Data protection and exams: does an exam script constitute personal data?

Advocate General Kokott (“AG”) of the Court of Justice of the European Union (“CJEU”) has recently delivered an Opinion, in Case C-434/16 Peter Nowak v Data Protection Commissioner, that states that a handwritten exam script, capable of being attributed to an exam candidate, constitutes personal data within the meaning of Article 2(a) of the Data Protection Directive (95/46/EC) (the “Directive”). If this Opinion is followed by the CJEU, the potential impact includes the widening of the scope of information that can be requested by data subjects from academic institutions or qualifications authorities. It may also prompt the revisal of the Information Commissioner's Office’s (“ICO”) current guidance on requesting exam results.

In Nowak, a trainee accountant who had sat an exam made a subject access request (“SAR”) for all personal data (which, in Mr Nowak’s view, included his exam script). However, the Irish Data Protection Commissioner considered that the request was abusive and that the script was not his personal data. Consequently, Mr Nowak brought an action against this decision before the Irish courts, and the Supreme Court of Ireland subsequently referred to the CJEU the question of whether information/answers recorded in an exam script by a candidate during an exam is capable of being personal data.

In the Opinion, AG disagreed with the conclusion of the Irish Data Protection Commissioner. The AG considered that an exam script amounted to a collection of personal data as it incorporates information about the exam candidate (for example, it is a record that the individual has taken part in an exam and how that individual has performed). Furthermore, the AG opined that an exam candidate has a legitimate interest (based on the protection of his private life) in being able to object to the processing of his script outside the exam procedure, which supported the AG’s view that an exam script constitutes personal data. However, the AG made clear that the Directive could not be used by a candidate to ‘rectify’ their answers or the marking of their answers by examiners.

In the UK, under the Data Protection Act 1998 (“DPA”) and guidance published by the ICO, a candidate is permitted to access his/her mark, comments written by the examiner and minutes of any exam appeals panel. However, the DPA explicitly excludes exam scripts from being available through a SAR. Therefore, if the CJEU follows the AG’s opinion in Nowak, this may signal a move away from the current position under the DPA and the ICO’s guidance.

Universities, local councils, qualifications authorities and any other bodies processing test or exam scripts in the UK should therefore pay attention to the future decision of the CJEU, as well as any actions taken by the ICO in response; it is possible that students may soon expect to receive more information than is ordinarily provided in response to a SAR.