[BreachExchange] Irish student wins support in legal battle over exam script

[Destry Winant]

https://www.irishtimes.com/news/ireland/irish-news/irish-student-wins-support-in-legal-battle-over-exam-script-1.3161854

Ireland’s Data Protection Commissioner (DPC) is facing another
possible defeat at Europe’s highest court in an eight-year legal
marathon over an exam script.

In a referral from the Supreme Court, the European Court of Justice
(ECJ) in Luxembourg has been told by its Advocate General that
Ireland’s DPC was wrong to say an accountancy trainee had no right to
access the script of a failed exam.

In an opinion released on Thursday, the ECJ Advocate General
recommended the court classify the script as personal data under EU
data protection laws.

In 2009 Peter Nowak, a registered student with the Institute of
Chartered Accountants of Ireland (CAI) asked to view his scripts for
an accounting exam after failing it for the fourth time, with a view
to challenging the result.

The CAI released 17 items but declined to release the exam script,
saying it did not constitute personal data under data protection
legislation.

Mr Nowak then sought assistance from the Data Protection Commissioner,
who advised him that exam scripts “would not generally constitute
personal data”.

Formal complaint

After he filed a formal complaint, the commissioner refused to
investigate the complaint, saying it was not sustainable on legal
grounds and, in a technical sense, was frivolous and vexatious.

Mr Nowak appealed the commissioner’s decision to the Circuit Court,
which found he had no right to appeal the commissioner’s
determination.

The High Court agreed with the Circuit Court but the Supreme Court
said it was not clear whether an exam script constitutes personal data
and asked the ECJ for guidance.

In its opinion, the Advocate General said the Data Protection
Commissioner may have been correct in the narrow sense, that the
solutions in exam scripts do not constitute personal data, but this
disregards how exam scripts contain the workings of the candidate.

“The script is a documentary record that the individual has taken part
in a given examination and how he performed,” wrote Juliane Kokott,
German Advocate General at the ECJ. “The personal connection to that
performance is also shown in the fact that examination candidates
often include their most important examination results in their CVs.”

‘Individual performance’

Every exam is a test of the “strictly personal and individual
performance” of a candidate and is thus “a collection of personal
data”.

As well the Irish parties involved, the case before the ECJ attracted
submissions from seven EU member states and the European Commission.

In its opinion the Advocate General said the issue was less about
access to the exam script but the Data Protection Commissioner’s
refusal to assist Mr Nowak in securing access. While the DPC refused
to take on his case, believing it had no chance of success, the
Advocate General saw a “genuine need” for Mr Nowak to access his exam
script and that such a document might be of interest at a later date.

The opinion points out that the Nowak ruling and the personal data
issues it addresses were “also of importance” for the looming new era
of EU data protection regulations.

A ruling on the Nowak case is likely in the autumn, referring it back
to the Supreme Court. The Advocate General’s opinion is not a ruling
and the Luxembourg-based court is not obliged to follow its Advocate
General’s line or argument, but it very often does.

This case is the second time in two years that a DPC finding has been
challenged in Europe’s highest court. In 2015 Luxembourg judges struck
out transatlantic data transfers under the so-called “Safe Harbour”
provisions on foot of a complaint by Austrian lawyer Max Schrems to
the Irish DPC.

No case to investigate

The Irish authority claimed it had no case to investigate as Safe
Harbour, and its implementation, was solely a matter for the European
Commission. The Luxembourg court disagreed and said the Irish
authority was wrong not to investigate the Schrems complaint.

On Wednesday Mr Schrems was back in Luxembourg’s ECJ in the latest
round of his long-running legal battle with Facebook’s Irish
subsidiary.

After withdrawing a complaint in Ireland, claiming the DPC was
delaying a ruling, Mr Schrems took a class action against Facebook’s
data collection policies in Vienna.

He argues that Facebook collection of European users’ data for
commercial gain disregards EU data protection laws. Austrian courts so
far have agreed with Facebook that such a class action suit –
involving 25,000 European Facebook users backing Mr Schrems – are not
permissible under EU law.

Another, separate, case involving Mr Schrems, Facebook and the DPC is
still ongoing at the Commercial Court over possible links between
Facebook user data collection and US surveillance programmes.