High Court dismisses appeal where exam script is not personal data and complaint is frivolous.

Neutral Citation: 2012 [IEHC] 449

THE HIGH COURT

IN THE MATTER OF THE DATA PROTECTION ACTS 1988 AND 2003, IN THE MATTER OF AN APPEAL PURPORTEDLY PURSUANT TO

SECTION 26 OF THE DATA PROTECTION ACTS 1988 AND 2003

BETWEEN

PETER NOWAK

APPELLANT

AND

DATA PROTECTION COMMISSIONER

RESPONDENT

Judgment of Mr. Justice Birmingham delivered the 7th day of March, 2012

1. This matter comes before the Court by way of an appeal from the judgment of Judge Linnane of the 16th November, 2010. The

background to the matter may be stated briefly. The appellant has registered as a student with Chartered Accountants Ireland

(hereinafter "CAI") with a view to gaining a professional qualification as a chartered accountant. He sat an examination on the 7th

October, 2009 but was unsuccessful. By letter dated the 12th May, 2010, Mr. Nowak submitted a personal data access request in

which he asked CAI to release to him all personal data within the meaning of that term as set out in the Data Protections Acts 1988

to 2003 (hereinafter "the Data Protection Acts"). The letter specified that in particular he was seeking a copy of his examination

script, all personal data relating to his appeal to the Appeals Panel with regard to his failure in that examination to include any

personal data in existence concerning that appeal, any data compiled by the External Examiner and Appeals Panel and any data sent

or received by CAI whether in manual or electronic format.

2. A very considerable volume of material was furnished to Mr. Nowak by CAI but in correspondence it was made clear to him that the

material that would be provided to him would not include his examination script because CAI had received legal advice that the Data

Protection Acts did not extend to that material. In passing, it may be noted and it is certainly a very strange feature of this case that

although the procedures in relation to examinations conducted by the CAI provided exam candidates with an opportunity to read their

scripts at a particular time and under controlled conditions, that Mr. Nowak never availed of this option. By letters dated the 1st July,

2010 and the 14th July, 2010, Mr. Nowak submitted a formal complaint to the Data Protection Commissioner, the respondent. CAI, it

may be noted is registered as a "data controller" with the respondent,. These written complaints supplemented an earlier online

complaint that had been submitted by him on the 17th June, 2010. While Mr. Nowak in the form he completed and in correspondence

had raised a number of issues, his principal concern, and this is the only matter that arises on the appeal hearing, was the refusal of

CAI to provide him with a copy of his examination script based on the view that it had formed that the script did not constitute

"personal data" within the meaning of the Acts. On the 21st July, 2010, the respondent wrote to the appellant and informed him that

having examined all the papers in the matter it had been concluded that Mr. Nowak had not identified any substantive breach of the

Data Protection Acts. The letter stated:

"In accordance with s. 10(1)(b)(i) of the Data Protection Acts we are not obliged to investigate a complaint where no

substantive breach of the Act remains to be investigated".

3. By a notice of motion dated the 11th August, 2010 an appeal was brought to the Circuit Court. By letter of even date, the

respondent wrote to the appellant's solicitors stating as follows:-

"It is noted that you intend to make an appeal to the Circuit Court under the provisions of the Data Protection Acts 1988

and 2003. You should be aware that the Data Protection Commissioner has not made an appealable decision under the

provisions of s.10(1)(b)(ii) of the Data Protection Acts 1988 and 2003. The Commissioner chose not to investigate your

client's complaints as he had formed the opinion, in accordance with s.10(1)(b)(i) of the Acts, that they were frivolous or

vexatious. The Data Protection Acts do not provide for a right of appeal in such circumstances".

