[2018] IEHC 118
THE HIGH COURT
(CIRCUIT COURT APPEALS)
[2014 No. 118 C.A.]
[CIRCUIT COURT 2013 No. 10332]
IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 & 2003
IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26 OF THE DATA PROTECTIONS ACTS 1988 & 2003
PETER NOWAK
APPELLANT
AND
DATA PROTECTION COMMISSIONER
RESPONDENT
AND
INSTITUTE OF CHARTERED ACCOUNTANTS IN IRELAND
NOTICE PARTY
JUDGMENT of Mr. Justice Coffey delivered on the 26th day of February, 2018
1. This is an appeal on a point of law against an order of the Circuit Court made on the 3rd June, 2014 dismissing the appellant’s appeal of a decision of the respondent made on the 27th January, 2014.
2. In its decision of the 3rd June, 2014 the Circuit Court determined, inter alia:-
(1) That an exam script involving the transposition of model answers from a text book to an exam sheet did not constitute “personal data” within the meaning and for the purposes of the Data Protection Acts 1988 and 2003;
(2) That insofar as the respondent had determined that the appellant’s complaint did not require investigation because the exam script in issue did not contain personal data, the complaint was unfounded in law and could not be appealed under s. 26 of the Data Protection Act 1988 (“the Act of 1988”).
3. The respondent accepts that, arising from subsequent decisions of the European Court of Justice and the Supreme Court respectively, both of these issues have been determined in favour of the appellant. These decisions arose from an earlier but related appeal brought by the appellant against a decision of the respondent made on the 21st July, 2010.
4. In a preliminary reference from the Supreme Court, the European Court of Justice in Case C-434/16 held that Article 2(a) of Directive 95/46/EC must be interpreted as meaning that the written answers submitted by a candidate at a professional examination and any comments made by an examiner therein with respect to those answers constitute personal data within the meaning of the said provision.
5. In Nowak v. Data Protection Commissioner [2016] 2 I.R. 585, the Supreme Court held that the mere fact that the respondent determined that a complaint was ill-founded in law did not preclude the appellant from bringing a statutory appeal pursuant to s. 26 of the Act of 1988.
6. The appellant’s appeal to the Circuit Court included an appeal from the decision of the respondent on the issue of whether the right of access under s. 4 of the Data Protection Act 1988 entitled him access to the original exam script, an issue which appears not to have been determined by the Circuit Court.
7. For the foregoing reasons, the parties have consented to the making of the following orders by this Court:-
(1) An order quashing the decision of the Circuit Court insofar as it held that an appeal did not lie against the decision of the respondent made on the 27th January, 2014;
(2) An order quashing the decision of the Circuit Court insofar as it held that an exam script of the nature at issue in these proceedings did not constitute personal data;
(3) A consequential order quashing the decision of the respondent made on the 27th January, 2014 insofar as it held that an exam script of the nature at issue in these proceedings did not constitute personal data;
(4) A declaration that the Circuit Court erred in law in failing to address the issue of whether the appellant is entitled to a declaration that the right of access under s. 4 of the Data Protection Acts 1988 and 2003 entitles a data subject to access the originals of his or her personal data.
8. Rather than remitting it to the Circuit Court, the parties have consented to this Court determining the only remaining issue, namely whether a data subject, pursuant to s. 4 of the Data Protection Acts 1988 and 2003, is entitled to access his or her personal data in its original form.
The Data Protection Directive
9. EU Directive 95/46/EC was adopted in 1995 and regulates the processing of personal data within the European Union.
10. The purpose underlying the Directive is discernable from the recitals in the preamble, specifically recital (2) which states that data processing systems must “respect (the) fundamental rights and freedoms (of natural persons), notably the right to privacy …”
11. Recitals (25) and (41) deal with questions of access to personal data and state as follows:-
12. Article 12 provides for the right of access in the following terms:-
“Member States shall guarantee every data subject the right to obtain from the controller:
(a) without constraint at reasonable intervals and without excessive delay or expense:
- confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,
- communication to him in an intelligible form of the data undergoing processing and of any available information as to their source,
- knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15(1):
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
(c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.”
13. Article 14 provides for the data subject’s right to object as follows:-
“Member States shall grant the data subject the right:
(a) at least in the cases referred to Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
(b) to object, on request and free of charge, to the processing of personal data relating to him which the controller anticipates being processed for the purposes of directing marketing, or to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses.
Member States shall take the necessary measures to ensure that data subjects are aware of the existence of the right referred to in the first subparagraph of (b)”.
14. Article 22 provides for remedies and states:-
“Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question”.
15. Article 23 provides for a right to compensation in certain circumstances:-
The Charter of Fundamental Rights of the European Union
16. Article 8 of the Charter guarantees everyone the right to protection of personal data concerning him or her. Article 8(2) is of relevance and provides:-
“Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.”
