Nowak v Data Protection Commissioner (Approved)

Factual and Procedural Background

The Appellant was employed as a trainee accountant by Company A and initially lodged a complaint in 2010 regarding a personal data access request made to Company A concerning examination scripts and related materials. The complaint led to litigation culminating in a reference to the Court of Justice of the European Union (CJEU), which confirmed that examination scripts and examiner comments constitute personal data under EU law. Following this, the Appellant was provided with copies of his examination scripts and offered inspection of the originals, which he declined. Subsequent litigation and appeals addressed whether the Appellant was entitled to original documents and other regulatory complaints.

The Data Protection Commissioner (DPC) issued a decision in April 2022 addressing five specific issues raised by the Appellant as outstanding from his original complaint. The Appellant appealed this decision to the Circuit Court, which dismissed the appeal in October 2023. The present judgment concerns the Appellant’s further appeal to the High Court on points of law arising from the Circuit Court decision.

Legal Issues Presented

1. Whether the Circuit Court judge erred in law by upholding the Commissioner's decision regarding the timing of release of the examination script.
2. Whether the Data Protection Commissioner had jurisdiction to rule on the legal status of Company A's examination regulations or to make factual findings in this respect during the investigation.
3. If Company A's examination regulations for 2006-2009 were unlawful or invalid, whether this rendered the processing of examination and training contract data unlawful under the Data Protection Acts and EU Directive 95/46/EC.
4. Whether a mere assessment of a letter of complaint and supporting documentation suffices as an investigation under Section 10 of the Data Protection Acts.
5. Whether examination answer scripts constitute personal data in light of allegedly disallowed examination regulations under the 1966 Charter Amendment Act.
6. Any further points of law advanced at the hearing of the appeal.

Arguments of the Parties

Appellant's Arguments

• The Appellant contended that the DPC failed to properly investigate his complaint as required by the Supreme Court’s directive, alleging that the DPC’s process was limited to an assessment rather than a full investigation.
• He argued that the release of his examination script was outside the statutory timeframe.
• The Appellant questioned the legality of Company A’s examination regulations, claiming they were unlawful and that this invalidity impacted the lawfulness of data processing.
• He asserted a right to access original examination documents and marking schemes, citing concerns about the accuracy and potential manipulation of copies provided.
• The Appellant maintained that certain personal data had not been provided in response to his 2010 subject access request, including confirmation of appeal eligibility and reports related to his appeal.

Respondent's Arguments

• The Respondent (DPC) submitted that the issues concerning the legality of Company A’s regulations fell outside its statutory remit and jurisdiction.
• The DPC contended that the initial complaint had been fully investigated and addressed, and that the 2022 decision properly applied the law and facts.
• It was argued that the Appellant was provided with copies of all personal data held and offered inspection of originals, which he declined.
• The DPC maintained that the Appellant’s allegations of manipulation or doctoring of documents were speculative and unsupported by evidence.
• The Respondent submitted that the statutory timeframe for provision of data was complied with, with the response issued within 40 days of the request.
• The DPC emphasized its discretion in determining the scope and extent of investigations under the Data Protection Acts.

Table of Precedents Cited

Court's Reasoning and Analysis

The court carefully reviewed the procedural history, statutory framework, and prior case law, concluding that the Circuit Court had correctly applied the law and facts in dismissing the Appellant’s appeal. The court emphasized that the Data Protection Commissioner’s jurisdiction is limited to data protection matters and does not extend to assessing the legality of Company A’s examination regulations or internal rules, which fall outside the statutory remit.

The court noted that the Appellant’s arguments concerning hypothetical manipulation or doctoring of documents were unsupported by evidence and thus not justiciable. The DPC had provided the Appellant with copies of all relevant personal data and offered inspection of originals, which the Appellant declined. The statutory timeframe for responding to the subject access request was met, and the Appellant’s contention regarding timing was not part of the properly formulated complaint or appeal.

Regarding the adequacy of the DPC’s investigation, the court found that the DPC exercised its discretion appropriately, engaging extensively with the Appellant and Company A, and that the investigation complied with statutory requirements. The Appellant failed to establish serious or significant errors of law or fact warranting overturning the Circuit Court’s decision. The court also reiterated the settled legal principle that data subjects are entitled to access personal data in intelligible form but not necessarily the original documents.

Holding and Implications

The court DISMISSED the Appellant’s appeal against the Circuit Court judgment dated 9^th October 2023.

The direct effect is that the dismissal of the appeal upholds the Data Protection Commissioner’s decision of 21^st April 2022 and the Circuit Court’s ruling, confirming that the Appellant is not entitled to original examination documents and that the DPC acted within its statutory remit and discretion. No new legal precedent was established beyond the reaffirmation of existing principles concerning the scope of data subject access rights and the limits of the DPC’s jurisdiction.