4. The matter came on for hearing before Judge Linnane on the 16th November, 2010. She determined that the Court did not have

jurisdiction pursuant to s.26 of the Data Protection Acts to hear an appeal as the Data Commissioner pursuant to s. 10(1)(b) of the

Acts had declined to investigate the appellant's complaint having formed the view that the complaint was "frivolous or vexatious". She

went on to hold that if she had jurisdiction to hear the appeal that she would have upheld the decision arrived at by the Commissioner

and would have agreed with his views that the examination script did not constitute personal data.

5. Section 26(3)(b) of the Data Protection Acts provides that an appeal may be brought to the High Court on a point of law against a

decision of the Circuit Court in relation to an appeal that had been brought to it. The notice of appeal in the present case which is

dated the 26th November, 2010 does not specify on what point of law the appeal is brought to the High Court but instead simply

states that Mr. Nowak appeals the whole of the order of the Circuit Court declaring that the Circuit Court did not have jurisdiction to

hear the appeal pursuant to s. 26 of the Data Protection Acts and dismissing the appeal and granting the respondent, the Data

Protection Commissioner the costs of the proceedings. However, written submissions have been exchanged and by reference to those

and more particularly by reference to the submissions delivered on behalf of the appellant it emerges that the following points of law

are said to arise on the hearing of the appeal to this Court.

(1) Was the Circuit Court correct to conclude that it had no jurisdiction to hear an appeal in circumstances where the

Data Commissioner had not embarked upon an investigation of the merits of the complaint but had declined to do so

having formed the view that the complaint was frivolous and vexatious;

(2) If the Circuit Court had jurisdiction should it have determined that the Data Commissioner was correct in concluding

that the examination scripts did not constitute "personal data" and;

(3) Should the Circuit Court have concluded that the complaint advanced by Mr. Nowak to the Data Commissioner was

one that was frivolous and vexatious.

6. Section 10(1)(b)(i) of the Data Protection Acts provides as follows:-

(a) The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act, have been,

are being or are likely to be contravened in relation to an individual either where the individual complains to him of a

contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention.

(b) Where a complaint is made to the Commissioner under paragraph (a) of this subsection, the Commissioner shall -

(i) investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or vexatious,

and

(ii) if he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned

of the matter, the subject of the complaint notify in writing the individual who made the complaint of his or her

decision in relation to it and that the individual may, if aggrieved by the decision, appeal against it, to the Court

under section 26 of this Act within 21 days from the receipt by him or her of the notification.

7. Section 26(1) of the Acts so far material provides that:

"An appeal may be made to and heard and determined by the Court against-

…

(d) a decision by the Commissioner in relation to a complaint under section 10(1)(a) of this Act".

Thus, the Circuit Court's jurisdiction is to hear and determine an appeal against a decision of the Commissioner in relation to a

complaint under s. 10(1)(a) of these Acts. The question then is whether when the Commissioner declines to investigate a complaint

because he has formed the view that the subject matter of the complaint is frivolous or vexatious, that reaching that conclusion

involves a decision which can be the subject of an appeal.

8. Section 10(1) seems to envisage that the following sequence of events will occur:-

(1) The Commissioner has to decide whether the matter submitted to him is frivolous or vexatious.

(2) If the Commissioner is of the view that the matter was not frivolous or vexatious, then, unless an amicable resolution

can be arranged within a reasonable time, he considers the matter and reaches a decision in relation to it and then

informs the complainant of the decision that has been reached and that the decision may be appealed.

(3) However, if the view is formed that the matter that has been submitted is frivolous or vexatious, then the

Commissioner does not investigate the complaint or cause it to be investigated. In that event the procedure comes to a

halt.

9. I find myself in respectful agreement with Judge Linnane that the jurisdiction of the Circuit Court is to hear an appeal against a

decision that has been arrived at after there has been an investigation. I share her view that absent investigation of the complaint

and a decision in relation to the investigation, that the Circuit Court has no jurisdiction. The entitlement of an aggrieved party in the

first place to submit an appeal and then of the Court to hear and determine an appeal arises only where there has been a decision of

the Commissioner in relation to a complaint under section 10(1)(a). However, the Commissioner reaches a decision in relation to a

complaint only if, not having decided that the matter is frivolous and vexatious, he proceeds to investigate the complaint and reaches

a decision in relation thereto.