Relevant Implementing Legislation
17. Section 1 of the Data Protection Act 1988 defines a “data subject” as “an individual who is the subject of personal data”. Section 4(1)(a) of the Act of 1988 (as inserted by s. 5 of the Data Protection (Amendment) Act 2003) reflecting Article 12 of the Directive, gives a data subject a right of access to data in the following terms:-
18. Section 4(9) of the Act of 1988 (as inserted by s. 5 of the Data Protection (Amendment) Act 2003) provides that–
Relevant Case Law
19. Joined cases C-141/12 and C-372/12, Y.S. v. Minister voor Immigratie, Integratie en Asiel, Minister voor Immigratie, Integratie en Asiel v M [2015] 1 WLR 609, concerned the right of access under Article 12(a) of the Directive to, inter alia, minutes drafted before the adoption of administrative decisions on the applications of the persons concerned for residence permits. Having found that the relevant minutes contained “personal data”, the European Court of Justice held that in order to comply with the right of access provided for by Article 12(a) of the Directive and Article 8(2) of the Charter, it was “sufficient” for the applicant to be provided with “a full summary” of all his data in an intelligible form.
20. The court arrived at this conclusion by the following reasoning:-
“57. Although Directive 95/46 requires Member States to ensure that every data subject can obtain from the controller of personal data communication of all such data processed by the controller relating to the data subject, it leaves it to the Member States to determine the actual material form that that communication must take, as long as it is ‘intelligible’, in other words it allows the data subject to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that that person may, where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the directive. …
58. Therefore, in so far as the objective pursued by the right of access may be fully satisfied by another form of communication, the data subject cannot derive from either Article 12(a) of Directive 95/46 or Article 8(2) of the Charter the right to obtain a copy of the document or the original file in which those data appear. In order to avoid giving the data subject access to information other than the personal data relating to him, he may obtain a copy of the document or the original file in which that other information has been redacted”.
21. In Deer v. The University of Oxford [2017] EWCA Civ 121, the Court of Appeal for England and Wales considered the nature and extent of the right of access that is given to the data subject under the equivalent provisions of the United Kingdom Data Protection Act 1998.
22. Section 7(1)(c) of the UK Act is similar to s. 4(1)(iii) of its Irish counterpart insofar as it provides for an obligation to communicate in intelligible form “the information constituting any personal data of which the individual is the data subject”. In its analysis of the relevant provisions, the Court of Appeal stated that it was of “critical importance” to note that the obligation under the Act was an obligation “to supply the information itself” and not “an obligation to supply documents”(see per paras. 92-93 of the judgment).
23. The court went on to observe that “the mere supply of copy documents” may not be enough to comply with all the requirements of the relevant section where, for example, the supply of the copy documents does not disclose to whom the personal data has been disclosed or the source of the personal data in question.
Decision
24. Section 4 of the Data Protection Act 1988, insofar as it is inserted by section 5 of the Data Protection (Amendment) Act 2003, was enacted to give effect to Directive 95/46/EC, and as such this Court should interpret its provisions conformably with the Directive.
25. It is clear that the obligation provided for under both the Directive and s. 4(1)(a)(iii) of the Act of 1988 is an obligation to communicate the relevant information not in its original form but rather in an “intelligible form” to the data subject. Prima facie this leaves it to the data controller to decide in what material form the data is communicated. This is subject to the caveat established at para. 57 of YS & Ors. that, the material form chosen by the data controller must be sufficient to allow the data subject to “become aware of those data and to check that they are accurate and processed in compliance with (the) Directive, so that the person may, where relevant exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the Directive”.
26. Section 4(1)(a)(iii) of the Act of 1988 must, however, be construed in the light of s. 4(9) of the Act which provides:-
27. Prima facie the provisions of s. 4(9) of the Act of 1988 appear to do no more than declare the legal consequence of supplying the data subject with a copy of the information concerned in permanent form. However, the use of the word “shall” followed by the word “unless” and the subsequent specification of three exceptions indicates that the subsection is to be construed as providing for a mandatory requirement that a copy of the information concerned in permanent form is to be supplied to the data subject who requests access to his or her personal data unless the exceptions provided for at s. 4(9)(a) or (b) apply.
28. It follows that where a data subject duly request access to his or her personal data under s. 4(1)(a)(iii) of the Act, the data controller is obliged to supply a copy of the information concerned in permanent form to the data subject unless the supply of such a copy is not possible or it would involve disproportionate effort or the data subject agrees to the information being communicated in some other material form.
29. Absent such an agreement and where either of the exceptions specified at s. 4(9)(a) apply, the data controller is not obliged to supply to the data subject a copy of the information concerned in permanent form. However, pursuant to s. 4(1)(a)(iii) of the Act the data controller is obliged to communicate the data in an “intelligible form”, that is, in a form that is sufficient to allow the data subject to “become aware of those data and to check that they are accurate and processed in compliance with (the) Directive so that the person may where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the Directive” (see judgment of ECJ in Y.S. & Ors).
30. It follows from the foregoing that the obligation on a data controller to provide a data subject with personal data, whether arising from s. 4(9) or s. 4(1)(a)(iii) of the Act, does not extend to an obligation to provide the data in its original material form or, in the case of a document, to provide the original of that document.
