The Court of Appeal has dismissed Peter Nowak’s appeal against the High Court’s decision to uphold the Data Protection Commission’s dismissal of his data protection complaint against Chartered Accountants Ireland (CAI). The court affirmed the High Court order and proposed that the DPC receive its costs, subject to either party seeking a different order within 21 days of electronic delivery of the judgment.
The dispute began after Nowak failed a CAI professional examination in 2009. In 2010, he requested his personal data, including his examination scripts. CAI provided 17 documents but refused the scripts, arguing they were not personal data. Following litigation and a 2017 ruling by the Court of Justice of the European Union that exam answers and examiner comments could constitute personal data, CAI provided copies of Nowak’s scripts in June 2018 and offered him an opportunity to inspect the originals. He declined.
In 2020, Nowak identified five matters he said remained unresolved from his 2010 complaint. The DPC rejected them in April 2022. It concluded that it had no jurisdiction to rule on alleged failures by CAI under its 1966 legislation or on the legitimacy of CAI’s examination rules and records. It also found that the documents supplied in 2010 and 2018 represented the personal data held in response to the request, and that the DPC was not required to investigate speculative claims of document manipulation without evidence. The DPC further relied on an earlier Court of Appeal ruling that data access did not create a general right to original documents.
The Circuit Court dismissed Nowak’s appeal in October 2023, finding no serious or significant error in the DPC’s decision. The High Court dismissed his subsequent appeal on a point of law in October 2024. The Court of Appeal considered his further appeal, which challenged those decisions and the adequacy of the DPC’s investigation.
The Court of Appeal acknowledged that the High Court judge had incorrectly described Nowak as employed by CAI, but held that the mistake did not affect the issues decided. It also rejected arguments about the statutory response deadline and the adequacy of the investigation. The court said the deadline issue had not been included among the five matters Nowak identified in 2020, and noted that CAI had responded to the original request within 40 days with the documents it considered personal data. It found the DPC’s investigation adequate and within its statutory discretion.
The court said Nowak had provided no evidence of erasure, unauthorised amendment or other interference with his data. It found that the earlier offer to inspect the original scripts gave him an opportunity to compare them with the copies. On the facts before it, the court concluded that he had been provided with a faithful and intelligible reproduction of his personal data. The appeal was dismissed; the court did not determine any new claim under section 4(7), which had not been raised before the DPC or lower courts.