10. Counsel for the appellant has placed reliance on the terms of Council Directive 95/46/E.C. of 24 October, 1995 on the protection

of individuals with regard to the processing of personal data and on the free movement of such data, O.J. L281 23.11.1995 and in

particular article 28.1 thereof.

11. However, if one looks at the structure of article 28 of the Council Directive 95/46/E.C., it does not seem to me that the provision

to which the appellant has drawn attention is of any real assistance. Article 28.3 is in these terms:

"3. Each authority shall in particular be endowed with:-

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and

powers to collect all the information necessary for the performance of its supervisory duties;

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are

carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking,

erasure or destruction of data,

- of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the

matter to national parliaments or other political institutions;

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been

violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts."

12. It would seem that the complaint submitted by the appellant does not fit readily within the terms of article 28.3, but would seem

to fit more naturally within the terms of article 28.4 it reads so far as material:

"4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person,

concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned

shall be informed of the outcome of the claim."

13. In any event, I am quite satisfied that the effect of ss. 10(1)(b)(i) and 26(1) when read together is quite clear and fully supports

the conclusion reached in the Circuit Court.

14. Lest I be wrong in my conclusion that the Circuit Court did not have jurisdiction to entertain the appeal and in a situation where

counsel on both sides have addressed the issues, I have decided to indicate a view on the substantive issue that the appellant had

sought to canvass in his appeal.

15. Had an appeal been possible, it would then have been necessary to consider how a court should approach the hearing of an

appeal from a body such as the Data Protection Commissioner. How a court should approach an appeal from a statutory body was

addressed by Finnegan P. in the case of Ulster Bank v. Financial Services Ombudsman [2006] IEHC 323 (Unreported, High Court,

Finnegan P., 1st November, 2006). In the course of his judgment he commented:

"To succeed on this appeal the Plaintiff must establish as a matter of probability that, taking the adjudicative process as

a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In applying the

test the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The deferential

standard is that applied by Keane C.J. in Orange v The Director of Telecommunications Regulation & Anor and not that in

The State (Keegan) v Stardust Compensation Tribunal."

16. The reference by Finnegan P. to the standard applied by Keane C.J. in Orange v. the Director Telecommunications Regulations &

Anor (Unreported, Supreme Court, Keane C.J. 18th May, 2000) was a reference to the following passage from the judgment of the

Chief Justice in that case:

"In short, the appeal provided for under this legislation was not intended to take the form of a re-examination from the

beginning of the merits of the decision appealed from culminating, it may be, in the substitution by the High Court of its

adjudication for that of the first defendant. It is accepted that, at the other end of the spectrum, the High Court is not

solely confined to the issues which might arise if the decision of the first defendant was being challenged by way of

judicial review. In the case of this legislation at least, an applicant will succeed in having the decision appealed from set

aside here (sic) it establishes to the High Court as a matter of probability that, taking the adjudicative process as a

whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In arriving at a

conclusion on that issue, the High Court will necessarily have regard to the degree of expertise and specialised knowledge

available to the [first defendant]."

17. I am satisfied that the approach identified by Finnegan P. is the one that would have been appropriate to apply had an appeal

been available. In particular, it seems to me that it would have been appropriate for the court to have regard to what Finnegan P.

referred to as the deferential standard, when deciding whether to substitute its own view for that of the Data Protection

Commissioner on the issue of whether an examination script constituted personal data. The Data Protection Commissioner is

concerned with issues involving data protection on a daily basis. He is required to be in regular contact with his colleagues in other EU

member states and is likely to be fully au fait with developments internationally. Pointing to the expertise of the Data Protection

Commissioner does not mean that a court will abdicate its responsibilities and there may be cases where decisions of the

