THE COURT OF APPEAL
Haughton J.
Ní Raifeartaigh J.
Binchy J.
Neutral Citation Number [2020] IECA 174
Appeal No. 2018/139
High Court Record No. 2014/89 CA
IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003
IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26
OF THE DATA PROTECTION ACTS, 1988 & 2003
BETWEEN/
PETER NOWAK
APPELLANT
- AND -
THE DATA PROTECTION COMMISSIONER
RESPONDENT
-AND-
THE INSTITUTE OF CHARTERED ACCOUNTANTS IN IRELAND
NOTICE PARTY
Appeal No. 2018/140
High Court Record No. 2014/118 CA
IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003
IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26
OF THE DATA PROTECTION ACTS, 1988 & 2003
BETWEEN/
PETER NOWAK
APPELLANT
- AND -
THE DATA PROTECTION COMMISSIONER
RESPONDENT
-AND-
THE INSTITUTE OF CHARTERED ACCOUNTANTS IN IRELAND
NOTICE PARTY
JUDGMENT of Mr. Justice Haughton delivered in the second appeal record no. 2018/140 on the 1st day of July 2020
Introduction
1. This judgment relates to the second of the above entitled appeals. This is an appeal on a point of law from a judgment of the High Court (Coffey J.) determining that the obligation on a data controller (the Notice Party “ICAI”) to provide a data subject (the appellant) with personal data, whether arising from section 4(1)(a)(iii) or section 4(9) of the Data Protection Acts, 1988 and 2003 (the “DP Acts”), does not extend to an obligation to provide the data in its original material form or - in the case of a document - to provide the original of that document. The original documents at issue are the appellant’s examination scripts arising from sitting accounting exams organised by ICAI for accountancy students in 2009.
2. While the two appeals relate to different data and different points of law, common to both is that the appellant and respondent are one and the same, they are both matters appealed pursuant to s.26 of the Data Protection Act, 1988 (“the Act of 1988”) on points of law from the Circuit Court to the High Court, with both orders being made in the High Court on 12 March 2018 and perfected on 29 March 2018; and both matters were further appealed under s.26 to this court and were listed together and argued before this court on 5 May 2020.
3. Importantly the same general legal principles which are set out more fully in the judgment just delivered by Binchy J in the first above entitled appeal (see paras. 24-28, where Binchy J sets out the respondents submissions which were not, in respect of these legal principles, disputed - see also para.52) also apply to this appeal. The relevant framework principles may be summarised as follows:-
(1) Section 26(3)(b) of the Act of 1988 provides that where the Circuit Court has determined an appeal from a decision made by the DPC there is a further appeal available to the High Court limited to a point of law.
(2) Following the High Court a further appeal lies to the Court of Appeal and/or to the Supreme Court in the normal course.
(3) It is not a de novo appeal.
(4) The burden is on the appellant to establish as a matter of probability that the impugned decision was vitiated by a serious and significant error or a series of such errors (Ulster Bank v McCarron [2006] IEHC 323, per Finnegan P.).The court will have regard to the degree of expertise and specialist knowledge of the adjudicating body (the deferential standard referred to by Keane C.J. in Orange v the Director of Telecommunications Regulation (No.2) [2000] 4 IR 159) where appropriate.
Factual background
4. This appeal is directly related to an earlier complaint made by the appellant on 21 July 2010 (“the First Complaint”) to the Data Protection Commissioner (“DPC”).
5. In 2009 the appellant was registered as a student with the ICAI in order to qualify as a chartered accountant. He was employed by PricewaterhouseCoopers (“PwC”). In the summer and autumn 2009 examination sessions the appellant sat his Strategic Finance and Management Accounting Exam (“SFMA Exam”) which he failed. That result was confirmed on appeal.
6. By letter dated 10 March 2010 James Maher & Company Solicitors on behalf of the appellant wrote to ICAI indicating an intention to have the result of the exam judicially reviewed and requested an undertaking that the exam script, examination protocols, marking schemes and marks awarded in the original markings and in the appeals markings would be preserved. By letter dated 15 March 2010 that undertaking was given by ICAI.
7. By letter dated 12 May 2010 the appellant made a formal request of ICAI to release to him all “personal data” within the meaning of that term set out in the DP Acts, and in particular he sought: -
“… A copy of my examination script relating to my recent CAP 2 examination, all personal data concerning my appeal to the appeals panel relating to my failure of that examination to include any personal data in existence concerning that appeal, any data complied (sic) by the external examiner and appeals panel and any data sent or received by Chartered accountants Ireland whether in manual or electronic format.”
8. In their response dated 1 June 2010 ICAI furnished copies of seventeen documents but declined to furnish the exam scripts, stating -
“Further to legal advice which we received regarding your Data Protection Application we have been advised that the Examination Scripts from the summer 2009 and autumn 2009 sessions at CAP 2 are not personal data. I have therefore not enclosed copies of same.”
9. By on-line communication dated 17 June 2010 and letters dated 1 July and 14 July 2010 the appellant submitted a complaint to the office of the DPC alleging failure to provide him with all of his personal data and access (the First Complaint). The DPC determined that that complaint was frivolous and vexatious, and declined to hear it. The appellant appealed that decision to the Circuit Court, but it held that it did not have jurisdiction to hear the appeal and dismissed it by order dated 16 November 2010.
10. The appellant appealed that decision to the High Court on a point of law, and that appeal was refused by order dated 14 March 2012. By Notice of Appeal dated 14 May 2012 the appellant further appealed that decision to the Supreme Court.
