20 December 2017 (*1)
(Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Article 2(a) — Concept of ‘personal data’ — Written answers submitted by a candidate in a professional examination — Examiner’s comments with respect to those answers — Article 12(a) and (b) — Extent of the data subject’s rights to access and rectification)
In Case C‑434/16,
REQUEST for a preliminary ruling under Article 267 TFEU from the Supreme Court (Ireland), made by decision of 29 July 2016, received at the Court on 4 August 2016, in the proceedings
Peter Nowak
v
Data Protection Commissioner,
THE COURT (Second Chamber),
composed of M. Ilešič (Rapporteur), President of the Chamber, A. Rosas, C. Toader, A. Prechal, and E. Jarašiūnas, Judges,
Advocate General: J. Kokott,
Registrar: M. Aleksejev, Administrator,
having regard to the written procedure and further to the hearing on 22 June 2017,
after considering the observations submitted on behalf of:
after hearing the Opinion of the Advocate General at the sitting on 20 July 2017,
gives the following
1This request for a preliminary ruling concerns the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ).
2The request has been made in proceedings between Mr Peter Nowak and the Data Protection Commissioner (Ireland) concerning the latter’s refusal to give Mr Nowak access to a corrected script of an examination at which he was a candidate, on the ground that the information contained therein did not constitute personal data.
Legal context
3Recitals 25, 26 and 41 of Directive 95/46, the object of which is stated in Article 1 thereof to be the protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and the elimination of obstacles to the free flow of such data, state:
‘(25)
… the principles of protection must be reflected, on the one hand, in the obligations imposed on persons … responsible for processing, in particular regarding data quality, technical security, notification to the supervisory authority, and the circumstances under which processing can be carried out, and, on the other hand, in the right conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances;
...
4The concept of ‘personal data’ is defined in Article 2(a) of that directive as being ‘any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’.
5Article 6 of that directive, within Section I of Chapter II of that directive, that section being headed ‘Principles relating to data quality’, is worded as follows:
‘1. Member States shall provide that personal data must be:
2It shall be for the controller to ensure that paragraph 1 is complied with.’
6Article 7 of Directive 95/46, within Section II of Chapter II of that directive, that section being headed ‘Criteria for making data processing legitimate’, provides:
‘Member States shall provide that personal data may be processed only if:
...
...
7Article 12 of that directive, headed ‘Right of access’, states:
‘Member States shall guarantee every data subject the right to obtain from the controller:
...
8Article 13 of that directive, headed ‘Exemptions and restrictions’, provides:
‘1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard:
...
...’
9Article 14 of Directive 95/46, headed ‘The data subject’s right to object’, provides:
‘Member States shall grant the data subject the right:
...’
10Article 28 of that directive, headed ‘Supervisory authority’, states:
‘1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
...
3Each authority shall in particular be endowed with:
...
Decisions by the supervisory authority, which give rise to complaints, may be appealed against through the courts.
4Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
...’
11Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 ) is applicable, pursuant to Article 99(2) thereof, as from 25 May 2018. Article 94(1) of that regulation provides that Directive 95/46 is repealed with effect from that date.
12Article 15 of that regulation, headed ‘Right of access by the data subject’, provides:
‘1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data …
...
3The controller shall provide a copy of the personal data undergoing processing …
4The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.’
13Article 23 of Regulation 2016/679, headed ‘Restrictions’, states:
‘1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 …, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
...
...
...’
14The Data Protection Act 1988, as amended by the Data Protection (Amendment) Act 2003 (‘the data protection legislation’) is designed to transpose Directive 95/46 into the Irish legal system. Section 1(1) of that Act defines the concept of ‘personal data’ as follows:
‘Data relating to a living individual who is or can be identified either from the data or from data in conjunction with other information that is in, or is likely to come into, the possession of the Data Controller’.
15The right of access is governed by Section 4 of the data protection legislation; Section 4(6), which relates specifically to requests for access to the results of examinations, is worded as follows:
‘(a)
A request by an individual under subsection (1) of this section in relation to the results of an examination at which he was a candidate shall be deemed, for the purposes of this section, to be made on
whichever is the later; ...
16Article 6 of the data protection legislation establishes the right to rectification and erasure of personal data the processing of which does not comply with that legislation.
17Article 10(1)(b)(i) of the data protection legislation requires the Data Protection Commissioner to investigate a complaint ‘unless he is of the opinion that it is frivolous or vexatious’.
18Mr Nowak was a trainee accountant who passed first level accountancy examinations and three second level examinations set by the Institute of Chartered Accountants of Ireland (‘the CAI’). However, Mr Nowak failed the Strategic Finance and Management Accounting examination, which allowed candidates to make use of documents (an open book examination).
