The High Court has dismissed Peter Nowak’s appeal on a point of law against a Circuit Court decision upholding the Data Protection Commissioner’s handling of complaints about access to his professional examination data.
In a judgment delivered on 2 July 2024, Mr Justice Conleth Bradley found that Nowak had not shown an error of law or fact that warranted overturning the Circuit Court’s dismissal of his appeal. The High Court appeal concerned the Circuit Court’s decision of 9 October 2023, which had upheld the Commissioner’s decision of 21 April 2022.
Nowak, a former trainee accountant with the Institute of Chartered Accountants in Ireland, made a data access request to Chartered Accountancy Ireland in May 2010, seeking personal data that included his CAP2 examination script. After the Court of Justice of the European Union ruled in 2017 that examination answers and examiner comments could constitute personal data, his complaint was remitted to the Commissioner for further examination. He later received a copy of his script and was offered the opportunity to inspect the original, but declined.
The Commissioner’s 2022 decision addressed five issues Nowak said remained unresolved: whether examination answers existed in law given alleged defects in the institute’s regulations; whether all requested data had been provided; whether copies of marking schemes and reports were legitimate; whether safeguards prevented unauthorised changes to marks; and whether he was entitled to original documents.
The High Court said challenges to the legality of the institute’s regulations and the legitimacy of its marking materials fell outside the Commissioner’s statutory remit. On the access request, the Commissioner had concluded there was no evidential basis to find that further personal data was being withheld. The judgment also noted that the Commissioner’s role did not extend to examining how the institute applied its internal appeal rules or investigating speculative claims that documents had been altered.
Nowak argued that the Commissioner had not conducted an adequate investigation. The judge rejected that ground, finding the Commissioner had acted within her statutory discretion and had engaged with the complaint and the institute. The court also held that an argument about providing data outside the statutory timeframe could not be added at this stage because it had not formed part of the reformulated complaint or the decision under appeal. The judgment noted the institute had replied to the May 2010 request on 1 June 2010, within the 40-day period cited in the Data Protection Acts.
The High Court dismissed the appeal against the Circuit Court judgment. The judge directed that the case be mentioned on 10 October 2024 to address costs and any further consequential matters; the judgment did not determine costs.