11. Pending the hearing in the Supreme Court the appellant sent a letter dated 13 November 2013 to ICAI seeking reconfirmation that they continued to hold the “originals of documents constituting or/and containing my personal data” including its examination scripts and related documentation. ICAI responded on 19 November 2013 stating –
“I can confirm that we have retained a copy of your exam script and related documentation.” [Emphasis added]
This prompted the appellant to lodge a further Complaint with the DPC dated 13 January 2014 (“the Second Complaint”). The Second Complaint having recited the correspondence in relating to preservation of documentation, then sets out some eight Grounds for Complaint, some of which it is appropriate to quote: -
“(1) Based on the contents of the letter from the Institute dated 19 November 2013 a copy of the examinations data was confirmed to be retained. It appears, indirectly, that the originals of the said data were destroyed. Moreover, the letter refers to one exam script only. The institute was requested to retain two examination scripts. One submitted in the summer exam session and the second submitted in the autumn exam session 2009 as referred also in the letter dated 1 June 2010 from the Institute attached herein. This would be in breach of s.2(1)(d) of the Data Protection Acts, 1988 & 2003 which provides:
‘Appropriate security measures shall be taken against unauthorised access to, or alteration, disclosure or destruction of, the data and against their accidental loss or destruction.’
(2) Destruction of the said data took place after receipt of a data access request. It is well known that any interference with the data subject after receipt of a data access request is strictly forbidden. Also, issues surrounding that data and handling of the request itself were a subject matters (sic) of the Complaint to the ODPC dated 1 July 2010 and 14 July 2010 which are currently under appeal to the Supreme Court.
(3) The Institute destroyed the said data without securing my prior consent. No permission to destroy that data has been ever given.”
It is apparent that the Second Complaint was lodged because the appellant assumed from ICAI’s letter of 19 November 2013 that they had only retained a copy exam script, and only in relation to one exam, and he inferred that the original documentation had been destroyed.
12. In response to the Second Complaint by letter dated 27 January 2014 the office of the DPC wrote to the appellant indicating that the grounds of complaint had been assessed and stating: -
“As you will be aware, the right of access under Section 4 of the Data Protection Acts is a right to request a copy of personal data held by a data controller. This right of access does not require the supply of originals of information held. The Data Protection Acts do not provide a right to an individual to require an organisation to preserve originals of personal data. In addition, you will be aware, in any case, that it remains the contention of this Office that exam scripts of this nature do not consist of personal data within the meaning of the Acts. It is the view of this Office therefore that the non-retention of the Institute of the originals of the information you refer to would not be a data protection issue for investigation by this Office.
Furthermore, the destruction of such information in whatever form after submission of an access request would not in our view breach the Data Protection Acts in a case where it is considered that it does not constitute personal data within the meaning of the Acts and would not, in any case, have been subject to consideration for release as part of an access request made pursuant to Section 4 of the Acts.”
The letter concluded that as the DPC had not identified grounds for investigation, a formal investigation would not be commenced as the DPC considered that section 10(1)(b)(i) of the DP Acts applied. That provision obliges the Commissioner to investigate a complaint or cause it to be investigated “unless he is of opinion that it is frivolous or vexatious”.
13. The appellant took issue with the decision of the DPC on the Second Complaint, and by Notice of Motion issued on 17 February 2014 appealed to the Circuit Court. This sought a number of declarations, including:
“4. A Declaration that interference with personal data, to include a destruction of the originals, by a Data Controller after receipt of a Data Subject Access Request pursuant to Section 4 of the Data Protection Acts, 1988 and 2003, is a matter which falls under the remit of the Respondent to investigate.
8. A Declaration that the right of access under Section 4 of the Data Protection Acts 1988 & 2003 entitles a Data Subject to access the originals of his or her personal data if he or she so agrees.
9. A Declaration that the examination scripts submitted by the Appellant as a student for the qualifications of the Institute of Chartered Accountants in Ireland are ‘personal data’ within the meaning of Section 1 of the Data Protection Acts, 1988 and 2003.”
14. In his grounding affidavit sworn on 18 February 2014 the appellant sets out the history of the First Complaint, in respect which an appeal was then pending before the Supreme Court, and he exhibits the correspondence that led to the Second Complaint, and at paragraph 16 he avers:
“16. As appears from the foregoing the Deponent’s complaint related to the Data Controller allegedly acting in contravention of Section 2(1)(d) and Section 2(1)(c)(iv) of the Data Protection Acts 1988 & 2003 and its Data Protection Policy by destroying the originals of the personal information after the receipt of the access request and prior to the appeal hearing by the Supreme Court.”
15. When this Circuit Court appeal was brought to the attention of ICAI, their solicitors, Matheson, wrote by letter dated 14 April 2014 to DPC’s solicitors Philip Lee, indicating that their client as notice party did not propose participating in the proceedings, but addressing the assertion that the original exam scripts and related documentation had been destroyed by them in the following terms: -
“… The basis for these allegations is set out in Mr. Novak’s complaint to your client dated 13 January 2014, exhibited at PN 7 to his Affidavit, where he interprets our client’s letter of 19 November 2013 as confirmation that our client has destroyed originals of exam scripts, notwithstanding that our client’s letter provides no such confirmation.
For the record, our client confirms that it does hold Mr. Novak’s original exam scripts.” [Emphasis added]
A copy of that letter was sent to the appellant. Philip Lee Solicitors by letter of 22 April 2014 also copied Matheson’s letter to the appellant, noting the confirmation therein that his original exam scripts had been retained. Without prejudice to the contention that s.26 of the DP Acts didn’t provide for a right of appeal against the DPC’s opinion that the complaint was vexatious and frivolous, they stated -
“… The purpose of this letter is to call on you to agree to the appeal being struck out in circumstances where the letter of 14 April 2014 renders the appeal moot.”
16. By way of response the appellant wrote to Matheson on 7 May 2014. He noted that their letter “contained unsubstantiated confirmation” of retention of the original exam scripts, and requested a time and place for personal inspection by him within seven days. By letter of 12 May 2014, Matheson responded, again confirming that ICAI continued to hold the original exam scripts, and noting that: -
“The provision of this confirmation should be sufficient to reassure you that our client maintains these documents and our client does not consider it needs to go any further to provide proof of such confirmation. Your claim that the refusal of your request will deem our client to have made ‘false statements’ is entirely groundless.”
By letter of 15th May, 2014 the appellant replied to Matheson noting the refusal to produce the documents and -
“…that your client based the refusal on the non-binding opinion of the DP Commissioner which is subject to the appeal to the Supreme Court and related matter will again come on for hearing on 3 June 2014.”
