Data Subjects’ Right of Appeal and Testing the Boundaries of “Personal Data”

Under Section 26 of the Data Protection Acts 1988 and 2003, an appeal before the courts is provided for against a decision of the Data Protection Commissioner in relation to a complaint under Section 10(1)(a) of the Acts. The scope and applicable review standard for such an appeal was one of two key issues which came before the Supreme Court in the recent case of Nowak v. The Data Protection Commissioner (Judgment of O'Donnell J delivered on 28th April 2016).

The second matter facing the Court was whether an examination script could be considered "personal data" within the meaning of the Data Protection Acts and/or the Data Protection Directive 95/46 EC.   Background to the Case:

Mr. Nowak was a trainee accountant who sat one of the required examinations in 2008, and again in 2009. He submitted a data access request to Chartered Accountants in Ireland (CAI) under Section 4 of the Data Protection Acts. The CAI released certain items to Mr. Nowak but declined to release the examination script on the grounds that it did not believe that it was personal data, and had received advice to this effect. Mr. Nowak then escalated his complaint to the Office of the Data Protection Commissioner (ODPC). In replying, the ODPC stated that under Section 10(1)(b)(i) there was no requirement to investigate the complaint as there was no substantive contravention of the Acts as the ODPC did not believe that the material constituted personal data within the meaning of the Acts and therefore, as the complaint was not legally sustainable, it was both frivolous and vexatious.  

(i) The applicable standard of review for a Section 26 Appeal

In the Circuit Court, Judge Linnane held that a Section 26 appeal did not lie against a determination by the ODPC that a complaint was frivolous or vexatious. Judge Linnane, however, went on to consider what the appropriate scope of such an appeal would be. Judge Linnane endorsed the test outlined by Keane C.J. in Orange Communications Ltd. v The Director of Telecommunications Regulation and anor and adopted in Ulster Bank Investment Funds Ltd. v Financial Services Ombudsman which provides as follows:  

"An applicant will succeed in having the decision appealed from set aside where it establishes that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In arriving at a conclusion on that issue, the High Court will necessarily have regard to the degree of expertise and specialised knowledge available to the first defendant."

Following unsuccessful appeals by Mr. Nowak to the High Court and the Court of Appeal, the matter came before the Supreme Court in late April of this year. The Supreme Court overturned the finding that a determination from the ODPC that a complaint which was frivolous or vexatious could not be subject to appeal. The ODPC had argued that the determination was not a "decision" against which Section 26 of the Acts envisaged a right of appeal. O'Donnell J. stated as follows: 

"The decision here, while characterised as frivolous or vexatious, is in fact a significant decision on the law relating to data protection, which it might be thought is precisely the sort of issue which should be capable of appeal to a court of law."  

As to the applicable standard of review, O'Donnell J highlighted that where an appeal is provided for in statute, very often the nature of that appeal is not specified. He went on to endorse the test as set out in Orange which was acknowledged as indicative of a "modern trend" whereby independent decision makers with a considerable degree of technical expertise are increasingly making decisions in complex areas.  

"It can be said that if an error is sufficiently clear and serious to be detectable by a non-expert court after scrutiny, then that is justification for overturning the decision, even though the court may lack more specific expertise. In my view, the Orange standard is the appropriate standard to apply."  

In endorsing this approach the Supreme Court is seeking to strike a balance between judicial oversight of bodies endowed with significant decision making powers while also seeking to have due regard to the significant expertise of such bodies. 

(ii) Was the examination paper capable of constituting "personal data" within the meaning of the Acts and/or the Directive?

The Acts define "personal data" as follows:  

"Data relating to a living individual who is or can be identified either from the data or from the data on conjunction with other information that is in, or is likely to come into, the possession of the data controller."  

The Supreme Court acknowledged that while there is no precedent from any other European data protection authority that an examination script is personal data, it must be said "that the opposite is also true". There was a lingering question as to whether the paper could in fact be personal data considering that an examination result is capable of being personal data, as indirectly recognised under Section 4(6) of the 1988 Act, but the Court decided that on this point, it was ultimately a matter for EU law. Accordingly, the Court proposed to refer relevant questions to the CJEU (Court of Justice of the European Union).  

Comment:  In making it clear that data subjects have rights of appeal against an ODPC determination not to investigate a complaint under Section 10(1)(a) on the grounds that it is frivolous or vexatious, the Supreme Court is recognising that a valid legal issue arises. This is a welcome development and is somewhat reminiscent of the Schrems case in which Mr Schrems took a judicial review against the ODPC's decision not to investigate his complaint. In its analysis of both Section 10 and Section 26 of the Data Protection Acts, and having regard to the ordinary meaning of the language employed, the Supreme Court is further vindicating the rights of data subjects to appeal unfavourable determinations and makes it clear that rights of appeal should not become swallowed up by procedural limitations. As for the question concerning the examination script, this represents an opportunity for the CJEU to provide guidance as to the boundaries of what constitutes "personal data". In the YS case, Advocate General Sharpston said that "only information relating to facts about an individual can be personal data." This was in respect of a legal analysis in connection with the grant of residence permits.

In its ruling on the joined cases , the CJEU confirmed that the legal analysis contained personal data but that did not give rise to a right to access the legal analysis itself. It will be interesting to see whether a similar analysis might be applied and adapted to the contents of an examination script when the Supreme Court reference in Nowak comes before the CJEU.

For more information please contact Claire Rush or your usual contact in A&L Goodbody.

Date Published: 24 May 2016