Peter Nowak -v- Data Protection Commissioner

1. This matter comes before the Court by way of an appeal from the judgment of Judge Linnane of the 16th November, 2010. The background to the matter may be stated briefly. The appellant has registered as a student with Chartered Accountants Ireland (hereinafter "CAI") with a view to gaining a professional qualification as a chartered accountant. He sat an examination on the 7th October, 2009 but was unsuccessful. By letter dated the 12th May, 2010, Mr. Nowak submitted a personal data access request in which he asked CAI to release to him all personal data within the meaning of that term as set out in the Data Protections Acts 1988 to 2003 (hereinafter "the Data Protection Acts"). The letter specified that in particular he was seeking a copy of his examination script, all personal data relating to his appeal to the Appeals Panel with regard to his failure in that examination to include any personal data in existence concerning that appeal, any data compiled by the External Examiner and Appeals Panel and any data sent or received by CAI whether in manual or electronic format.

2. A very considerable volume of material was furnished to Mr. Nowak by CAI but in correspondence it was made clear to him that the material that would be provided to him would not include his examination script because CAI had received legal advice that the Data Protection Acts did not extend to that material. In passing, it may be noted and it is certainly a very strange feature of this case that although the procedures in relation to examinations conducted by the CAI provided exam candidates with an opportunity to read their scripts at a particular time and under controlled conditions, that Mr. Nowak never availed of this option. By letters dated the 1st July, 2010 and the 14th July, 2010, Mr. Nowak submitted a formal complaint to the Data Protection Commissioner, the respondent. CAI, it may be noted is registered as a "data controller" with the respondent,. These written complaints supplemented an earlier online complaint that had been submitted by him on the 17th June, 2010. While Mr. Nowak in the form he completed and in correspondence had raised a number of issues, his principal concern, and this is the only matter that arises on the appeal hearing, was the refusal of CAI to provide him with a copy of his examination script based on the view that it had formed that the script did not constitute "personal data" within the meaning of the Acts. On the 21st July, 2010, the respondent wrote to the appellant and informed him that having examined all the papers in the matter it had been concluded that Mr. Nowak had not identified any substantive breach of the Data Protection Acts. The letter stated:

"In accordance with s. 10(1)(b)(i) of the Data Protection Acts we are not obliged to investigate a complaint where no substantive breach of the Act remains to be investigated".

"It is noted that you intend to make an appeal to the Circuit Court under the provisions of the Data Protection Acts 1988 and 2003. You should be aware that the Data Protection Commissioner has not made an appealable decision under the provisions of s.10(1)(b)(ii) of the Data Protection Acts 1988 and 2003. The Commissioner chose not to investigate your client's complaints as he had formed the opinion, in accordance with s.10(1)(b)(i) of the Acts, that they were frivolous or vexatious. The Data Protection Acts do not provide for a right of appeal in such circumstances".

5. Section 26(3)(b) of the Data Protection Acts provides that an appeal may be brought to the High Court on a point of law against a decision of the Circuit Court in relation to an appeal that had been brought to it. The notice of appeal in the present case which is dated the 26th November, 2010 does not specify on what point of law the appeal is brought to the High Court but instead simply states that Mr. Nowak appeals the whole of the order of the Circuit Court declaring that the Circuit Court did not have jurisdiction to hear the appeal pursuant to s. 26 of the Data Protection Acts and dismissing the appeal and granting the respondent, the Data Protection Commissioner the costs of the proceedings. However, written submissions have been exchanged and by reference to those and more particularly by reference to the submissions delivered on behalf of the appellant it emerges that the following points of law are said to arise on the hearing of the appeal to this Court.

(1) Was the Circuit Court correct to conclude that it had no jurisdiction to hear an appeal in circumstances where the Data Commissioner had not embarked upon an investigation of the merits of the complaint but had declined to do so having formed the view that the complaint was frivolous and vexatious;

(2) If the Circuit Court had jurisdiction should it have determined that the Data Commissioner was correct in concluding that the examination scripts did not constitute "personal data" and;

(3) Should the Circuit Court have concluded that the complaint advanced by Mr. Nowak to the Data Commissioner was one that was frivolous and vexatious.

(a) The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act, have been, are being or are likely to be contravened in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention.

(b) Where a complaint is made to the Commissioner under paragraph (a) of this subsection, the Commissioner shall -


(i) investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or vexatious, and

(ii) if he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter, the subject of the complaint notify in writing the individual who made the complaint of his or her decision in relation to it and that the individual may, if aggrieved by the decision, appeal against it, to the Court under section 26 of this Act within 21 days from the receipt by him or her of the notification.

"An appeal may be made to and heard and determined by the Court against-

…

(d) a decision by the Commissioner in relation to a complaint under section 10(1)(a) of this Act".

8. Section 10(1) seems to envisage that the following sequence of events will occur:-

(1) The Commissioner has to decide whether the matter submitted to him is frivolous or vexatious.