17. The DPC brought an application before the Circuit Court to strike out the appellant’s appeal in respect of the Second Complaint. Critically in support of that application an affidavit was sworn by David Butler, then secretary of the ICAI in which he verified that ICAI held the appellant’s original exam scripts, and characterised the appellant’s averments as to destruction of those documents as “a factual inaccuracy”. That averment of fact was not further contested by the appellant.
18. The appellant’s appeal to the Circuit Court was dismissed by Deery J. on 3 June 2014. A Note of that judgment records: -
“5. The Court noted that, having established that the CAI continues to hold the original scripts, the Data Protection Commissioner informed Mr. Novak that, if the appeal was withdrawn, he would not seek his costs. Mr. Novak chose to proceed with the appeal nevertheless.
6. The Court concluded that the matters in issue have been determined twice. The examination script has been found not to be personal data. It has also been determined that no appeal lies where no investigation has been undertaken by the Data Protection Commissioner. The Court also noted that the assertions made by Mr. Novak in correspondence that the original scripts have not been retained have been categorically denied in correspondence and on affidavit. In all of these circumstances, Judge Deery expressed himself satisfied that the appeal must be dismissed.” [Emphasis added]
The sentence highlighted can only be read as a finding by Deery J. that the appellant’s original exam scripts had not been destroyed and were retained by ICAI.
19. From that dismissal the appellant brought an appeal pursuant to section 26 of the DP Acts to the High Court, raising the following points of law: -
“1. Was the learned Circuit Court Judge correct in determining that the examination scripts, submitted by the Appellant relating to the Summer and Autumn 2009 examination sessions, do not constitute the Appellant’s personal data?
2. Is a Data Subject entitled to access the originals of his or her personal data pursuant to Section 4 of the Data Protection Acts, 1988 & 2003?
3. Does Section 26 of the Data Protection Acts, 1988 & 2003 apply when the Respondent undertakes the level of investigation necessary to determine whether a complaint is frivolous or vexatious?
4. Was the Respondent’s decision dated 27 January 2014 vitiated by a serious and significant error or a series of such errors?”
20. Before the appeal in respect of these Points of Law came on for hearing before the High Court on 1 & 2 February 2018 the first and third issues raised by the appellant’s s.26 appeal had been determined in his favour by decisions of the Supreme Court and the European Court of Justice respectively arising from the appeals brought by the appellant in relation to the First Complaint in respect of the decision of the DPC made on 21 July 2010.
21. In Nowak v Data Protection Commissioner [2016] 2 IR 585, the Supreme Court held that the mere fact that the DPC determined that a complaint was ill-founded in law did not preclude the appellant from bringing a statutory appeal pursuant to section 26 of the Act of 1988.
22. In a preliminary reference from the Supreme Court, in Case-434/16, Nowak v The Data Protection Commissioner EU:C:2017:994 the European Court of Justice held that Article 2(a) of Directive 95/46/EC of 24 October 1995 “On the protection of individuals with regard to the processing of personal data and on the free movement of such data” (“the Directive”) must be interpreted as meaning, in circumstances such as those of the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data within the meaning of the said provision.
The High Court Order
23. As a result the parties to the instant appeal consented to the High Court making certain orders which flowed inevitably from the decisions of the Supreme Court and ECJ: -
“1. An order quashing the decision of the Circuit Court insofar as it held that an appeal did not lie against the decision of the Respondent made on the 27th January, 2014;
2. An order quashing the decision of the Circuit Court insofar as it held that an exam script of the nature at issue in these proceedings did not constitute personal data;
3. A consequential order quashing the decision of the respondent made on the 27th January, 2014 insofar as it held that an exam script of the nature at issue in these proceedings did not constitute personal data;
4. A declaration that the Circuit Court erred in law in failing to address the issue of whether the appellant is entitled to a declaration that the right of access under s.4 of the Data Protection Acts, 1988 and 2003 entitles the data subject to access the originals of his or her personal data.”
Then, as appears by paragraph 8 of the judgment of the trial judge delivered on 26 February 2018 –
“Rather than remitting it to the Circuit Court, the parties have consented to this Court determining the only remaining issue, namely whether a data subject, pursuant to s.4 of the Data Protection Acts, 1988 and 2003, is entitled to access his or her personal data in its original form.”
Thus the only issue before the High Court was whether or not the appellant was entitled to access or obtain the original examination script instead of a copy. In the appealed Judgment dated 26 February 2018 the trial judge found against the appellant on this issue and by Order dated 12 March 2018 Coffey J ordered : -
“5. An order refusing a declaration that a data subject is entitled to access his or her personal data in its original form or format pursuant to Section 4 of the Data Protection Acts, 1998 - 2003.
6. ….
7. A consequential Order upholding the decision of the Data Protection Commissioner made on 27 January, 2014 insofar as it held that a right of access under Section 4 of the Data Protection Acts does not require the supply of the personal data held in its original form or format.”
The court further decided to vacate an order for costs made in favour of the DPC and the ICAI as Notice Party by the Circuit Court order dated 3 June 2014, and made no order as to the costs of the Circuit Court and no order as to the costs of the appeal.
The Notice of Appeal
24. From those two orders the appellant filed a Notice of Appeal on 9 April 2018, and the Grounds of Appeal assert: -
“The court erred in law in holding that the obligation on a data controller to provide a data subject with personal data, whether arising from section 4(9) or section 4(1)(a)(iii) of the Acts, does not extend to an obligation to provide the data in its original material form or, in the case of a document, to provide the original of that document.”
Respondent’s Notice
25. In the Respondent’s Notice filed on behalf of the DPC on 27 April 2018 the appeal is opposed in its entirety on the following grounds: -
“(1) Section 4(1) of Acts gives an individual the right to be supplied with certain information in respect of any personal data processed by a data controller in relation to him or her and a right to have communicated to him or her ‘in intelligible form’ the information constituting any personal data of which he or she is the data subject. Section 4(9) of the DP Acts expressly requires a data controller to implement the latter right of access by supplying the data subject with ‘a copy of the information concerned in permanent form.’
(2) On a plain reading of the section, it does not compel the controller to produce an original document.
