts 1988 and 2003 ("DPA") seeking all personal data held by the relevant examining body. That body declined to release his examination script on the basis that it did not constitute personal data within the meaning of the DPA.

Mr. Nowak contended that his examination script constitutes his personal data because:

it contains his handwriting, which he contends is biometric data; and it may contain markings and/or comments by the examiner. Mr. Nowak submitted a formal complaint to the Irish Data Protection Commissioner ("DPC"). He disputed the assertion that his examination script does not constitute personal data. The DPC refused to investigate the complaint under Section 10(1)(b)(i) of the DPA. The DPC was of the opinion that Mr. Nowak's complaint was "frivolous and vexatious".

Mr. Nowak appealed this decision to Ireland's Circuit Court. When the Circuit Court upheld the DPC's decision, further appeals were made to the High Court and, subsequently, the newly established Court of Appeal. The matter eventually found its way to the Supreme Court.

What's in a scrawl?

A number of matters were examined by the Irish Supreme Court. These included whether Mr. Nowak enjoyed a right of appeal in the Irish Courts under the DPA and what form these appeals may take.

Of most interest to privacy and data protection professionals will be the Supreme Court's examination of Mr. Nowak's assertion that his examination script is his personal data. Mr. Justice O'Donnell, writing the unanimous decision for the Court stated:

The underlying issue here, whether an examination script is ever capable of being personal data within the meaning of the [DPA], and if so, whether this script is such personal data, is one of some difficulty and complexity that...