On 20 December 2017, the Court of Justice of the European Union (the "ECJ") issued its preliminary ruling on the question whether the concept of personal data, as defined in Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"), encompasses information recorded as answers given by a candidate during a professional examination (ECJ, 20 December 2017, Case C-434/16, Peter Nowak v. Data Protection Commissioner).
Mr. Nowak had participated in several accountancy examinations organised by the Institute of Chartered Accountants of Ireland (the "CAI"). He failed one of these examinations and afterwards submitted a data access request, seeking all the personal data relating to him held by the CAI. The CAI sent multiple documents to Mr. Nowak, but refused to send him his examination script, on the ground that it did not contain personal data within the meaning of the data protection legislation. Mr. Nowak challenged this decision with the Data Protection Commissioner and, when the Data Protection Commissioner did not grant him access to the requested data, brought an action against that decision before the Circuit Court. Ultimately, the Supreme Court submitted a request for a preliminary ruling to the ECJ.
The ECJ considered the broad scope of 'any information' in the definition of personal data under Article 2(a) of the Data Protection Directive. To qualify as personal data, such information must 'relate' to the data subject. According to the ECJ, information 'relates' to the data subject if the information, "by reason of its content, purpose or effect, is linked to a particular person".
In the case at hand, the ECJ explained that written answers submitted by a candidate at a professional examination are linked to him or her as a person. Indeed, the content of these answers reflects the extent of the candidate's knowledge and competence in a given field, as well as his or her intellect, thought process and judgment. Moreover, the purpose for which the information is collected is to assess the person's professional abilities. Finally, the use of this information is liable to have an effect on the person's rights and interests. Similarly, the ECJ held that the comments of an examiner with respect to the candidate's answers also constitute information relating to that candidate.
The ECJ went on to explain that it follows that the data subject must be permitted to exercise his or her rights with regard to this personal data, including the right of access. As regards the right of rectification, the ECJ points out that this right does not allow the data subject to 'correct' answers which are incorrect. The right to rectify personal data is intended to assess whether personal data are accurate and complete in the light of the purpose for which these data were collected. In the case at hand, this right can be relied on to verify whether the examination answers have been ascribed to the candidate concerned and if this was not the case, for instance because the examiner has attributed the written answers of the data subject to another candidate, the data subject can request a rectification.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