(3) The Commissioner’s interpretation of what the relevant case law establishes is that, while there is no question but that the data subject must be given access to their personal data in permanent and intelligible form, that right of access is not to be construed as equating to a right to access documents. As such, access can be provided in a number of different ways, including but not limited to the production of a photocopy of a document containing the personal data.
(4) For the above reasons, the Respondent believes that the High Court correctly interpreted the scope of the right of access.”
The respondent also cross-appealed in relation to the costs orders made in the High Court.
Developments before this appeal came on for hearing
26. Two further developments that occurred subsequent to the High Court judgment and order and before this appeal came on for hearing before this court should be noted. Although these were not matters deposed to on affidavit, they are referred to in the DPC’s written submissions and appended Chronology, and no objection was taken by the appellant to them being brought to the attention of this court.
27. Firstly, following the appellant’s success before the European Court of Justice and the Supreme Court on 30 May 2018, ICAI wrote to the appellant offering copies of his exam scripts. On 18 June 2018 copies of these scripts were released to the appellant, and receipt of same was confirmed by the appellant. Clearly the appellant has had the opportunity to review copies of the exam scripts.
28. Secondly, by letter dated 11 July 2018 ICAI’s solicitors wrote to the appellant to indicate that, without prejudice to ICAI’s position that they were not obliged to do so, they would nonetheless permit the appellant to inspect the original scripts under controlled conditions, and that the appellant would be allowed to examine the copies provided to him against the originals.
29. The appellant confirmed to this court that he did not take up this offer. He informed the court that his reason for not doing so, and for pursuing the instant appeal, was because of his belief that the trial judge erred in law and no court had set aside the decision of the DPC, and that these decisions “need to be corrected”.
Preliminary Issues
30. Counsel for the DPC raised a number of preliminary issues which it is appropriate to address at this stage.
Mootness by reason of offer of inspection
31. Counsel raised at the oral hearing a question as to whether this court should entertain this appeal at all on the basis that it was moot by reason of the ICAI’s offer to the appellant to inspect the original exam scripts. For a number of reasons I am of the view that this court should hear and determine the appeal.
32. Following failure of the appellant to take up the ICAI offer to inspect in July 2018 no application was made to this court to have this appeal dismissed on grounds of mootness; nor was there any application made to amend the Grounds of Position to include such a claim.
33. Further, mootness and the case law which might justify this court in treating the appeal as moot, is not mentioned at all in the respondent’s written Submissions. The fact of the offer of inspection of the original in controlled conditions is mentioned at paragraphs 35 and 36, and again at paragraph 113 where it is noted that the appellant was afforded the opportunity to inspect the original scripts, and it is said that “As such he has had an opportunity to pursue any concerns he may have about manipulation, re-engineering or fraud”. Mootness as such is not raised or argued.
34. Mootness was raised, but without any great vigour, by counsel for the DPC at the oral hearing, and without reference to any of the jurisprudence governing the circumstances in which a case may be said to be moot, or the exercise of the discretion of the court to hear and determine a case notwithstanding that it may be moot.
35. Accordingly, the appellant had not had any meaningful opportunity to consider or address this issue, although when it was raised he was clear in his desire to pursue the appeal in principle because otherwise his view was that the High Court and DPC’s decisions would not be “corrected”.
36. The court was also mindful that the appellant is not a lawyer and cannot be expected to deal with a mootness argument “on the hoof”. He would have been entitled to understand and address the full legal argument on mootness, and this would have necessitated an adjournment. It would not have been a good use of the time and resources of the court, and doubtless of the parties themselves, for the court to have adjourned for a separate hearing on mootness, potentially followed by a hearing on the merits.
37. A practical consequence of mootness being raised in this manner was that the appeal papers and Submissions had been read by judges of this court and we were ready to hear argument and address the net issue raised by the appeal - and this was all the more significant as a ‘remote’ video hearing of the court was arranged to hear the appeal, and that hearing ran its full course.
38. In addition, it was unclear whether the offer was continuing or would survive judgment on this appeal. It is not therefore clear whether the case is moot - if the ICAI offer is no longer available then there is an argument that it is not moot. Finally no mention was made of how the question of costs of the court below and in this appeal (up to the date of the letter of offer) were to be dealt with if the appellant took up the offer.
39. It is well established that this court has a discretion to hear and determine an issue, even if can be said to be moot. In Lofinmakin v. Minister for Justice [2013] IESC 49, [2013] 4 IR 274 McKechnie J emphasised that the rule of mootness had never been absolute, and stated -
“[67] At the level of principle however it seems to me that, where the overriding interests of justice require a decision on the moot, the same should be given.”
40. I am of the view that even if the appeal is moot - and I do not determine that issue - this is an appeal in which the court should, for the reasons just given and for the overriding interests of justice determine the discrete issue which is raised by the appellant.
Scope of appeal
41. This brings me to the second preliminary point raised by counsel for the DPC. This relates to an argument raised by the appellant which the DPC submits has no basis in the facts of this case, and is therefore hypothetical and therefore should not be addressed or determined by the court.
42. At paragraph 24 of the appellant’s written Submission to this court the appellant includes the following: -
“24. … Access to the originals of personal data would be specifically desirable if there are suspicions of manipulation, re-engineering of copies provided or fraud.”
At hearing the appellant argued that when a copy document is “doctored” then access to the original is desirable, and (more broadly) that unless the data subject has access to the original he/she cannot “check to see whether the data is accurate”. He said he “had concerns about the original scripts” and “believed that the copy was not correct” and that he “wanted the originals because of the risk of manipulation…[they] can be doctored. Data can be manipulated”. In so doing the appellant relied on his first request for the original script, which was not acceded to by ICAI, and his concerns about the original. He thus asserted “The right of the data subject to check for accuracy”.
43. I am satisfied that the appellant cannot pursue the ‘doctoring’ argument as it is based on hypothetical facts. The DPC, and the Circuit Court on appeal, can only determine the complaint on the facts presented to them. The High Court on appeal, and now this court on further appeal, under section 26 can only determine a point of law. It must take the facts presented on affidavit and as found by the Circuit Court, and determine the point of law raised on those facts.
