The High Court has ruled that a person’s right to access personal data does not, by itself, require a data controller to provide the original document in which the data appear.
Mr Justice Coffey delivered the judgment on 26 February 2018 in Peter Nowak’s appeal against a 2014 Circuit Court decision concerning his examination script. The appeal was on a point of law. The remaining question for the High Court was whether the Data Protection Acts 1988 and 2003 entitled a data subject to receive personal data in its original form.
The Circuit Court had dismissed Mr Nowak’s appeal from a decision by the Data Protection Commissioner. It had held that an exam script containing answers transposed from a textbook did not constitute personal data, and that the Commissioner’s decision not to investigate the complaint on that basis could not be appealed under section 26.
The Commissioner accepted that subsequent rulings by the European Court of Justice and the Supreme Court had resolved both issues in Mr Nowak’s favour. The European court held that a candidate’s written answers in a professional examination, and an examiner’s comments on them, constitute personal data. The Supreme Court held that a finding that a complaint was ill-founded in law did not prevent a statutory appeal.
The parties consented to orders quashing the Circuit Court’s decisions on those two issues and quashing the Commissioner’s decision insofar as it found that the script was not personal data. The High Court also declared that the Circuit Court had erred by failing to address whether section 4 access rights entitled a data subject to access the original of their personal data.
The parties agreed that the High Court would decide that remaining issue rather than sending it back to the Circuit Court.
Mr Justice Coffey interpreted section 4 in light of EU Directive 95/46/EC. He held that section 4(9) generally requires the data controller to provide a copy of the relevant information in permanent form. The stated exceptions are where providing a copy is impossible or would involve disproportionate effort, or where the data subject agrees to another form.
If an exception applies, the controller must still communicate the personal data in an intelligible form that allows the person to understand it and check its accuracy and lawful processing. The court concluded that the access obligation does not extend to providing the data in its original material form or, when the data are in a document, supplying the original document.
The judgment determined the remaining legal question. It did not order that Mr Nowak be given the original exam script.