(2) If the Commissioner is of the view that the matter was not frivolous or vexatious, then, unless an amicable resolution can be arranged within a reasonable time, he considers the matter and reaches a decision in relation to it and then informs the complainant of the decision that has been reached and that the decision may be appealed.

(3) However, if the view is formed that the matter that has been submitted is frivolous or vexatious, then the Commissioner does not investigate the complaint or cause it to be investigated. In that event the procedure comes to a halt.

10. Counsel for the appellant has placed reliance on the terms of Council Directive 95/46/E.C. of 24 October, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, O.J. L281 23.11.1995 and in particular article 28.1 thereof.

11. However, if one looks at the structure of article 28 of the Council Directive 95/46/E.C., it does not seem to me that the provision to which the appellant has drawn attention is of any real assistance. Article 28.3 is in these terms:

"3. Each authority shall in particular be endowed with:-

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties;

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data,

- of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions;

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts."

"4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim."

14. Lest I be wrong in my conclusion that the Circuit Court did not have jurisdiction to entertain the appeal and in a situation where counsel on both sides have addressed the issues, I have decided to indicate a view on the substantive issue that the appellant had sought to canvass in his appeal.

15. Had an appeal been possible, it would then have been necessary to consider how a court should approach the hearing of an appeal from a body such as the Data Protection Commissioner. How a court should approach an appeal from a statutory body was addressed by Finnegan P. in the case of Ulster Bank v. Financial Services Ombudsman [2006] IEHC 323 (Unreported, High Court, Finnegan P., 1st November, 2006). In the course of his judgment he commented:

"To succeed on this appeal the Plaintiff must establish as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In applying the test the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The deferential standard is that applied by Keane C.J. in Orange v The Director of Telecommunications Regulation & Anor and not that in The State (Keegan) v Stardust Compensation Tribunal."

"In short, the appeal provided for under this legislation was not intended to take the form of a re-examination from the beginning of the merits of the decision appealed from culminating, it may be, in the substitution by the High Court of its adjudication for that of the first defendant. It is accepted that, at the other end of the spectrum, the High Court is not solely confined to the issues which might arise if the decision of the first defendant was being challenged by way of judicial review. In the case of this legislation at least, an applicant will succeed in having the decision appealed from set aside here (sic) it establishes to the High Court as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In arriving at a conclusion on that issue, the High Court will necessarily have regard to the degree of expertise and specialised knowledge available to the [first defendant]."

18. It seems to me that the conclusion arrived at by the Data Protection Commissioner was not one that would have come as a surprise to most people. The CAI had an examination system in place and one might have expected that Mr. Nowak would have availed of that system. If he was unhappy with aspects of the system then there was scope available to him to challenge that system. However, what would have surprised most people was that instead of utilising the examination system to the full, Mr. Nowak sought to invoke the data protection code in order to create a parallel examination code.

19. Accordingly, had it been possible to appeal to the Circuit Court, then, in my view, the Court would have been correct to uphold the conclusion of the Data Protection Commissioner that the material in question did not amount to personal data within the meaning of the Acts and accordingly to dismiss the appeal. I am of that view notwithstanding that the applicant has pointed to the provisions of the equivalent British legislation and has drawn attention to the fact that Schedule 7 of the Data Protection Act there, which contains a number of exemptions, lists examination scripts as an exempt category. Counsel for the applicant asks why it would be necessary to exempt examination scripts unless, in the absence of such a specific exemption, examination scripts would fall within the concept of personal data. It seems to me that that argument falsely assumes that all examination scripts fall to be treated in an identical manner. However, that is not necessarily so at all. The amount of personal information contained in an examination script may vary significantly depending on the nature of the examination. As the website of the respondent in its frequently asked questions section points out a psychometric test or IQ test would likely contain more information relating to the person that undertook the test than say a test of general knowledge. The examination that the applicant sat was, as we have seen, an "open book" examination. The applicant described the process involved in the course of a letter to the Commissioner dated the 14th July, 2010. He did so in these terms:-

"Since the above mentioned exam was an "open book" exam I was able to reproduce answers provided during the real exam".

20. Once the Commissioner had formed the view that the examination script did not constitute personal data it followed that he was being asked to proceed with an investigation where no breach of the Data Protection Acts could be identified. It was in those circumstances he had resort to s. 10(1)(b)(i). That section refers to complaints that are frivolous or vexatious. However, I do not understand these terms to be necessarily pejorative. Frivolous, in this context does not mean only foolish or silly, but rather a complaint that was futile, or misconceived or hopeless in the sense that it was incapable of achieving the desired outcome, see R. v. Milden Hall Magistrates Courts Ex P Forest Heat D. C. -16/05/1997 Times Law Reports. Having regard to the view the Commissioner had formed that examination scripts did not constitute personal data, he was entitled to conclude that the complaint was futile, misconceived or hopeless in the sense that I have described, indeed such a conclusion was inevitable.

21. Having regard to the views that I have reached that Judge Linnane was correct that no appeal lay and to the views that I have reached on the arguments in relation to the merits of the case that have been canvassed, I propose to affirm the decision of the Circuit Court dated the 16th November, 2010.