44. In respect of the Second Complaint, there was never any evidence before the DPC or the Circuit Court to ground a suspicion of “manipulation”, “re-engineering”, or “doctoring” of the original script, and still less any hard evidence to support such allegations or any allegation of fraud.
45. The sole relevant fact presented to the DPC and the Circuit Court was an allegation of destruction of the originals by ICAI. This allegation was based solely on the appellant’s inference from the letter from ICAI informing him that it had retained a copy of the scripts. It was a mere assertion which was wholly undermined by the affidavit evidence of David Butler, secretary of ICAI, confirming that ICAI held “the original exam scripts”. The Circuit Court judge in his judgment noted that the assertion of destruction was denied in correspondence and on affidavit. That finding of fact, which would seem to have been inevitable on the evidence before Circuit Court, was thereafter unassailable. It could not be upset or varied on a statutory appeal on a point of law, and it defines and limits the scope of the appeal to the High Court and now to this court.
46. Moreover, after the appellant had had sight of copy scripts, in June 2018, he did not make any fresh complaint to the DPC based on those copies. Nor did he seek to adduce any fresh evidence before this court that might have supported any suspicions of doctoring or manipulation, although whether that would have been an option open to him in a statutory appeal on a point of law may be doubted. Also the appellant did not take up the offer to inspect the original script. It is not unreasonable to suggest that he would have done so if he had any basis for suspicion of doctoring following on his consideration of the copy furnished by ICAI.
47. Accordingly it is not within the scope of this appeal for the court to consider whether the appellant, or indeed any exam candidate, may have an entitlement under the DP Acts, 1988-2003 to be provided with or to inspect original exam scripts or related documents in circumstances where there is evidence tending to suggest that the original documents had been manipulated, re-engineered or doctored.
This court can only determine this appeal on the limited factual basis presented on affidavit, and the facts as found by the Circuit Court, namely that, notwithstanding the appellant’s assertions, the original exam scripts were not in fact destroyed by ICAI, and continue to be preserved by that body. The appeal therefore raises the sole question of whether, without any special circumstances, and in particular without any evidence or manipulation or re-engineering of the original exam script, a candidate is entitled to inspect the original documentation under the DP Acts and/or the Directive.
Status of the examinations
48. At paragraphs 13-19 inclusive of his written submissions the appellant sought to raise an entirely new issue, arguing that the ACA Accountancy Examinations in question carried out by ICAI were organised under regulations which were unlawful, and accordingly were invalid under Irish law. This was not an issue raised before the DPC, the Circuit Court or the High Court, and would seem to have no relevance to an appeal under section 26 of the Data Protection Acts, 1988 – 2003. It certainly cannot be raised on this appeal.
Considerations
49. I propose to address the relevant legal provisions in tandem with legal arguments raised in this court and in the High Court.
50. Article 8 of the Charter of Fundamental Rights of the European Union guarantees everyone the right to protection of personal data concerning him or her. Article 8(2) provides that: -
“Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.”
51. Article 12 of Directive 95/46/EC governs “Right of access to data” and provides: -
“Member States shall guarantee every data subject the right to obtain from the
controller:
(a) without constraint at reasonable intervals and without excessive delay or expense:
- confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,
- communication to him in an intelligible form of the data under-going processing and of any available information as to their source,
- knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15(1);
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
(c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.”
Emphasis is added to the wording critical to the minimum obligation that Article 12(a) in the second indent casts on Member States to adopt measures to ensure that individuals can access personal data.
52. The DPC placed reliance on recitals in the Directive to emphasise that its purpose is to provide “respect [for] their fundamental rights and freedoms, notably the right to privacy” of individuals (Recital (2)) - with similar wording in Recitals (7), (9) and (10) also citing “the right to privacy”. The Directive however has other recitals and objectives that may favour an argument that, at least in some circumstances, an individual may be entitled to access an original document with personal data: thus later recitals espouse the individual’s right to accuracy of personal data, and the right to seek corrections: Recital (25) refers to “…the right conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances”; and Recital (41) refers to the exercise of the right of access “… in order to verify in particular the accuracy of the data and the lawfulness of the processing”.
53. The right of access under Article 12 was considered by the European Court of Justice in joint cases C – 141/12 and C - 372/12, Y.S. v Minister voor Immigratie, Integratie en Asiel, Minister voor Immigratie, Integratie en Asiel v. M. [2015] 1 WLR 609, a decision that was considered by the trial judge and features prominently in his judgment. The CJEU was called upon to consider the right of access under Article 12(a) inter alia minutes drafted before the adoption of administrative decisions on the applications of persons concerned for residence permits. It is important to note that the claimant asserted a right to obtain a copy of the relevant minute, as “only such a copy would allow him to ensure that he is in possession of all the personal data which concern him in the minute.” (paragraph 52). The Court found that the relevant minutes contained “personal data”, but drew a distinction between two types of material within the minutes: the factual basis for the application, and the legal analysis of that factual data. The court stated: -
“46. In those circumstances, extending the right of access to the applicant for a residence permit to that legal analysis would not in fact serve the Directive’s purpose of guaranteeing the protection of the applicant’s right to privacy with regard to the processing of data relating to him, but would serve the purpose of guaranteeing him a right of access to administrative documents, which is not however covered by Directive 95/46.”
54. Importantly in paragraph 47 the CJEU went on to stress that the Directive has a different purpose from other legislative instruments - such as Regulation (EC) No. 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents - and stated that it is -
“…not designed to ensure the greatest possible transparency of the decision-making process of the public authorities and to promote good administrative practices by facilitating the exercise of the right of access to documents.”
55. In the instant appeal the trial judge quoted paragraphs 57 and 58 of Y.S., and it is appropriate to do so again as these were relied upon differently by the appellant and by the DPC in their submissions to this court: -
“57. Although Directive 95/46 requires Member States to ensure that every data subject can obtain from the controller of personal data communication of all such data processed by the controller relating to the data subject, it leads to the Member States to determine the actual material form that that communication must take, as long as it is ‘intelligible’ in other words it allows the data subject to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that that person may, where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the Directive (c), to that effect, the judgment in Rijkeboer, (EU: C: 2009: 293, paragraphs 51 and 52).