19After he had failed that examination for the fourth time, in the autumn of 2009, Mr Nowak initially submitted a challenge to the result of that examination. After that challenge was rejected in March 2010, he submitted, in May 2010, a data access request, under Section 4 of the data protection legislation, seeking all the personal data relating to him held by the CAI.
20By letter of 1 June 2010, the CAI sent 17 documents to Mr Nowak, but refused to send to him his examination script, on the ground that it did not contain personal data, within the meaning of the data protection legislation.
21Mr Nowak then contacted the Data Protection Commissioner with a view to challenging the reason given for the refusal to disclose his examination script. In June 2010 the Data Protection Commissioner replied to him by email to state, inter alia, that ‘exam scripts do not generally fall to be considered [for data protection purposes] … because this material would not generally constitute personal data’.
22That reply from the Data Protection Commissioner was followed by correspondence between Mr Nowak and the Commissioner which culminated, on 1 July 2010, in Mr Nowak submitting a formal complaint.
23By letter of 21 July 2010, the Data Protection Commissioner informed Mr Nowak that, after consideration of the case, he had identified no substantive contravention of [the data protection legislation] and that, in accordance with Section 10(1)(b)(i) of that legislation, which covers frivolous or vexatious complaints, there would be no investigation of the complaint. The letter stated, further, that the material over which Mr Nowak sought to exercise ‘a right of correction is not personal data to which Section 6 of the [data protection legislation] applies’.
24Mr Nowak brought an action against that decision before the Circuit Court. That court held that the action was inadmissible on the ground that, since the Data Protection Commissioner had not initiated an investigation of a complaint, there was no decision against which legal proceedings could be brought. In the alternative, that court held that the action was unfounded, since the examination script did not constitute personal data.
25Mr Nowak brought an appeal against the judgment of that court before the High Court, which however upheld the decision. The judgment of the High Court was, in its turn, upheld by the Court of Appeal. The Supreme Court, which allowed an appeal against the judgment of the Court of Appeal, held that the action brought by Mr Nowak against the decision of the Data Protection Commissioner was admissible.
26However, the Supreme Court is uncertain whether an examination script can constitute personal data, within the meaning of Directive 95/46, and therefore decided to stay the proceedings and to refer to the Court the following questions for a preliminary ruling:
‘(1)
Is information recorded in/as answers given by a candidate during a professional examination capable of being personal data, within the meaning of Directive 95/46?
27By its questions, which can be examined together, the referring court seeks, in essence, to ascertain whether Article 2(a) of Directive 95/46 must be interpreted as meaning that, in circumstances such as those at issue in the main proceedings, the written answers submitted by a candidate at a professional examination and any examiner’s comments with respect to those answers constitute personal data, within the meaning of that provision.
28In that regard, it must be recalled that Article 2(a) of Directive 95/46 defines personal data as meaning ‘any information relating to an identified or identifiable natural person’. Under the same provision, ‘an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’.
29It is not disputed that a candidate at a professional examination is a natural person who can be identified, either directly, through his name, or indirectly, through an identification number, these being placed either on the examination script itself or on its cover sheet.
30Contrary to what the Data Protection Commissioner appears to argue, it is of no relevance, in that context, whether the examiner can or cannot identify the candidate at the time when he/she is correcting and marking the examination script.
31For information to be treated as ‘personal data’ within the meaning of Article 2(a) of Directive 95/46, there is no requirement that all the information enabling the identification of the data subject must be in the hands of one person (judgment of 19 October 2016, Breyer, C‑582/14 , EU:C:2016:779 , paragraph 43 ). It is also undisputed that, in the event that the examiner does not know the identity of the candidate when he/she is marking the answers submitted by that candidate in an examination, the body that set the examination, in this case the CAI, does, however, have available to it the information needed to enable it easily and infallibly to identify that candidate through his identification number, placed on the examination script or its cover sheet, and thereby to ascribe the answers to that candidate.
32It is however necessary to determine whether the written answers provided by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute information relating to that candidate, within the meaning of Article 2(a) of Directive 95/46.
33As the Court has held previously, the scope of Directive 95/46 is very wide and the personal data covered by that directive is varied (judgment of 7 May 2009, Rijkeboer, C‑553/07 , EU:C:2009:293 , paragraph 59 and the case-law cited).
34The use of the expression ‘any information’ in the definition of the concept of ‘personal data’, within Article 2(a) of Directive 95/46, reflects the aim of the EU legislature to assign a wide scope to that concept, which is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject.
