CJEU: Written exam answers and comments are personal data

To give a candidate that right serves the objective of the EU legislation to guarantee the protection of the right of individuals to respect for private life with regard to the processing of personal data relating to them.

Peter Nowak was a trainee accountant who passed first level accountancy examinations and three second-level examinations with the Institute of Chartered Accountants of Ireland (CAI). However, he failed the Strategic Finance and Management Accounting exam.

In autumn 2009, he submitted a challenge to the result of that examination. After that challenge was rejected, he submitted a request for access to all the personal data relating to him held by the CAI. In 2010, the CAI sent 17 documents to Mr Nowak, but refused to send his examination script on the ground that it did not contain personal data.

Mr Nowak is challenging the decision of Ireland’s Data Protection Commissioner that examination scripts generally do not constitute personal data before Ireland’s Supreme Court, which sought a European court ruling on whether the written answers provided by a candidate at a professional examination, and any examiner’s comments with respect to those answers, constitute personal data.

In yesterday’s judgment, the Court stated, first, that a candidate at a professional examination is a natural person who can be identified, either directly, through his name, or indirectly, through an identification number, these being located either on the examination script itself or its cover sheet. It is of no relevance, in that context, whether the examiner can or cannot identify the candidate at the time when he/she is correcting and marking the examination script.

Second, the Court determined whether the written answers provided by a candidate at a professional examination, and any comments made by an examiner with respect to those answers, constitute information relating to that candidate. The Court stated in that regard that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 reflects the aim of the EU legislature to assign a wide scope to that concept, which is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, provided that it ‘relates’ to the data subject. That condition is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person. The written answers submitted by a candidate at a professional examination constitute information that is linked to him or her as a person.

The content of those answers reflects the extent of the candidate’s knowledge and competences in a given field and, in some cases, his intellect, thought processes, and judgment. Further, the purpose of collecting those answers is to evaluate the candidate’s professional abilities and his suitability to practice the profession concerned. Last, the use of that information, one of the consequences of that use being the candidate’s success or failure at the examination concerned, is liable to have an effect on his or her rights and interests, in that it may determine or influence, for example, the chance of entering the profession aspired to or obtaining the post sought.

As regards the comments of an examiner with respect to the candidate’s answers, the Court found that they, no less than the answers submitted by the candidate at the examination, constitute information relating to that candidate. The content of those comments reflects the opinion or the assessment of the examiner on the individual performance of the candidate in the examination, particularly on his or her knowledge and competences in the field concerned.

The Court said the question of whether the written answers and any comments made by the examiner should be classified as personal data cannot be affected by the fact that the consequence of that classification is that the candidate has rights of access and rectification.

The Court further found that the rights of access and rectification may also be asserted in relation to the written answers submitted by a candidate at a professional examination and to any comments made by an examiner with respect to those answers. It is possible that there might be situations where the answers of an examination candidate and the examiner’s comments with respect to those answers prove to be inaccurate, for example due to the fact that, by mistake, the examination scripts were mixed up in such a way that the answers of another candidate were assigned to the candidate concerned. Further, it cannot be ruled out that a candidate may have the right to ask the data controller to ensure his answers and the examine’’s comments are, after a certain period of time, destroyed.

Consequently, in so far as the written answers submitted by a candidate at a professional examination, and any comments made by an examiner with respect to those answers, are liable to be checked for, in particular, their accuracy and the need for their retention, and may be subject to rectification or erasure, the Court held that to give a candidate a right of access to those answers and to those comments serves the purpose of the directive of guaranteeing the protection of that candidate’s right to privacy with regard to the processing of data relating to him, irrespective of whether that candidate does or does not also have such a right of access under the national legislation.

Last, the Court explained that those rights of access and rectification do not extend to the examination questions, which do not as such constitute the candidate’s personal data. Further, the Court noted that EU law provides for certain restrictions on those rights. Thus, Member States may adopt legislative measures to restrict the scope of the obligations and rights laid down, when such a restriction constitutes a necessary measure to safeguard the rights and freedoms of others.