58. Therefore, insofar as the objective pursued by the right of access may be fully satisfied by another form of communication, the data subject cannot derive from either Article 12(a) of Directive 95/46 or Article 8(2) of the Charter the right to obtain a copy of the document or the original file in which those data appear. In order to avoid giving the data subject access to information other than the personal data relating to him, he may obtain a copy of the document or the original file in which that other information has been redacted”.
56. The appellant relied upon the last sentence in paragraph 58 to support his contention that he had an entitlement to “the original file”. However this was not a valid basis for his argument. That sentence must be read in the context of the earlier sentence where the CJEU was clearly stating that neither Article 12 of the Directive nor Article 8(2) of the Charter could support either the right to obtain a copy of the document, or the original file; it must also be read in the context of redaction from the original file of information other than personal data relating to the data subject. Moreover in Y.S. the CJEU was not called upon to consider or decide a claim for access to the original document containing personal data.
57. Counsel for the DPC relied on the decision in Y.S. for the proposition that the data subject is only entitled under the Directive to a full summary of the data in an intelligible form sufficient to enable the data subject to exercise their rights under the Directive. Counsel pointed to the articulation of the court at paragraph 31 of the first question referred to it for a preliminary ruling: -
“Should the second indent of Article 12(a) of [Directive 954/46] be interpreted to mean that there is a right to a copy of documents in which personal data have been processed, or is it sufficient if a full summary, in an intelligible form, of the personal data that have undergone processing in the documents concerned is provided?”
The CJEU gave the following response at paragraph 60: -
“… Article 12(a) of Directive 95/46 and Article 8(2) of the Charter must be interpreted as meaning that an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities within the meaning of Article 2(b) of that directive. For that right to be complied with, it is sufficient for the applicant to be provided with a full summary of those data in an intelligible form, that is, a form which allows him to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by that directive.”
It is clear that in reaching this conclusion the CJEU emphasised the necessity for interpreting the Directive in accordance with its purpose of protecting fundamental freedoms “in particular the right to privacy” in relation to the processing of personal data (see paragraph 54), in light of Article 8 of the Charter which guarantees the right to protection of personal data, and the right of access to data implemented by Article 12(a) of the Directive (paragraph 55).
58. Far from assisting the appellant, in my view the trial judge quite properly relied on the decision in Y.S. which clearly supports the argument of the DPC that under the Directive the data subject’s entitlement is to access to the relevant information/personal data in an “intelligible form”, and does not support a right under the Directive to personal data in its original form.
59. Turning to domestic legislation, the guarantee of the right of access to personal data is implemented in Ireland by subsections (1)(a)(iii) and (9) of section 4 of the Data Protection Act 1988 (as amended):
“4.—(1) (a) Subject to the provisions of this Act, an individual shall, if he or she
so requests a data controller by notice in writing—
(iii) have communicated to him or her in intelligible form—
(I) the information constituting any personal data of which that individual
is the data subject, and
(II) any information known or available to the data controller as to the
source of those data unless the communication of that information is
contrary to the public interest,
…
(9) The obligations imposed by subsection (1)(a)(iii) (inserted by the Act of
2003) of this section shall be complied with by supplying the data subject with a
copy of the information concerned in permanent form unless—
(a) the supply of such a copy is not possible or would involve disproportionate
effort, or
(b) the data subject agrees otherwise.”
60. Subsection (1)(a)(iii) implements Article 12(a), and as we have seen, the Y.S. decision which was relied on by the trial judge supports the proposition that this does not even give a right or entitlement to access copy documents, as opposed to information constituting the personal data in the documents. Counsel for the DPC also relied on the decision of the Court of Appeal in England and Wales in joined appeals Ittihadieh v 5-11 Cheyne Gardens RTM Company Limited/ Deer v. University of Oxford [2017] EWCA Civ 121, a decision that is in fact referred to by the trial judge at paragraphs. 21 and 22 of his judgment. As the trial judge noted that appeal concerned the nature and extent of the right of access given to a data subject under section 7(1)(c) of the United Kingdom Data Protection Act, 1998, which is the counterpart of s.4(1)(iii) of the Irish Act of 1988.
61. At paragraph 68 of the judgment of the court Lewison LJ cited Y.S. and referred to the passage at paragraph 46, which I have quoted earlier, where the ECJ emphasised the purpose of the Directive as guaranteeing the right to privacy in the processing of personal data, and not guaranteeing a right of access to administrative documents. In paragraph 93 Lewison LJ stated:
“93. The obligation under section 7(1)(c) includes an obligation to communicate in intelligible form the information constituting any personal data of which the individual is the data subject. This goes further than section 7(1)(b) which requires a description of the personal data. It is an obligation to supply the information itself. Even so, it is not an obligation to supply documents: Dunn v Durham County Council [2013] 1 WLR 2305, para 16. It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so. It is very easy, however, to slip from dealing with personal data into dealing with electronically generated or stored documents in which personal data are recorded. It seems from many of the reported cases (as well as these two appeals) that individuals who make SARs [Subject Access Requests] are, in truth, looking for copy documents. They are in my judgment aiming at the wrong target. This ties in with the definition of personal data. Accepting as I do that a person’s name is his personal data, it does not follow that every piece of information in a document in which his name appears is his personal information. In such a case it would, in my judgment, be enough for the data controller to inform the data subject that, for instance, his name is consistently recorded as “Charles Pooter” and his address as “The Laurels, Brickfield Terrace, Holloway” in a specified number of documents between particular dates. There would be no obligation to disclose the documents themselves. This is, I think, borne out by article 12 of the Directive which requires the data controller to inform the data subject of the categories of data concerned”.
62. In my view this passage applies equally to s.4(1)(a)(iii) of the Act of 1988, and the trial judge correctly cited the judgment in Ittahdieh/Deer as a persuasive authority supportive of the purposive approach adopted in Y.S. and the notion that the Directive is concerned with access to personal data/information and not with targeting documents per se.