35As regards the latter condition, it is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person.
36As is argued, in essence, by Mr Nowak, the Czech, Greek, Hungarian, Austrian and Portuguese governments and also by the European Commission, the written answers submitted by a candidate at a professional examination constitute information that is linked to him or her as a person.
37First, the content of those answers reflects the extent of the candidate’s knowledge and competence in a given field and, in some cases, his intellect, thought processes, and judgment. In the case of a handwritten script, the answers contain, in addition, information as to his handwriting.
38Second, the purpose of collecting those answers is to evaluate the candidate’s professional abilities and his suitability to practice the profession concerned.
39Last, the use of that information, one consequence of that use being the candidate’s success or failure at the examination concerned, is liable to have an effect on his or her rights and interests, in that it may determine or influence, for example, the chance of entering the profession aspired to or of obtaining the post sought.
40It is, moreover, equally true that the written answers submitted by a candidate at a professional examination constitute information that relates to that candidate by reason of its content, purpose or effect, where the examination is, as in this case, an open book examination.
41As is stated by the Advocate General in point 24 of her Opinion, the aim of any examination is to determine and establish the individual performance of a specific person, namely the candidate, and not, unlike, for example, a representative survey, to obtain information that is independent of that person.
42As regards the comments of an examiner with respect to the candidate’s answers, it is clear that they, no less than the answers submitted by the candidate at the examination, constitute information relating to that candidate.
43The content of those comments reflects the opinion or the assessment of the examiner of the individual performance of the candidate in the examination, particularly of his or her knowledge and competences in the field concerned. The purpose of those comments is, moreover, precisely to record the evaluation by the examiner of the candidate’s performance, and those comments are liable to have effects for the candidate, as stated in paragraph 39 of this judgment.
44The finding that the comments of the examiner with respect to the answers submitted by the candidate at the examination constitute information which, by reason of its content, purpose or effect, is linked to that candidate is not called into question by the fact that those comments also constitute information relating to the examiner.
45The same information may relate to a number of individuals and may constitute for each of them, provided that those persons are identified or identifiable, personal data, within the meaning of Article 2(a) of Directive 95/46.
46Further, the question whether written answers submitted by a candidate at a professional examination and any comments made by the examiner with respect to those answers should be classified as personal data cannot be affected, contrary to what is argued by the Data Protection Commissioner and the Irish government, by the fact that the consequence of that classification is, in principle, that the candidate has rights of access and rectification, pursuant to Article 12(a) and (b) of Directive 95/46.
47In that regard, it must, first, be recalled, as argued by the Commission at the hearing, that a number of principles and safeguards, provided for by Directive 95/46, are attached to that classification and follow from that classification.
48It is stated in recital 25 of Directive 95/46 that the principles of protection provided for by that directive are reflected, on the one hand, in the obligations imposed on those responsible for processing data, obligations which concern in particular data quality, technical security, notification to the supervisory authority, and the circumstances under which processing can be carried out, and, on the other hand, in the rights conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances.
49Accordingly, if information relating to a candidate, contained in his or her answers submitted at a professional examination and in the comments made by the examiner with respect to those answers, were not to be classified as ‘personal data’, that would have the effect of entirely excluding that information from the obligation to comply not only with the principles and safeguards that must be observed in the area of personal data protection, and, in particular, the principles relating to the quality of such data and the criteria for making data processing legitimate, established in Articles 6 and 7 of Directive 95/46, but also with the rights of access, rectification and objection of the data subject, provided for in Articles 12 and 14 of that directive, and with the supervision exercised by the supervisory authority under Article 28 of that directive.
50As stated by the Advocate General in point 26 of her Opinion, it is undisputed that an examination candidate has, inter alia, a legitimate interest, based on the protection of his private life, in being able to object to the processing of the answers submitted by him at that examination and of the examiner’s comments with respect to those answers outside the examination procedure and, in particular, to their being sent to third parties, or published, without his permission. Equally, the body setting the examination, as the data controller, is obliged to ensure that those answers and comments are stored in such a way as to ensure that third parties do not have unlawful access to them.
51Further, it is clear that the rights of access and rectification, provided for in Article 12(a) and (b) of Directive 95/46, may also be asserted in relation to the written answers submitted by a candidate at a professional examination and to any comments made by an examiner with respect to those answers.
52Of course, the right of rectification provided for in Article 12(b) of Directive 95/46 cannot enable a candidate to ‘correct’, a posteriori , answers that are ‘incorrect’.
