Una prova d’esame scritta a mano, attribuibile ad un candidato, incluse le eventuali correzioni degli esaminatori, costituisce dati personali
OPINION OF ADVOCATE GENERAL KOKOTT
delivered on 20 July 2017
Case C‑434/16
Peter Nowak
v
Data Protection Commissioner
(Request for a preliminary ruling from the Supreme Court (Ireland))
I. Introduction
1. Does an examination script consist of personal data in such a way that an examination candidate might therefore be entitled to ask the examination body for access to his own script on the basis of the Data Protection Directive? (2) This is the issue addressed by the present request for a preliminary ruling from the Irish Supreme Court. However, the main proceedings do not directly deal with access to an examination script, but concern the refusal of the former Irish Data Protection Commissioner to pursue a complaint made in response to the denial of access.
2. The central question at issue here is whether the answers given by an examination candidate in an examination script may constitute personal data. Some subsidiary questions can also be discussed, such as whether it is significant that the script was handwritten and whether the examiner’s corrections on the script are also the personal data of the examination candidate.
3. Although the Data Protection Directive will shortly be repealed by the General Data Protection Regulation, which is not yet applicable, (3) the latter will not affect the concept of personal data. Therefore, this request for a preliminary ruling is also of importance for the future application of the EU’s data protection legislation.
[…]
1. Definition of personal data
18. The scope of the Data Protection Directive is very wide and the personal data covered by the Directive is varied. (4) In accordance with Article 2(a) ‘personal data’ means any information relating to an identified or identifiable individual.
(a) The classification of examination scripts
19. The present Irish Data Protection Commissioner takes the view that an examination script, in particular when the use of one’s own reference material is allowed, does not constitute personal data. That view may be correct, in general, when an assessment is made, in isolation, of the solution to examination exercises. Since examination exercises are normally formulated in abstract terms or relate to hypothetical situations, (5) answers to them are not liable to contain any information relating to an identified or identifiable individual.
20. Although the questions raised by the Supreme Court actually appear to address only the solution, i.e. ‘information recorded … by a candidate’, it would not be sensible to end the analysis there.
21. That is because, as nearly all the other parties have rightly submitted, an examination script contains not only information about the solution to certain exercises but links that solution to the individual examination candidate who produces the script. The script is a documentary record that that individual has taken part in a given examination and how he performed. The personal connection to that performance is also shown in the fact that examination candidates often include their most important examination results in their CVs.
22. Whether a script consists of one’s own composed answers or the selection of specified answers in a multiple choice procedure is of as little importance for the classification of an examination script as incorporating personal data as the possibility in the present case of being able to use certain material (an ‘open book examination’).
23. It is true that the extent of the link between an examination candidate and his performance in an examination increases according to the extent to which he has to formulate the answers himself. That is because the formulation of one’s own solution is not confined merely to reproducing information that has been learned but also shows how the examination candidate thinks and works.
24. However, in every case, the aim of an examination — as opposed, for example, to a representative survey — is not to obtain information that is independent of an individual. Rather, it is intended to identify and record the performance of a particular individual, i.e. the examination candidate. Every examination aims to determine the strictly personal and individual performance of an examination candidate. There is a good reason why the unjustified use in examinations of work that is not one’s own is severely punished as attempted deception.
25. Consequently, an examination script incorporates information about the examination candidate and is in that sense a collection of personal data.
26. That this is the correct conclusion is also shown, moreover, in the fact that an examination candidate has a legitimate interest, based on the protection of his private life, in being able to object to the processing outside the examination procedure of the examination script ascribed to him. An examination candidate does not have to accept that his script can be disclosed to third parties or published without his permission.
27. Contrary to the argument of the Irish Data Protection Commissioner, the personal data incorporated in an examination script is not confined to the examination result, the mark achieved or even points scored for certain parts of an examination. That marking merely summarises the examination performance, which is recorded in detail in the examination script itself.
28. The classification of an examination script as incorporating personal data is not affected if, instead of bearing the examination candidate’s name, the script has an identification number or bar code. Under Article 2(a) of the Data Protection Directive, it is sufficient for the existence of personal information that the data subject may at least be indirectly identified. (6) Thus, at least where the examination candidate asks for the script from the organisation that held the examination, that organisation can identify him by means of the identification number.
(b) Importance of handwriting
29. Mr Nowak, Poland and the Czech Republic also rightly argue that answers that are handwritten contain additional information about the examination candidate, namely about his handwriting. A script that is handwritten is thus, in practice, a handwriting sample that could at least potentially be used at a later date as evidence to determine whether another text was also written in the examination candidate’s writing. It may thus provide indications of the identity of the author of the script.
