Brussels for Christmas: Examining Data Protection

Just in time to be printed and put in your stocking came everyone’s favourite Christmas tradition: a special helping of Brussels. In this case, a judgment of the CJEU in Case C-434/16 Nowak v Data Protection Commissioner (ECLI:EU:C:2017:994) about the application of the Data Protection Directive to examination scripts and examiner comments.The Court’s judgment contains various little titbits which may make it worth citation in other contexts, and the judgment is short and pretty readable. Some edited highlights are these.

The fact that the examiner cannot identify the candidate is irrelevant when the exam board obviously can: at [31]. The test for whether data relates to a person “is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person“: at [35]. Both a script, open book or not, and examiner comments relate to the candidate, as both tell the reader something about the person’s intellect, thought processes, handwriting, suitability to carry out the examined-for profession, and the exam has an effect on the person’s rights and interests: at [37]-[43]. That the examiner’s comments may also be the personal data of the examiner is besides the point for present purposes: at [44]. The questions though are not personal data: at [58].

The CJEU did not think that finding the information to be personal data posed any risk that a candidate could seek to rectify an incorrect answer; errors in the answers given at the time are not ‘inaccurate’ data having regard for the purpose for which it was collected: at [52]-[53]. But what could need rectification is if the data controller mistakenly stores an incorrect answer paper against the records of a data subject: at [54]. Various of the rights and principles imposed by the Directive would have purchase on examination scripts so as to ensure that the controller is obliged to properly store and secure the data, as well as to allow the subject the right of access to it, or not retained after an appropriate period of time has passed: at [50], [55]. The CJEU reiterated its approach from YS that the right of access “is necessary, inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the data controller“: at [57] (although this is no basis to try and restart the now deceased purpose-based restriction on subject access requests). Finally, the Court noted that it was open to Member States (including under the GDPR) to limit the rights afforded, implicitly including in the examination context: at [60]-[61].

Nothing radically different here from the Opinion of AG Kokott (on which, see my post here), but a welcome application of common sense and clear general principle. A warm, comforting Christmas present, unlikely to cause arguments over even the most geeky of Christmas dinner tables.

Christopher Knight