Jump to content

Nowak v Data Protection Commissioner: Difference between revisions

Add links
From Wikipedia, the free encyclopedia
Next edit →
Content deleted Content added
VisualWikitext
Created Draft for Irish Supreme Court case Nowak v Data Protection Commissioner
(No difference)

Revision as of 17:41, 26 January 2024

Nowak v The Data Protection Commissioner
Coat of arms of Ireland
CourtSupreme Court of Ireland
Full case name Nowak v The Data Protection Commissioner
Decided24 April 2016
Citationhttps://www.bailii.org/ie/cases/IESC/2016/S18.html
Case history
Appealed fromHigh Court
Appealed toSupreme Court
Court membership
Judges sittingO'Donnell Donal J, McKechnie J, Clarke J, MacMenamin J, Laffoy J, [Dunne J, Charleton J
Case opinions
This case's Court of Justice of the European Union ruling created a precedent for other Member States and defined personal data. In April 2016, Mr. Nowak appealed to the Supreme Court after the Circuit Court and Court of Appeal denied his appeal. The Supreme Court overruled the High Court's ruling that frivolous or vexatious complaints may not be appealed. The Court considered three questions: can Nowak appeal the Data Protection Commissioner's decision under section 26? The Court ruled that frivolous or vexatious findings that a document is not personal data can be contested. Since exams don't grade handwriting, the Court rejected Mr. Nowak's claim that his script was personal data. The Supreme Court asked the Court of Justice of the European Union to decide if an examination script and its outcome are personal data. The CJEU ruled that exam candidates must comply with data protection rules and safeguards, including the right to access information. This case made all EU member states prioritise personal data and its rights, including GDPR requirements.
Decision byO'Donnell Donal J.
Keywords

Nowak v Data Protection Commissioner [2016] IESC 18[1]; [2016] 2 IR 585, is a reported Irish Supreme Court case in which the Court referred the question of what constitutes as personal data to the Court of Justice of the European Union.[2] In this case, the Court saw the first time an applicant contending that an exam script is his personal data.[3] The Court of Justice of the European Union's decision in this case is significant because it set a precedent for other Member States as well. Also, it gave clarification on what can be considered personal data.[4]

Background

In this case, Mr. Peter Nowak was a trainee accountant who had passed the first level of his accountancy exams, which were issued by the Institution of Chartered Accountants in Ireland. He took the strategic finance and management accounting exams in two separate sittings. Once in 2008 and again in 2009 after subsequently failing his initial attempt. Mr Nowak failed his final attempt at the exams and subsequently requested a copy of his exam scrips from the Chartered Accountants of Ireland. He did this under Section 4 of the Data Protections Act 1998 and 2003.[5] Despite retaining some documents from Chartered Accountants Ireland, he did not receive his exam script for review as they believed that the scrips did not fall under what they believed to be personal data.[6]

The request for his exam scripts was then put to the Office of the Data Protection Commissioner.[7] The Commissioner felt there was no need to conduct an independent investigation as under the terms of the Data Protections Act, exam scripts did not constitute as personal data.[8] The Commissioner was of the view that if a complaint forwarded to him does not have any substantial legal grounds, then it can be considered frivolous and vexatious. In which circumstance, he would not be obliged to investigate the complaint any further. This process is what Nowak is questioning.[9]

The Circuit Court rejected Mr Nowak's request for an appeal, and the same conclusion was reached by the Court of Appeal as well. This resulted in him bringing the case to the Supreme Court in April 2016.

Holding of the Supreme Court

The Supreme Court overturned the decision of the High Court that an appeal could not be made on the basis of a complaint which was frivolous or vexatious, as this was unjust. On the very basis of data protection, any appeal in relation to one's personal data could be appealed.

This Court had to consider three questions. Firstly, can Nowak appeal the Data Protection Commissioner's decision under section 26 of the Data Protection Act 1988 and 2003.[5] Secondly, if he could, then what test should the Circuit Court have applied in relation to his case? Lastly, by applying this test, is the Data Protection Commissioner correct in making his decision?

