Directive 95/46/EC defines personal data as meaning any information relating to an identified or identifiable natural person.
Mr Peter Nowak was a trainee accountant who passed first level accountancy examinations and three second level examinations set by the Institute of Chartered Accountants of Ireland (the CAI). However, he failed the Strategic Finance and Management Accounting examination. Following that failure, in the autumn of 2009, he initially submitted a challenge to the result of that examination. After that challenge was rejected, he submitted a request for access to all the personal data relating to him held by the CAI. In 2010 the CAI sent to Mr Nowak 17 documents, but refused to send to him his examination script, on the ground that it did not contain personal data.
Mr Nowak is challenging the decision of the Data Protection Commissioner that examination scripts generally do not constitute personal data before the Supreme Court (Ireland). That court seeks a ruling from the Court of Justice on whether the written answers provided by a candidate at a professional examination, and any examiner’s comments with respect to those answers, constitute personal data.
In the judgment the Court states, first, that a candidate at a professional examination is a natural person who can be identified, either directly, through his name, or indirectly, through an identification number, these being located either on the examination script itself or its cover sheet. It is of no relevance, in that context, whether the examiner can or cannot identify the candidate at the time when he/she is correcting and marking the examination script.
Second, the Court determines whether the written answers provided by a candidate at a professional examination, and any comments made by an examiner with respect to those answers, constitute information relating to that candidate. The Court states in that regard that the use of the expression «any information» in the definition of the concept of «personal data» in the directive reflects the aim of the EU legislature to assign a wide scope to that concept, which is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it «relates» to the data subject. That condition is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person. The written answers submitted by a candidate at a professional examination constitute information that is linked to him or her as a person.
The content of those answers reflects the extent of the candidate’s knowledge and competences in a given field and, in some cases, his intellect, thought processes, and judgment. Further, the purpose of collecting those answers is to evaluate the candidate’s professional abilities and his suitability to practice the profession concerned. Last, the use of that information, one of the consequences of that use being the candidate’s success or failure at the examination concerned, is liable to have an effect on his or her rights and interests, in that it may determine or influence, for example, the chance of entering the profession aspired to or obtaining the post sought.
As regards the comments of an examiner with respect to the candidate’s answers, the Court finds that they, no less than the answers submitted by the candidate at the examination, constitute information relating to that candidate. The content of those comments reflects the opinion or the assessment of the examiner on the individual performance of the candidate in the examination, particularly on his or her knowledge and competences in the field concerned.
The Court states that the question whether written answers submitted by a candidate at a professional examination, and any comments made by the examiner with respect to those answers, should be classified as personal data cannot be affected by the fact that the consequence of that classification is, in principle, that the candidate has rights of access and rectification.
To rule otherwise would have the effect of entirely excluding that information from the obligation to comply with the principles and safeguards in the area of personal data protection. An examination candidate has, inter alia, a legitimate interest, based on the protection of his private life, in being able to object to the processing of the answers submitted by him at that examination and of the examiner’s comments with respect to those answers outside the examination procedure and, in particular, to their being sent to third parties, or published, without his permission. Equally, the body setting the examination, as the data controller, is obliged to ensure that those answers and comments are stored in such a way as to ensure that third parties do not have unlawful access to them.
The Court further finds that the rights of access and rectification, provided for in the directive, may also be asserted in relation to the written answers submitted by a candidate at a professional examination and to any comments made by an examiner with respect to those answers. Of course, the right of rectification provided cannot enable a candidate to «correct», a posteriori, answers that are «incorrect», since these do not represent inaccuracy within the meaning of the directive. On the other hand, it is possible that there might be situations where the answers of an examination candidate and the examiner’s comments with respect to those answers prove to be inaccurate, for example due to the fact that, by mistake, the examination scripts were mixed up in such a way that the answers of another candidate were assigned to the candidate concerned. Further, it cannot be ruled out that a candidate may have the right to ask the data controller to ensure that his examination answers and the examiner’s comments with respect to them are, after a certain period of time, erased, that is to say, destroyed.
Consequently, in so far as the written answers submitted by a candidate at a professional examination, and any comments made by an examiner with respect to those answers, are liable to be checked for, in particular, their accuracy and the need for their retention, and may be subject to rectification or erasure, the Court holds that to give a candidate a right of access to those answers and to those comments serves the purpose of the directive of guaranteeing the protection of that candidate’s right to privacy with regard to the processing of data relating to him, irrespective of whether that candidate does or does not also have such a right of access under the national legislation. The Court recalls in that regard that the protection of the fundamental right to respect for private life means, inter alia, that any individual may be certain that the personal data relating to him is correct and that it is processed in a lawful manner.
Last, the Court explains that those rights of access and rectification do not extend to the examination questions, which do not as such constitute the candidate’s personal data. Further, the Court notes that EU law provides for certain restrictions on those rights. Thus, Member States may adopt legislative measures to restrict the scope of the obligations and rights laid down, when such a restriction constitutes a necessary measure to safeguard the rights and freedoms of others.
Judgement of the CJEU C-434/16 of 20 December 2017
Source: press release of the CJEU no. 140/17 of 20 December 2017
