Exam paper constitutes personal data, rules Court of Justice – Candidate granted right to access

To many Belgian students, January is a month dedicated
to studious preparation for university exams, while February may be a month for
contemplation as to what went wrong (or right) in this regard. A recent
judgment of the Court of Justice of the European Union might assist
dissatisfied students to this end. On 20 December 2017, this Court ruled that the written answers submitted at a professional examination, as
well as any examiner’s comments with respect to those answers, constitute a
candidate’s personal data to which he or she, in principle, has a right of
access.

First,
a brief account of the facts. Mr Peter Nowak was a trainee accountant who
passed a number of examinations set by the Institute of Chartered Accountants
of Ireland (the “CAI”), but who had repeatedly stumbled at the final hurdle,
namely the Strategic Finance and Management Accounting examination. After
having unsuccessfully challenged this result, in 2009, Mr Nowak filed a request
for access to all the personal data relating to him held by the CAI. The CAI
granted Mr Nowak’s request, but refused to send him the examination script,
stating that this script did not contain any personal data. Mr Nowak took the
case all the way up to the Irish Supreme Court, which referred a number of
questions to the Court of Justice.

On 20
July 2017, Advocate-General Kokott argued in her Opinion
that, at least in the circumstances of this case, a handwritten exam script
that may be ascribed to a candidate, including any of the examiner’s
corrections, constitutes personal data. This broad scope of the concept of
‘personal data’ has now been confirmed by the Court of Justice.

First,
the Court of Justice refers to the broad scope of ‘personal data’ in the Data Protection Directive (DPD), where this concept is defined as “any
information relating to an identified or identifiable natural person”.

A
candidate at a professional examination is said to be such a natural person, who
can be identified, either directly, through their name, or indirectly, through
an identification number. In this regard, it is said to be irrelevant whether
or not the examiner can identify the candidate at the time of correction.

Next,
the question arises whether the written answers of such a natural person
(including possible comments made by an examiner in this regard) constitute
information “relating to” that
candidate in the sense of the DPD. In this regard, the Court of Justice again
refers to the wide scope of the DPD and the broad scope of the expression “any information”. This concept includes
all kinds of information, not only objective but also subjective, in the form
of opinions and assessments, provided that it “relates” to the data subject. The latter condition is satisfied
once the information is linked to a particular person.

The
Court of Justice then goes on to find that a candidate’s written answers may
indeed be linked to them (i.e. the candidate) as a person, also in case the
examination is an open book exam. In this regard, the following elements play a
part in the Court’s reasoning:

• The content of written answers reflects
  the candidate’s knowledge and competence in relation to a certain subject and,
  more generally, their intellect, thought processes, and judgment;
• In case the script is handwritten, it
  provides information regarding the candidate’s handwriting;
• The purpose of collecting the answers is
  to evaluate the candidate; and
• The use of the information at issue is
  liable to have an effect on the rights and interests of the candidate, in that
  it may determine or influence the candidate’s chances of entering a certain
  profession or getting a job.

In
relation to the examiner’s comments in particular, the Court of Justice
observes that these comments reflect the examiner’s opinion or assessment of
the candidate’s performance and therefore concludes that they, no less than the
candidate’s written answers, constitute information relating to that candidate.
This does not detract from the fact that these comments also constitute
information relating to the examiners themselves.

The
Court of Justice subsequently remarks that its conclusion remains unaffected by
the significant consequences it entails, namely that the candidate has rights
of access and rectification in relation to their personal data contained in the
exam script. In the Court’s view, to rule otherwise would have the effect of
entirely excluding that information from the obligation to comply with the
principles and safeguards in the area of personal data protection.

An
examination candidate is said to have a legitimate interest in being able to
object to the processing of the answers submitted by them at that examination
and of the examiner’s comments with respect to those answers outside the
examination procedure. Equally, the body setting the examination, as the data
controller, must ensure that third parties cannot unlawfully access those
answers and comments.

In
view of the above, a candidate has rights of access and rectification in relation
to the written answers and the examiner’s comments. For the sake of clarity,
this does not mean that a candidate may, a
posteriori, ‘correct’ ‘incorrect’ answers. However, a candidate may have
the right to ask the data controller to ensure that their examination answers
and the examiner’s comments with respect to them are, after a certain period of
time, erased. In this way, an individual may be certain that the information
relating to them is correct and that it is processed in a lawful manner.

Last,
the Court notes that the candidate’s rights do not extend to the examination questions, which as such do not constitute
the candidate’s personal data.

Further,
the Court notes that the DPD, and the General Data Protection Regulation (GDPR) which repeals it with effect from 25 May 2018, provides for certain
restrictions on data subjects’ rights. Thus, EU Member States may adopt
legislative measures to this end, when such a restriction constitutes a
necessary measure to safeguard the rights and freedoms of others.

This
decision from the Court of Justice again shows an expansive view on the scope
of the concept of ‘personal data’. It could have major implications for
professional examination boards and universities alike. Indeed, in times where
students are often not afraid to speak up following a disappointing exam
result, it could make examiners’ lives significantly more difficult.