63. In his submissions to this court the appellant relied principally on the wording of section 4(9) of the 1988 Act which provides that the Data Controller’s obligations are complied with by supplying the Data Subject with “a copy…in permanent form unless - (b) the Data Subject otherwise agrees.”
The appellant’s argument was that he did not agree to acceptance of merely a copy, and that in requiring the original exam scripts he was “agreeing otherwise”. I cannot agree with this contention. A plain reading of the section indicates that the supply of the information by means otherwise than a copy is permissible where the supply of a copy in permanent form is not possible or where the Data Subject agrees otherwise. This defines the limits of the Data Controller’s obligations. It generally entitles the Data Subject to a copy of the information in permanent form, but less than this is sufficient in certain circumstances. For instance, if the Data Subject agreed to accept an email containing the information that would be sufficient, and it would not be necessary to send a printout or a hard copy of the original document containing the information.
It is also notable that s. 4(9) goes further than Article 12A of the Directive, which does not go so far as to require a copy of the data but merely requires communication to the Data Subject of an “intelligible form of the data”.
64. The Trial Judge rejected the argument made by the appellant in the following terms: -
“27. Prima facie the provisions of S. 4(9) of the Act of 1988 appeared to do no more than declare the legal consequence of supplying the Data Subject with a copy of the information concerned in permanent form. However, the use of the word “shall” followed by the word “unless” and the subsequent specification of three exceptions indicates that the subsection is to be construed as providing for a mandatory requirement that a copy of the information concerned in permanent form is to be supplied to the Data Subject who requests access to his or her personal data unless the exceptions provided for at s. 4(9)(a) or (b) applies.
28. It follows that where a Data Subject duly requests access to his or her personal data under s. 4(1)(a)(iii) of the Act, the Data Controller is obliged to supply a copy of the information concerned in permanent form to the Data Subject unless the supply of such a copy is not possible or it would involve disproportionate effort or the Data Subject agrees to the information being communicated in some other material form.
29. Absent such an agreement and where either of the exceptions specified at s. 4(9)(a) apply, the Data Controller is not obliged to supply to the Data Subject a copy of the information concerned in permanent form. However, pursuant to s. 4(1)(a)(iii) of the Act the Data Controller is obliged to communicate the data in an ‘intelligible form’, that is, in a form that is sufficient to allow the Data Subject to ‘become aware of those data and to check that they are accurate and processed in compliance with (the) Directive so that the person may where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the Directive’ (see judgment of ECJ in Y.S. & Ors).”
65. I see no error in this reasoning. It will be for other courts to decide on appropriate facts the circumstances in which a Data Controller may refuse to supply a copy on the grounds that it is “not possible”, or would involve “disproportionate effort”. Some situations are covered by express statutory exemption from access under s.5, for example, where a claim of legal professional privilege is maintained (s.5(1)(g)). In other circumstances, for example, if personal data is mixed with other information which is commercially sensitive, or contains information related to other individuals that is covered by GDPR, then it is conceivable that there is no entitlement to a copy of the information in permanent form, and the obligation may be satisfied by communication of the relevant data by redacted copy or written narrative or in some other intelligible form.
66. At paragraph 25 of his written submissions the appellant submits that section 4(9) does not “impose a ban on access to the original of personal information. The legislation is accommodative in this respect if a Data Subject wishes to access the original of personal information.” While it is correct to say that s. 4(9) does not impose a ban on access to the original, it does not give the Data Subject any right to original documentation, and is not in that sense “accommodative”, and it is certainly not mandatory.
67. The DPC drew the court’s attention to Article 29 of the Directive which provides that -
“A Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as “The Working Party”, is hereby set up.”
The Working Party published “Article 29 Data Protection Working Party - Opinion 4/2007 on the concept of personal data” which was adopted on 20 June 2007. This has already been referred to in the judgment just delivered by Binchy J. The following appears on page 5:-
“The Scope of the Data Protection Rules should not be overstretched
An undesirable result would be that of ending up applying data protection rules to situations which were not intended to be covered by those rules and for which they were not designed by the legislator.”
In my view what the appellant seeks in pursuing his appeal is precisely this - an undesirable result of extending the ambit of access under the DP Acts beyond the design or intention of the legislature, or the letter or purpose of Article 12.
68. The appellant also argues that “access to the originals of personal data would be specifically desirable if there are suspicions of manipulation, re-engineering of copies provided or fraud”, but as previously stated, that issue simply does not arise on the facts of the instant case. It is conceivable that in certain circumstances a data controller may have an obligation to produce an original document containing personal data, for example, where it is required for confirmation of rectification or erasure of data under section 6. Equally it may be that such document falls to be produced as a result of unlawful acts that give an entitlement to discovery or inspection in judicial review, plenary action or other legal proceedings, rather than under the Directive. Doubtless this is a question that will fall to be determined by another court on appropriate facts.
69. I am therefore satisfied that the trial judge correctly identified and interpreted Article 12 of the Directive and section 4 of the Data Protection Acts 1988 and 2003. The appellant has failed to point to any error of law in the judgment of the High Court. So far as the facts of the instant case are concerned I agree with the conclusion of the trial judge that the obligation on the Notice Party as Data Controller does not extend to an obligation to provide the original exam script to the appellant, or to produce them for inspection.
70. I would therefore dismiss this appeal.
Costs/outlays in Circuit Court and High Court
71. There is a cross appeal by the respondent in respect of the costs order made in the High Court whereby it was ordered:
“The Court doth vacate the Order for costs in favour of the Respondent and Notice Party pursuant to the said Circuit Court Order dated 3rd June 2014
And the Court doth make no Order as to the costs of the herein Appeal or that of the Court below.”
In the Respondent’s Notice it is argued that the High Court erred in vacating the Circuit Court costs order in favour of the respondents, and in making no order as to costs in the High Court, and that there “was no reason to depart from the normal rule that costs follow the event.”
72. This court has not heard argument on this, and clearly the respondent is entitled to elaborate on its arguments in respect of the cross appeal, and the appellant is entitled to an opportunity to make his submissions on this issue. However it is appropriate that I should indicate a preliminary view.
