|Parties||Jurisdiction||Formation||Judge Rapporteur||Advocate General||Subject-matter|
|Non-contractual liability||Peter Nowak / Data Protection Commissioner||Court of Justice||2nd Chamber||M. Ilešič||J. Kokott||Personal Data Directive|
|Keywords||Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Article 2(a) — Concept of ‘personal data’ — Written answers submitted by a candidate in a professional examination — Examiner’s comments with respect to those answers — Article 12(a) and (b) — Extent of the data subject’s rights to access and rectification|
|Significant points||The Supreme Court of Ireland asked the Court of Justice to rule in a preliminary ruling whether the written answers submitted by a candidate in a professional examination and the examiner’s comments with respect to those answers can be considered as protected personal data under Article 2(a) of the Directive 95/46/EC.
In the case, the claimant took a national exam, which he failed. He initially tried to challenge the result, but his request was denied. Therefore he submitted a data access request seeking to access all personal data relating to him held by the CAI (Institute of Chartered Accountants of Ireland).
First of all, the fact that the candidate can be identified by the examiner directly or indirectly is irrelevant in relation to this question. Instead, it is necessary to determine whether the written answers provided, and any comments made by an examiner with respect to those answers, constitute “information” linked to the candidate (under Article 2(a) of the Directive).
The Court considered that the answers reflect the extent of the candidate’s knowledge and competence, the candidate’s professional abilities and his suitability to practise the profession, and moreover, the use of the information contained in the answers will determine whether the candidate succeeds or fails, and that is the reason why they constitute information relating to the candidate.
The candidate can have a legitimate interest, based on the protection of his or her private life, in being able to object to the processing of his or her answers, outside of the examination procedure, in particular if sent to third parties or published without his or her permission.
Nevertheless, the right to access or the right of rectification provided for in Article 12(a) and (b) of the Directive cannot enable a candidate to correct, a posteriori, answers that are incorrect. The assessment of the data collection shall be made in the light of the purpose for which that data has been collected. Accordingly, the candidate, as also stated by Advocate General Kokott, may ensure after a certain period of time that his or her examination and the examiner’s comments with respect to them, are erased. The Court therefore concluded that the written answers submitted at a professional examination and any comments of the examiner with respect to those answers constitute a candidate’s personal data to which he has, in principle, a right of access. To give a candidate that right serves the objective of the EU legislation to guarantee the protection of private life with regard to the processing of personal data relating to them.
|Noteworthy||As recalled in the decision, the use of “any information” under Article 2(a) of the Directive 95/46 shows the willingness of the EU legislator to give a broad scope to that concept, potentially encompassing all kinds of information, objective or subjective, in the form of opinions and assessments.
In that regard, it seems relevant to draw a parallel between the drafting of Article 2(a) of the Directive 95/46 and Article 4(1) of General Data Protection Regulation 2016/679. The Court would certainly consider that answers to a professional examination and the comments of the examiner with respect to those answers will always constitute personal data. Consequently, it seems sensible that the Court grants the right to access and also the right to be forgotten, as it is expressly foreseen in the Regulation 2016/679.