53It is apparent from Article 6(1)(d) of Directive 95/46 that the assessment of whether personal data is accurate and complete must be made in the light of the purpose for which that data was collected. That purpose consists, as far as the answers submitted by an examination candidate are concerned, in being able to evaluate the level of knowledge and competence of that candidate at the time of the examination. That level is revealed precisely by any errors in those answers. Consequently, such errors do not represent inaccuracy, within the meaning of Directive 95/46, which would give rise to a right of rectification under Article 12(b) of that directive.
54On the other hand, it is possible that there might be situations where the answers of an examination candidate and the examiner’s comments with respect to those answers prove to be inaccurate, within the meaning of Article 6(1)(d) of Directive 95/46, for example due to the fact that, by mistake, the examination scripts were mixed up in such a way that the answers of another candidate were ascribed to the candidate concerned, or that some of the cover sheets containing the answers of that candidate are lost, so that those answers are incomplete, or that any comments made by an examiner do not accurately record the examiner’s evaluation of the answers of the candidate concerned.
55Moreover, as stated by the Advocate General in point 37 of her Opinion, it cannot be ruled out that a candidate may, under Article 12(b) of Directive 95/46, have the right to ask the data controller to ensure that his examination answers and the examiner’s comments with respect to them are, after a certain period of time, erased, that is to say, destroyed. Pursuant to Article 6(1)(e) of that directive, personal data is to be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data was collected or for which it is subsequently processed. Taking into consideration the purpose of the answers submitted by an examination candidate and of the examiner’s comments with respect to those answers, their retention in a form permitting the identification of the candidate is, a priori, no longer necessary as soon as the examination procedure is finally closed and can no longer be challenged, so that those answers and comments have lost any probative value.
56In so far as the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers are therefore liable to be checked for, in particular, their accuracy and the need for their retention, within the meaning of Article 6(1)(d) and (e) of Directive 95/46, and may be subject to rectification or erasure, under Article 12(b) of the directive, the Court must hold that to give a candidate a right of access to those answers and to those comments, under Article 12(a) of that directive, serves the purpose of that directive of guaranteeing the protection of that candidate’s right to privacy with regard to the processing of data relating to him (see, a contrario , judgment of 17 July 2014, YS and Others, C‑141/12 and C‑372/12 , EU:C:2014:2081 , paragraphs 45 and 46 ), irrespective of whether that candidate does or does not also have such a right of access under the national legislation applicable to the examination procedure.
57In that context, it must be recalled that the protection of the fundamental right to respect for private life means, inter alia, that any individual may be certain that the personal data relating to him is correct and that it is processed in a lawful manner. As is apparent from recital 41 of Directive 95/46, it is in order to be in a position to carry out the necessary checks that the data subject has, under Article 12(a) of the directive, a right of access to the data relating to him which is being processed. That right of access is necessary, inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the data controller and consequently to exercise the right set out in Article 12(b) of that directive (judgment of 17 July 2014, YS and Others, C‑141/12 and C‑372/12 , EU:C:2014:2081 , paragraph 44 and the case-law cited).
58Last, it must be said, first, that the rights of access and rectification, under Article 12(a) and (b) of Directive 95/46, do not extend to the examination questions, which do not as such constitute the candidate’s personal data.
59Second, Directive 95/46 and Regulation 2016/679 which replaces the directive both provide for certain restrictions on those rights.
60Thus, under Article 13(1)(g) of Directive 95/46, Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in, inter alia, Article 6(1) and Article 12 of that directive, when such a restriction constitutes a necessary measure to safeguard the rights and freedoms of others.
61Article 23(1)(e) of Regulation 2016/679 extends the list of grounds justifying restrictions, currently laid down in Article 13(1) of Directive 95/46, to ‘other important objectives of general public interest of the Union or of a Member State’. Further, Article 15(4) of Regulation 2016/679, that article relating to the data subject’s right of access, provides that the right to obtain a copy of personal data must not adversely affect the rights and freedoms of others.
62In the light of all the foregoing, the answer to the questions referred is that Article 2(a) of Directive 95/46 must be interpreted as meaning that, in circumstances such as those of the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data, within the meaning of that provision.
63Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Second Chamber) hereby rules:
Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that, in circumstances such as those of the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data, within the meaning of that provision.
Ilešič
Rosas
Toader
Prechal
Jarašiūnas
Delivered in open court in Luxembourg on 20 December 2017.
A. Calot Escobar
Registrar
M. Ilešič
President of the Second Chamber
(*1) Language of the case: English.
Text from our archive (Publications Office of the EU, Cellar). Commission Decision 2011/833/EU — free reuse incl. commercial; attribution to EUR-Lex / Court of Justice of the European Union required; EUR-Lex is not the authentic record of the Court.