30. The question whether such a handwriting sample is a suitable means of identifying the writer beyond doubt is of no importance for its classification as personal data. Many other items of personal data are equally incapable, in isolation, of allowing the identification of individuals beyond doubt. For that reason, neither is it necessary to determine whether the handwriting should be regarded as biometrical information.
[…]
2. Purpose of the right of access
31. Contrary to the view held by Ireland, neither does the purpose of the right of access to personal data set out in recital 41 of the Data Protection Directive preclude the classification of an examination script as personal data. It is stated there that any person must be able to exercise the right of access to data relating to him which is being processed, in order to verify in particular the accuracy of the data and the lawfulness of the processing. Ireland is concerned that, on this basis, in conjunction with the right of rectification laid down in Article 12(b), the examination candidate will seek the correction of incorrect examination answers.
(a) Teleological interpretation of the concept of ‘personal data’
32. First, it must be remembered that the issue of right of access is only secondary in this case, where the main issue is in fact the interpretation of the concept of ‘personal data’. As the Commission rightly pointed out at the hearing, a number of additional requirements of the Data Protection Directive are linked to this concept. Thus, for example, Article 6(1)(a) requires that personal data be processed fairly and lawfully and Article 6(1)(b) provides that personal data is only collected and processed for specific purposes.
33. In the context of the present case, it is of particular interest that under Article 8(3) of the Charter of Fundamental Rights, Article 16(2) TFEU and Article 28 of the Data Protection Directive, supervisory authorities, acting in complete independence, are to monitor compliance with EU provisions dealing with the protection of individuals with regard to the processing of personal data. (7) In that connection, Article 8(1) and (3) of the Charter and Article 28(4) of the Data Protection Directive guarantee to the individuals to which the data in question relates the right that their claims regarding the protection of their fundamental rights should be heard by the national supervisory authorities. (8)
34. Therefore, the classification of information as personal data cannot be dependent on whether there are specific provisions about access to this information which might apply in addition to the right of access or instead of it. Further, neither can problems connected with the right of rectification be decisive in determining whether there exists personal data. If those factors were regarded as determinative, certain personal data could be excluded from the entire protective system of the Data Protection Directive, even though the rules applicable in their place do not ensure equivalent protection but fragmentary protection at best.
(b) Rectification of data
35. However, if one concentrates on the right of access and the issue of rectification, it must be recognised that in relation to an examination script this right clearly cannot be claimed in order, subsequent to obtaining that access, to demand rectification, pursuant to Article 12(b) of the Data Protection Directive, of the contents of the script, i.e. the solution written down by the examination candidate. (9) As Poland has rightly emphasised, the accuracy and completeness of personal data pursuant to Article 6(1)(d) must be judged by reference to the purpose for which the data was collected and processed. The purpose of an examination script is to determine the knowledge and skills of the examination candidate at the time of the examination, which is revealed precisely by his examination performance and particularly by the errors in the examination. The existence of errors in the solution does not therefore mean that the personal data incorporated in the script is inaccurate.
36. However, rectification would be conceivable if it were the case that the script inaccurately or incompletely recorded the examination performance of the data subject. For example, such a situation would arise if — as observed by Greece — the script of another examination candidate had been ascribed to the data subject, which could be shown by means of, inter alia, the handwriting, or if parts of the script had been lost.
37. Furthermore, the possibility cannot be excluded that an examination candidate may have a legitimate interest at a later date in having personal data incorporated in the script erased under Article 12(b) of the Data Protection Directive, i.e. in having the script destroyed. Such an interest might be assumed at the latest when the script has lost any probative value in terms of checking the examination result because the relevant time limits have expired. This right of erasure again presupposes recognition of the incorporation of personal data in the script.
38. Finally, rectification and the other rights set out under Article 12(b) of the Data Protection Directive, namely blocking and erasure, are not the sole aims of the right of access.
39. Recital 41 does indeed describe the purpose of access as being that the data subject may verify in particular the accuracy of the data and the lawfulness of the processing. By using ‘in particular’ in most language versions, (10) however, the legislature has indicated that the purpose goes further. For even irrespective of rectification, erasure or blocking, data subjects generally have a legitimate interest in finding out what information about them is processed by the controller.
40. It is indeed true that an examination candidate’s need for information is initially likely to be extremely limited with respect to an examination script. He will generally still have a relatively good recollection of the contents of his answers and also assume that the examination body is still retaining his script.