73. The appellant lost in the Circuit Court and the note of the judgment of Deery J records his reasons for making the costs orders which he did in the following terms:
“7. The Respondent and Notice Party each applied for their costs. The Notice Party sought its costs on the basis that it had informed Mr. Nowak that it held the original scripts yet he nonetheless pursued his appeal. In the circumstances, the Notice Party said that it had no choice but to appear. Mr. Nowak opposed the applications for costs. The Court noted that the costs had been incurred by the Data Protection Commissioner and the Notice Party in relation to Mr. Nowak’s appeal and he allowed costs to both. He refused a further application by the Appellant for a stay on the Court’s orders.”
74. The Circuit Court judge was clearly entitled to make that order as Mr. Nowak failed in his appeal to that court. However the situation had changed by the time this appeal on a point of law came before the High Court: firstly Mr. Nowak had succeeded at that stage in the Supreme Court on his entitlement to pursue an appeal where DPA ruled that a complaint was ill founded and therefore ‘frivolous or vexatious’; secondly the CJEU ruled in his favour in finding that examination scripts contain ‘personal data’. This resulted in the High Court making certain consent orders quashing the decision of the Circuit Court on these two points, although it upheld the Circuit Court “in so far as it rejected, as a matter of fact, the appellant’s complaint that the original scripts had not been preserved” (Order no.3).
75. There is no separate judgment of the High Court explaining why the trial judge decided to make the orders that he did make. However it is entirely understandable that he would vacate the Circuit Court order granting costs to the respondent (and Notice Party), because it could now be said that that court fell into error and that Mr. Nowak had succeeded in appellate courts on the two central issues.
76. Furthermore, it was arguable (perhaps it was argued) before the High Court that Mr. Nowak should be entitled to his outlays of the Circuit Court against the respondent and/or Notice Party because of his success in the Supreme Court and before the CJEU, and in light of the orders made by the High Court vacating the Circuit Court orders. It could at least be said that he was successful on two out of three issues.
77. On the third issue, the claim that he was entitled to access the original examination scripts, Mr. Nowak chose to proceed, and he lost.
78. The question of costs is now governed by sections 168 and 169 of the Legal Services Regulation Act, 2015 which came into operation on 7 October, 2019, and an amended Order 99 RSC that came into operation on 3 December, 2019. However the old Order 99, as amended by S.I. 12 of 2008 which came into operation on 21 February 2008, applied at the time the trial judge made his decision on costs. There is extensive caselaw on the application of the old Order 99 much of which may well continue to be relevant as it would appear that s.169 of the 2015 Act is largely a codification of the pre-existing position. Suffice it to say that the general position is that costs usually follow the event and the successful party will usually be entitled to their costs, and while there are considerations that may justify a court departing from the ‘usual’ order ultimately the issue of where costs should lie is a matter for the discretion of the judge. The trial judge would have been entitled in the exercise of his discretion to have awarded all or the substantial part of his outlays in the Circuit Court to Mr. Nowak; equally he would have been entitled to award the costs of the appeal pursued on the third issue to the Respondent. It may well have been - although I readily accept that this is speculation on my part - that the trial judge decided instead that justice would best be met by simply making no order as to the costs/outlays in the Circuit Court, and no order as to the costs of the appeal that he did hear and determine, notwithstanding that Mr. Nowak lost that appeal. This is the type of balancing exercise that is not infrequently carried out by courts when addressing costs. Whatever the reasoning that was adopted by the trial judge, the outcome was one reached by him in the exercise of his discretion, and in my view it would be difficult to say that he erred in principle or that this court should interfere with the exercise of his discretion. This court has often expressed the view that deference is due to a trial judge in the exercise of their discretion, and that it will be slow to interfere. My preliminary view, unless persuaded otherwise, is that this court should not interfere with the costs orders made by the trial judge.
Costs of this appeal
79. There remains the question of whether the respondent is entitled to the costs of this appeal (assuming they are sought). Section 169 of the Legal Services Regulation Act, 2015 now applies, and provides, so far as relevant:
“169. (1) A party who is entirely successful in civil proceedings is entitled to an award of costs against a party who is not successful in those proceedings, unless the court orders otherwise, having regard to the particular nature and circumstances of the case, and the conduct of the proceedings by the parties, including—…”
- and what follows are considerations (a) - (g) that may lead the court to order
“otherwise”.
Mr. Nowak decided to pursue the appeal, and he has lost it and the respondent was “entirely successful”. The arguments that Mr. Nowak raised were substantially the same as those that were rejected in the High Court. None of the considerations listed in (a)-(g) would seem to have any application. In my view the costs of the appeal should follow the event, and therefore the respondent should be entitled to its costs. This is reinforced by the fact that IACI offered sight of the original scripts, but Mr. Nowak did not take up the offer. This is my preliminary view, unless persuaded otherwise.
80. Lest there be any confusion, the Notice Party did not appeal, or appear on this appeal, and I would therefore affirm the order of the High Court in respect of IACI’s costs (i.e no order as to its costs in the Circuit Court and the High Court).
81. In light of the foregoing, I would direct that –
(a) the parties seek to agree the costs orders to be made by this court - both in respect of the High Court order as to costs, and the costs of this appeal - within 7 days of delivery of this judgment electronically;
(b) in default of agreement between the parties on the costs orders, I would direct that Mr. Nowak and the Respondent have 14 days thereafter to lodge electronically with the Court of Appeal Office their written submission, not exceeding 1500 words, setting out their respective costs claims and arguments.
If on receipt and consideration of same this court considers that a further opportunity should be afforded for reply submissions, or that an oral hearing is appropriate, the parties will be notified accordingly. It is my view at this stage that a further oral hearing is unlikely to be warranted.
As this judgment is to be delivered electronically, Ní Raifeartaigh and Binchy JJ. have indicated their agreement with it. ACCORDINGLY THE COURT MAKES THE DIRECTIONS GIVEN ABOVE IN PARA. 81.
Result: Appeal Dismissed.