ECJ Rules Exam Responses, But Not Questions, Score As Personal Data

Background

On December 20, 2017, in the case of Peter Nowak v. the Data Protection Commissioner, the ECJ handed down its decision regarding whether or not test responses from a candidate taking a professional examination are personal information under the EU 95/46/EC Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This case was referred to the ECJ by the Supreme Court of Ireland and the ECJ was asked to provide a preliminary ruling on the following:

“Is the information recorded in answers given by a candidate during a professional examination capable of being personal data within the meaning of the Directive 95/46; and if yes to the above (some or all of such information being personal data), what factors are relevant in determining whether in any given case such script is personal data, and what weight should be given to such factors.”

The court went on to determine whether the written answers provided by a candidate at a professional exam and any comments made by the examiner with respect to those answers constitute personal information. Mr. Nowak and some other parties raised the issue of the comments also constituting personal information.

What Was the Ruling?

The ECJ relied on the Advocate General’s Opinion (July 2017) on this matter and determined that is it “undisputed” that an examination candidate has a legitimate interest, based on the protection of his private life, to object to data processing “outside of the examination procedure and,.., to their being sent to third parties, or published, without his permission.” Also, that the candidate has the right to assert his rights to access and rectification (Art. 12 a,b of Directive) in relation to written answers and to any comments made by an examiner with regard to those answers.
 
Notably, the ECJ did emphasize limitations to these rights. Specifically, a candidate cannot correct after the fact answers that are incorrect. The ECJ also noted that member states, both under the Directive and the upcoming General Data Protection Regulation (GDPR), can limit such access under their respective national legislation. Perhaps most importantly, the ECJ made clear that the candidate does not have any right to access or rectification of examination questions, and that such questions do not constitute candidate personal data. This is good news for test providers given the significant value of test questions and the substantial costs devoted to test question development.
 
The ECJ held that the written answers submitted by a candidate at a professional examination AND any comments made by the examiner with respect to those answers constitute personal data under Article 2(a) of the Directive 95/46.

What’s Next?

Clients administering tests in the European Union should review their test administration procedures in light of this recent decision. Specifically, test providers should separate individual responses from any test questions, and update their compliance programs taking into consideration this recent decision.