41. A few years later, that recollection is likely to be considerably weaker, so that a genuine need for information, for whatever reasons, will be reflected in a possible request for access. In addition, there is greater uncertainty with the passing of time — in particular, once any time limits for complaints and checks have expired — about whether the script is still being retained. In such circumstances the examination candidate must at least be able to find out whether his script is still being retained. That right, too, presupposes that the incorporation of the examination candidate’s personal data in the script is recognised.
(c) Abuse of the right of access
42. Further, the question of abuse of the rights laid down by data protection legislation must be examined, because the complaint lodged by Mr Nowak was classed as abusive by the Data Protection Commissioner in Ireland and his claim to access considered abusive in the present proceedings by the Czech Republic. That criticism appears to refer to the fact that Mr Nowak did not use the procedure established for checking the examination result but claimed a right of access under data protection legislation.
43. In that regard, it is true that it is not permitted improperly or fraudulently to take advantage of provisions of EU law. (11)
44. A finding of an abusive practice requires a combination of objective and subjective elements. First, with regard to the objective element, such a finding requires that it must be apparent from a combination of objective circumstances that, despite formal observance of the conditions laid down by EU rules, the purpose of those rules has not been achieved. Second, such a finding requires a subjective element, namely that it must be apparent from a number of objective factors that the essential aim of the transactions concerned is to obtain an undue advantage. The prohibition of abuse is not relevant where the activity carried out may have some explanation other than the mere attainment of an (undue) advantage. (12)
45. If examination scripts incorporate personal data, according to the pleadings of the Data Protection Commissioner and Ireland, a misuse of the aim of the Data Protection Directive would arise in so far as a right of access under data protection legislation would allow circumvention of the rules governing the examination procedure and objections to examination decisions.
46. However, any alleged circumvention of the procedure for the examination and objections to the examination results via the right of access laid down by data protection legislation would have to be dealt with using the provisions of the Data Protection Directive. In that regard, Article 13 in particular comes to mind, which allows for exceptions to the right of access to be established to protect certain interests specified therein.
47. To the extent that these grounds do not justify exceptions in certain situations, as may be the case in connection with examinations, it must be recognised that the legislature has given precedence to the data protection requirements which are anchored in fundamental rights over any other interests affected in a specific instance.
48. However, it should be pointed out that the General Data Protection Regulation, which will apply in the future, resolves this tension. First, under Article 15(4) of the regulation, the right to obtain a copy of personal data is not to adversely affect the rights and freedoms of others. Second, Article 23 of the regulation sets out the grounds for a restriction of data protection guarantees in slightly broader terms than Article 13 of the Directive, since, in particular, protection of other important objectives of general public interest of the Union or of a Member State pursuant to Article 23(1)(e) of the regulation may justify restrictions.
49. On the other hand, the mere existence of other national legislation that also deals with access to examination scripts is not sufficient to allow the assumption that the purpose of the Directive is being misused.
50. However, even if one wished to assume misuse of purpose, it is still not apparent where the undue advantage lies if an examination candidate were to obtain access to his script via his right of access. In particular, no abuse can be identified in the fact that someone obtains information via the right of access which he could not otherwise have obtained. If there were already access to personal information, the introduction of a right of access under data protection law would not have been required. It is instead the task of the right to access under data protection legislation to make available to the person concerned — subject to the exceptions provided for in Article 13 of the Data Protection Directive — access to his own data, where otherwise no right of access exists.
3. Interim conclusion
51. In brief, it can be concluded that a handwritten examination script capable of being ascribed to an examination candidate constitutes personal data within the meaning of Article 2(a) of the Data Protection Directive.
B. Examiner’s corrections on the examination script
52. Some of the parties and in particular Mr Nowak raise the question of whether any corrections made by the examiner on the examination script are also personal data with respect to the examination candidate.
53. However, an answer to this question is not necessary for a decision in the main proceedings since it is not at issue whether any such corrections constitute information about Mr Nowak. Rather, the subject matter of the proceedings is whether the then Irish Data Protection Commissioner was entitled to dismiss the complaint submitted by Mr Nowak on the ground that his examination script was a priori not personal data. The extent to which corrections should also be regarded as data relating to the examination candidate would have to be ruled upon not by the Supreme Court but rather, should the action be successful, at first instance by the present Irish Data Protection Commissioner. I will however discuss this point in case the Court should nonetheless decide to address it.
54. As opposed to the examination script overall, it is hard to imagine a right of rectification, erasure or blocking of inaccurate data, under data protection legislation, in relation to corrections made by the examiner. It appears inconceivable that comments made on the script could in fact refer to another script or not reflect the examiner’s opinion. It is precisely that opinion that the comments are meant to record. Therefore, in the context of the Data Protection Directive, such comments would not be wrong or in need of correction even if the evaluation recorded in them were not objectively justified.