Frivolous complaints are usually disregarded. Administrative decision makers can dismiss unfounded allegations. This is to avoid having to formalise every complaint and postpone work that might be done promptly. This is in the context of a frivolous complaint that raises a substantial legal question. Nowak's complaint was valid, but the Circuit Court can hear legal issues. Both Acts do not limit appeals. The Commissioner claimed he acted legally. Supreme Court stated that section 26 of the Data Protection Act 2003[5] deals with appeals and is clear. The modified section 26[5] also applies to complaints that are vexatious under section 10(1)(b).[5]

If the Commissioner finds that a complaint cannot be settled, he or she just needs to tell the complainant. Reading the Acts as requiring a comprehensive inquiry does not limit appeals. It would require an unnecessary procedure that would delay other instances.[10] The Court concluded that a frivolous or vexatious finding that a document is not personal data can be challenged. The Commissioner suggested judicial review.[11] The Court disagreed because there is no reason to limit judicial review to legal questions. This matter is not suitable for judicial review. The Commissioner may have erred in rejecting the complaint as frivolous or vexatious. The Court rejected Mr. Nowak's claim that his handwritten script constituted personal data because exams are not graded on handwriting.[12] Accountancy exams only test one topic. Mr. Nowak maintained that if the Act considers exam results personal data, then the script, markings, and other exam-related data should be too.[13]

However, on the issue of personal data, the Court held that there was no prior case law for it to make its decision.[14] There is also no European authority relating to data protection for the Court to base its decision upon whether an examination script falls under the scope of what is personal data.[15]

The Supreme Court made the decision to refer the case to the Court of Justice of the European Union in a request to answer the question of whether an examination script and its attached result can constitute personal data.[16]

Holding of the CJEU

It was the finding of the Court of Justice of the European Union that the answers provided by a candidate sitting an exam is in fact, information relating to the candidate. It can therefore be defined as the personal data of the candidate. The CJEU held that all information provided by a candidate in an exam on the exam paper is under an obligation to be compliant with all data protection principles and the safeguards relating to that data, including the right to access the information.[17]

The CJEU took a broad view of the concept of personal data. This case highlighted the importance of personal data and the rights that come with it, including all GDPR rules, as a guideline for all EU member states regarding what rules to follow when dealing with issues relating to the request for access to personal data.[17]

See Also

categories 2016 in case law, chartered accountants, privacy, constitution, GDPR, data protection

http://www.irishstatutebook.ie/eli/2003/act/6/enacted/en/html

  1. ^ Nowak -v- The Data Protection Commissioner [2016] IESC 18, 28 April 2016, retrieved 2023-04-28
  2. ^ "Accountancy exam paper dispute referred to EU court". The Irish Times. Retrieved 2020-04-06.
  3. ^ https://www.oic.ie/guidance-and-resources/Court-Judgments/supreme-court-judgments/P-Kelly-and-OIC.pdf
  4. ^ https://unece.org/fileadmin/DAM/env/pp/compliance/C2014-113_Ireland/frPartyC113_10.06.2016/Annex_13_Nowak_v_Data_Protection_Commissioner__2016__IESC_18..pdf
  5. ^ a b c d e Book (eISB), electronic Irish Statute. "electronic Irish Statute Book (eISB)". www.irishstatutebook.ie. Retrieved 2023-04-28.
  6. ^ https://www.wdsolicitors.ie/blog/data-protection-exam-script-personal-data
  7. ^ https://www.algoodbody.com/images/uploads/services/EU-Data-Protection/Irish_Data_Protection_Law_%E2%80%93_2018_in_Review.pdf
  8. ^ https://www.wdsolicitors.ie/blog/data-protection-exam-script-personal-data
  9. ^ https://www.lexology.com/library/detail.aspx?g=6edaaa1a-d352-4f2e-b935-36731870f1f6
  10. ^ admin (2016-05-03). "Data Protection: It's a long way from Portarlington to Luxembourg". FP Logue LLP. Retrieved 2023-04-28.
  11. ^ https://mcmahonsolicitors.ie/overview-4/4/
  12. ^ https://deliverypdf.ssrn.com/delivery.php?ID=863073094087022016070103105091109072049033032050001006088090093085002124018121120089010103119001122038023007087107000118120071055043092008037070028124080067082068005070020042094006093108127085072116085069101072115087031117126121076072121069088105031000&EXT=pdf&INDEX=TRUE
  13. ^ "Peter Nowak vs. Data Protection Commissioner". privacylibrary.ccgnlud.org. Retrieved 2023-04-28.
  14. ^ https://www.lkshields.ie/news-insights/publication/data-protection-commissioner-v-facebook-ireland-limited-anor
  15. ^ "Law | Data Protection Commission". Law | Data Protection Commission. Retrieved 2023-04-28.
  16. ^ "Testing Times: Are Exam Scripts Personal Data? Irish Supreme Court…". Mason Hayes Curran. Retrieved 2023-04-28.
  17. ^ a b "CURIA - List of results". curia.europa.eu. Retrieved 2023-04-28.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Nowak_v_Data_Protection_Commissioner&oldid=1199283810"