Commissioner will be set aside, but if that happens, the decision to set aside the decision of the Commissioner will have been taken by

a court that is conscious of the experience and expertise of the Commissioner. In this case, the Commissioner concluded that the

examination script did not constitute personal data and accordingly, he was not in a position to identify any substantive breach of the

Acts. He pointed out that there was no law in this jurisdiction to suggest it was personal data and in the course of a letter of the

21st July, 2010, pointed out that there was no example of any other Data Protection Authority within the EU considering such

material to be personal data. In this case the script to which access is sought was a script created during an accountancy

examination, an open book examination. While on its face the document would not contain any reference to Mr. Peter Nowak and its

author would be identified only by an examination number, it was of course potentially possible to link scripts to individual candidates.

Obviously, if that were not so, there would be no point in setting the examination. However, little or no personal information about Mr.

Peter Nowak would be gleaned by anyone reading his script.

18. It seems to me that the conclusion arrived at by the Data Protection Commissioner was not one that would have come as a

surprise to most people. The CAI had an examination system in place and one might have expected that Mr. Nowak would have

availed of that system. If he was unhappy with aspects of the system then there was scope available to him to challenge that

system. However, what would have surprised most people was that instead of utilising the examination system to the full, Mr. Nowak

sought to invoke the data protection code in order to create a parallel examination code.

19. Accordingly, had it been possible to appeal to the Circuit Court, then, in my view, the Court would have been correct to uphold

the conclusion of the Data Protection Commissioner that the material in question did not amount to personal data within the meaning

of the Acts and accordingly to dismiss the appeal. I am of that view notwithstanding that the applicant has pointed to the provisions

of the equivalent British legislation and has drawn attention to the fact that Schedule 7 of the Data Protection Act there, which

contains a number of exemptions, lists examination scripts as an exempt category. Counsel for the applicant asks why it would be

necessary to exempt examination scripts unless, in the absence of such a specific exemption, examination scripts would fall within the

concept of personal data. It seems to me that that argument falsely assumes that all examination scripts fall to be treated in an

identical manner. However, that is not necessarily so at all. The amount of personal information contained in an examination script

may vary significantly depending on the nature of the examination. As the website of the respondent in its frequently asked questions

section points out a psychometric test or IQ test would likely contain more information relating to the person that undertook the test

than say a test of general knowledge. The examination that the applicant sat was, as we have seen, an "open book" examination.

The applicant described the process involved in the course of a letter to the Commissioner dated the 14th July, 2010. He did so in

these terms:-

"Since the above mentioned exam was an "open book" exam I was able to reproduce answers provided during the real

exam".

In the course of the written submissions on behalf of the respondent the point is made that there was little more involved here than a

transfer of model answers from text books into the examination booklet. Even if it was thought that there was an element of

overstatement in that assertion, it does nonetheless provide a clear basis for the Commissioner to have formed the view that the

examination script was not personal data.

20. Once the Commissioner had formed the view that the examination script did not constitute personal data it followed that he was

being asked to proceed with an investigation where no breach of the Data Protection Acts could be identified. It was in those

circumstances he had resort to s. 10(1)(b)(i). That section refers to complaints that are frivolous or vexatious. However, I do not

understand these terms to be necessarily pejorative. Frivolous, in this context does not mean only foolish or silly, but rather a

complaint that was futile, or misconceived or hopeless in the sense that it was incapable of achieving the desired outcome, see R. v.

Milden Hall Magistrates Courts Ex P Forest Heat D. C. -16/05/1997 Times Law Reports. Having regard to the view the Commissioner

had formed that examination scripts did not constitute personal data, he was entitled to conclude that the complaint was futile,

misconceived or hopeless in the sense that I have described, indeed such a conclusion was inevitable.

21. Having regard to the views that I have reached that Judge Linnane was correct that no appeal lay and to the views that I have

reached on the arguments in relation to the merits of the case that have been canvassed, I propose to affirm the decision of the

Circuit Court dated the 16th November, 2010.