55. Any objections to the comments would consequently have to be dealt with as part of a challenge to the evaluation of the script.
56. It would of course be conceivable that the right of erasure mentioned above in connection with the script might extend also to the corrections.
57. The primary purpose however of a right of access to the corrections made by the examiner would be to inform the examination candidate about the evaluation of particular sections of his script.
58. In that respect, the present case resembles one in which the Court refused extension of the right of access to the draft legal analysis of an asylum application on the grounds that that did not serve the purpose of the Data Protection Directive but would establish a right of access to administrative documents. (13) In this case, it could be assumed that access to information about the evaluation of an examination script should be obtained primarily through the examination procedure or a special procedure for challenging examination decisions and not on the basis of data protection legislation. Where such an examination procedure is not determined by EU law, any claims to information made in connection with it would depend on national legislation alone.
59. Furthermore, in the aforementioned judgment the Court ruled that such a legal analysis is not information relating to the applicant for a residence permit, but at most information about the assessment and application by the competent authority of the law to the applicant’s situation. (14) At first glance, this finding could also be transposed to the examiner’s corrections. They would therefore merely show how the examiner assessed the answers.
60. In fact, it is not at all necessary that an examiner knows who produced a script when marking it. On the contrary, in many written examination procedures, such as is the case in the main proceedings, importance is placed on examiners not finding out the identity of the candidates, in order to exclude conflicts of interest or bias. Their comments initially bear no relation to the identity of the examination candidate, as indeed is the case with the examination at issue here.
61. Nonetheless, the purpose of comments is the evaluation of the examination performance and thus they relate indirectly to the examination candidate. The organisation holding the examination is also able to identify the candidate without difficulty and link him with the corrections once it receives the marked script back from the examiner.
62. Moreover, as Austria has submitted, in general, comments on an examination script are typically inseparable from the script itself — as opposed, for example, to a short appraisal report concerning the script — because they would not have any informative value without it. However, the script itself incorporates, as previously stated, personal data of the examination candidate. The purpose of collecting and processing this data is precisely to permit the evaluation of the examination candidate’s performance as incorporated in the examiner’s corrections.
63. Precisely because of that close link between the examination script and any corrections made on it, the latter also are personal data of the examination candidate pursuant to Article 2(a) of the Data Protection Directive.
64. The possibility of circumventing the examination complaint procedure is not, by contrast, a reason for excluding the application of data protection legislation. The fact that there may, at the same time, be additional legislation governing access to certain information is not capable of superseding data protection legislation. At most it would be admissible for the individuals concerned to be directed to the simultaneously existing rights of information, provided that these could be effectively claimed.
65. It should be mentioned for the sake of completeness that corrections made by the examiner are, at the same time, his personal data. His rights are an appropriate basis in principle for justifying restrictions to the right of access pursuant to Article 13(1)(g) of the Data Protection Directive if they outweigh the legitimate interests of the examination candidate. However, the definitive resolution to this potential conflict of interests is likely to be the destruction of the corrected script once it is no longer possible to carry out a subsequent check of the examination procedure because of the lapse of time.
C. Additional requirements for the application of the Data Protection Directive
66. The Commission rightly points out that the application of the Data Protection Directive and of the right to access is subject to additional requirements, beyond the existence of personal data, and also allows restrictions on the right to information.
67. However, no questions have been raised about these additional requirements and restriction options and therefore the Court need not address them. It would also appear that their consideration is not necessary in order for the Supreme Court to be able to rule on whether the then Irish Data Protection Commissioner was right to refuse further examination of the complaint made by Mr Nowak.
68. Should the Court nonetheless wish to comment on these questions, Article 3(1) of the Data Protection Directive in particular would initially appear of interest. This states that the Directive is to apply only to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
69. It does not seem obvious that Mr Nowak’s examination script was processed by automatic means, such as being entered and saved in an electronic data processing system. It can nevertheless be assumed that it is at least part of a ‘filing system’. For, according to Article 2(c) of the Data Protection Directive, a filing system does not necessarily have to be saved in an electronic data processing system. Rather, this concept covers any structured set of personal data which is accessible according to specific criteria. A physical set of examination scripts in paper form ordered alphabetically or according to other criteria meets those requirements.
V. Conclusion
70. I therefore propose that the Court should rule as follows:
A handwritten examination script capable of being ascribed to an examination candidate, including any corrections made by examiners that it may contain, constitutes personal data within the meaning of Article 2(a) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
Silvia Martinelli 
Leave a Reply