Case C‑434/16

Peter Nowak

v

Data Protection Commissioner

(Request for a preliminary ruling from the Supreme Court (Ireland))

(Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Article 2(a) — Concept of ‘personal data’ — Written answers submitted by a candidate in a professional examination — Examiner’s comments with respect to those answers — Article 12(a) and (b) — Extent of the data subject’s rights to access and rectification)

Summary — Judgment of the Court (Second Chamber), 20 December 2017

1.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Scope — Personal data — Concept ‑ Written answers submitted by a candidate in a professional examination and examiner’s comments with respect to those answers — Included

(European Parliament and Council Directive 95/46, Art. 2(a))

2.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 – Rights to rectification and erasure of data— Scope – Rights of a candidate with respect to answers submitted in a professional examination and examiner’s comments with respect to those answers – Purpose of guaranteeing the protection of the candidate’s right to private life

(Charter of Fundamental Rights of the European Union, Art. 7; European Parliament and Council Regulation No 2016/679; European Parliament and Council Directive 95/46, Recital 41and Arts 6(1)(d) and (e) and 12(a) and (b))

1.      Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that, in circumstances such as those of the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data, within the meaning of that provision.

As the Court has held previously, the scope of Directive 95/46 is very wide and the personal data covered by that directive is varied (judgment of 7 May 2009, Rijkeboer, C‑553/07, EU:C:2009:293, paragraph 59 and the case-law cited). The use of the expression ‘any information’ in the definition of the concept of ‘personal data’, within Article 2(a) of Directive 95/46, reflects the aim of the EU legislature to assign a wide scope to that concept, which is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject. As regards the latter condition, it is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person.

As regards the comments of an examiner with respect to the candidate’s answers, it is clear that they, no less than the answers submitted by the candidate at the examination, constitute information relating to that candidate. The finding that the comments of the examiner with respect to the answers submitted by the candidate at the examination constitute information which, by reason of its content, purpose or effect, is linked to that candidate is not called into question by the fact that those comments also constitute information relating to the examiner. The same information may relate to a number of individuals and may constitute for each of them, provided that those persons are identified or identifiable, personal data, within the meaning of Article 2(a) of Directive 95/46.

(see paras 33-35, 42, 44, 45, 62, operative part)

2.      In so far as the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers are therefore liable to be checked for, in particular, their accuracy and the need for their retention, within the meaning of Article 6(1)(d) and (e) of Directive 95/46, and may be subject to rectification or erasure, under Article 12(b) of the directive, the Court must hold that to give a candidate a right of access to those answers and to those comments, under Article 12(a) of that directive, serves the purpose of that directive of guaranteeing the protection of that candidate’s right to privacy with regard to the processing of data relating to him (see, a contrario, judgment of 17 July 2014, YS and Others, C‑141/12 and C‑372/12, EU:C:2014:2081, paragraphs 45 and 46), irrespective of whether that candidate does or does not also have such a right of access under the national legislation applicable to the examination procedure. Of course, the right of rectification provided for in Article 12(b) of Directive 95/46 cannot enable a candidate to ‘correct’, a posteriori, answers that are ‘incorrect’.

In that context, it must be recalled that the protection of the fundamental right to respect for private life means, inter alia, that any individual may be certain that the personal data relating to him is correct and that it is processed in a lawful manner. As is apparent from recital 41 of Directive 95/46, it is in order to be in a position to carry out the necessary checks that the data subject has, under Article 12(a) of the directive, a right of access to the data relating to him which is being processed. That right of access is necessary, inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the data controller and consequently to exercise the right set out in Article 12(b) of that directive (judgment of 17 July 2014, YS and Others, C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 44 and the case-law cited).

Last, it must be said, first, that the rights of access and rectification, under Article 12(a) and (b) of Directive 95/46, do not extend to the examination questions, which do not as such constitute the candidate’s personal data. Second, Directive 95/46 and Regulation 2016/679 which replaces the directive both provide for certain restrictions on those rights.

(see paras 52, 56-59)