Solicitor Fred Logue of FP Logue Solicitors writes on accessing exam scripts under data protection rules.

“Does an examination script contain personal data in such a way that an examination candidate might therefore ask the examination body for access to his own script on the basis of the Data Protection Directive?”

That is the question that the Court of Justice of the European Union was asked by the Supreme Court in Nowak.

Yesterday saw the publication of Advocate General Kokott’s opinion and her view that exam scripts are personal data and in principle are accessible under the Data Protection Directive. She went on to find that the right of access is unlikely to be used as a way for candidates to look to correct errors in the exam under the right of rectification. She also went on to observe that the right of access and the definition of personal data itself is not to be construed merely in the context of the rights of objection, erasure and rectification.

So why is an exam script personal data?

The Data Protection Commissioner had argued that an exam script merely recorded information, i.e. the answers to questions and at the very most only the result of the exam could be construed as personal data.

Dismissing this narrow interpretation AG Kokott noted that rather than simply recording information independent of an individual, an exam script shows how a candidate thinks and works and is used to determine the strictly personal and individual performance of the exam candidate. She found support for this conclusion from the fact that a candidate would have a legitimate interest in objecting to the processing of his script for purposes outside of the context of the examination process.

AG Kokott provided an extensive discussion of the purpose of the right of access to personal data and noted that the definition of what is personal data could not be constrained by concerns about other matter such as the right of rectification.

She noted that accuracy and completeness must be judged in light of the context in which the personal data was created and that in the context of an exam, incorrect answers could not be said to be inaccurate or incomplete in the same way as, for example, would be the case if exam scripts were mixed up or parts of it were missing.

The issue of whether Mr Nowak was abusing the right of access given that he could have availed of an appeal process was also addressed. Again AG Kokott noted that the legislature had given precedence to Data Protection Rights. She also noted that when the GDPR comes into effect there will be new provisions which qualify the right of access to protect the rights and freedoms of others and for other important public interest reasons.

However the mere existence of other national legislation that also deals with access to exam scripts could not give rise to an assumption that the subject access right was being misused nor could the possibility of circumventing the examination complaints procedure be a reason for excluding the application of data protection legislation.

This is a very thorough opinion and highlights the fundamental importance of the right of access as well as the need to adopt a purposive approach to the definition of what is personal data. The connection between the individual and the context is key rather than simply considering the nature of the information itself.

So what happens next?

The CJEU will issue its decision later this year in what is likely to be a significant precedent for interpretation of the GDPR.