The Irish Court of Appeal has held that while the definition of “personal data” is very broad, to interpret a document as constituting personal data for the sole reason that it was generated as a result of a complaint made by the data subject, would be to “overstretch” the concept of personal data.  In a related judgment, the Court found that the data subject was entitled only to a “copy“ of his personal data, and not the data in its “original“ form.

Background

On 1 July 2020, the Court of Appeal issued two related judgments in Nowak v Data Protection Commissioner (DPC) . The decisions relate to a request made by Mr Nowak in 2013, for access to his original exam scripts from the Institute of Chartered Accountants Ireland (ICAI) and memoranda from PwC (his former employer) under the Data Protection Acts 1988 and 2003 (DPA).  PwC and ICAI were notice parties to the  proceedings.

The High Court held that Mr Nowak was only entitled to a “copy” of the exam scripts, rather than the “original” scripts. As a result, the ICAI released copies of the exam scripts to Mr Nowak in June 2018. The ICAI also, although not obliged to, offered Mr Nowak access to inspect the original scripts under controlled conditions. Mr Nowak refused.  In a related judgment, the High Court held that Mr Nowak was not entitled to a copy of memoranda he had requested from PwC, on the grounds that it did not constitute his “personal data”.

Court of Appeal Decisions

(i) Is there an obligation to provide personal data in its ‘original’ form?

Haughton J., in Nowak v DPC [2020] IECA 175, confirmed that the right of access to personal data under Article 12 of the Data Protection Directive 95/46/EC (Directive), as implemented by section 4 of the DPA, had been correctly interpreted by the High Court. The High Court judge had properly relied on the decision of the CJEU in Y.S., which clearly supported the argument of the DPC that under the Directive the data subject’s entitlement is access to the relevant information/personal data in an “intelligible form”, and does not support a right to personal data in its “original” form.

Mr Nowak had argued in his appeal that when there are suspicions that a copy document has been “doctored”, access to the original is desirable. Mr Nowak had also argued that, unless the person seeking the data has access to the original, they cannot “check to see whether the data is accurate”. Mr Nowak said he “had concerns about the original scripts” and believed the copy was not correct. Haughton J. was satisfied Mr Nowak could not pursue the “doctoring” argument as it was based on hypothetical facts. There had never been any evidence before the DPC or the Circuit Court of doctoring or manipulation. When a case is appealed to the High Court and further again to the Court of Appeal, under section 26 of the DPA 1988 and 2003, all that can be determined is a point of law. It must take the facts presented on affidavit and as found by the Circuit Court, and determine the point of law raised on those facts.

Haughton J. also noted that the Y.S decision does not even give a right to access copy documents, but rather information constituting the personal data in the documents. He stated that the High Court judge had correctly cited the UK Court of Appeal decision in Ittahdieh/Deer as “persuasive authority supportive of the purposive approach adopted in Y.S. and the notion that the Directive is concerned with access to personal data/information and not with targeting documents per se”. The Court acknowledged that section 4(9) of the DPA went further than the Directive, which does not go so far as to require a “copy” of the data, but merely requires communication to the data subject of an “intelligible form of the data”. However, he stated, that there are statutory exemptions from the right of access, and other circumstances where, for example, “if personal data is mixed with other information which is commercially sensitive, or contains information related to other individuals that is covered by GDPR, then it is conceivable that there is no entitlement to a copy of the information…and the obligation may be satisfied by communication of the relevant data by redacted copy or written narrative or in some other intelligible form”.

Haughton J. concluded that the High Court was correct in determining that the obligation on the ICAI did not extend to an obligation to provide the “original” exam scripts to Mr Nowak, or to produce them for inspection and Mr Nowak had failed to prove any error of law.

(ii) Does memoranda stemming from a complaint by a data subject constitute his/her personal data?

Binchy J., in Nowak v DPC [2020] IECA 174, dismissed Mr Nowak’s appeal. The Court held that memoranda provided by PwC (in response to a complaint made by Mr Nowak) to the Chartered Accountants Regulatory Board (which regulates PwC’s activity), did not constitute Mr Nowak’s personal data.

The Court of Appeal noted the appeal centred around the meaning of the term “relating to” when determining whether the memoranda contained Mr Nowak’s personal data.  Binchy J. held that, it is clear from the Working Party 29 Opinion on the concept of Personal data, and the CJEU decision in YS, that in considering whether or not personal data “relates to” an individual and constitutes personal data, it is necessary to consider whether the information, by reason of its “content, purpose or effect” is linked to a particular person.

Binchy J. examined the memoranda in light of those factors. He noted that the “content” of the memoranda did not refer to Mr Nowak by name, nor identify him in any way. The “purpose” of the memoranda concerned PwC’s compliance with its professional and accountancy standards, and any “effect” of the memoranda could only impact PwC. Accordingly, the memoranda could not in any way engage Mr Nowak’s privacy interests. Mr Nowak could have no need to see the memoranda to assess their accuracy, or to request amendments thereto, because they did not refer to him in any way.

Binchy J. concluded that “while the definition of personal data is deliberately very broad, to interpret the Memoranda as being personal data for the purposes of the Data Protection Acts and/or the Directive, for the sole reason that it was generated as a result of a complaint made by the appellant would, in my opinion, be to “overstretch” (to borrow the word used by the Working Party in the Opinion) the concept of personal data.”

 Comment

The decision provides welcome clarification on the scope of the concept of “personal data” and a reminder of the court’s approach to interpreting whether information “relates to” a particular person. It also confirms that the right of access entitles a data subject to a copy of their data rather than the data in its “original form.  Haughton J’s comments also show that, in certain circumstances, such as where the document contains personal data relating to a third party, or another statutory exemption applies, it may be sufficient to provide the data subject with a written narrative of the personal data that a document contains.  However, these circumstances are likely to be narrowly construed.

Although, the decision is based on the pre-GDPR regime, it remains relevant in the post-GDPR world. This is due to the fact that the GDPR contains a similar definition of “personal data”, and the right of access under the GDPR also contains a similar right to a “copy” of one’s personal data, to be communicated in “intelligible form”, subject to certain statutory exceptions.