Court of Appeal finds memoranda relating to an audit are not personal data on foot of data access request
The Court of Appeal has confirmed that memoranda related to a complaint made about an audit do not constitute personal data.
This appeal relates to a data access request made by Mr Nowak, a trainee accountant, to his former employer. Mr Nowak has previously brought successful proceedings (ultimately to the CJEU) against the Data Protection Commission (the “DPC”) in which he sought access to his exam papers.
Mr Nowak alleges non-compliance by his former employer
Mr Nowak made a complaint to the Chartered Accountants Regulatory Board (“CARB”) against his former employer, alleging non-compliance with accounting and auditing standards in respect of two audits. His former employer provided CARB with memoranda addressing the complaints (the “Memoranda”). The Memoranda are the subject of these proceedings.
After CARB decided that Mr Nowak’s complaints did not merit further investigation, Mr Nowak made a data access request (“DAR”) to his former employer who provided him with his personnel file and other documentation.
DPC found memoranda did not contain personal data
Dissatisfied with the response from his former employer, Mr Nowak made a complaint to the DPC claiming that his former employer had failed to provide him with the Memoranda. His former employer informed him that the Memoranda did not constitute his personal data.
The DPC investigated the complaint and attended his former employers offices to inspect the Memoranda. The DPC found that the Memoranda did not contain any of Mr Nowak’s personal data for the purposes of the Data Protection Acts 1988 and 2003 (the “Data Protection Acts”).
Circuit Court upheld decision of the DPC
Mr Nowak appealed the DPC’s decision to the Circuit Court, which upheld the decision of the DPC. Mr Nowak then appealed the Circuit Court decision to the High Court on a point of law.
High Court dismisses Mr Nowak’s appeal
On appeal to the High Court, it was argued that the Circuit Court judge erred in determining the DPC’s decision that the Memoranda do not constitute personal data was “vitiated by a serious and significant error” (the test for an appeal of a decision of a statutory body).
The High Court found that the Memoranda, which addressed complaints of alleged non-compliance with accounting and auditing standards, did not contain any data of a personal nature and did not refer to Mr Nowak in any way. It held that there was no error of law made on the part of the Circuit Court judge and dismissed Mr Nowak’s appeal.
Circuit Court appeal
Mr Nowak appealed to the Court of Appeal on one ground – that the High Court had erred in holding that the Memoranda did not constitute personal data as interpreted by the Data Protection Directive 2002/58/EC (the “Directive”) and the Data Protection Acts.
Mr Nowak argued that the Memoranda did contain his personal data because they:
- were generated in response to a complaint he had made to CARB;
- should have been stored by his former employer on his personnel file; and
- should be considered in conjunction with the cover letter sent by his former employer to CARB as the letter specifically identified him as well as a CARB reference number for the complaint – meaning since the Memoranda was attached to the letter and the letter contained personal data that the Memoranda also constituted personal data.
The DPC responded that the Memoranda did not constitute personal data of Mr Nowak as the Memoranda:
- did not refer to or identify him in any way;
- were not concerned with his work and do not constitute an assessment of his work; and
- have no consequence for him.
Court of Appeal finds the memoranda do not constitute personal data
The Court of Appeal accepted the Memoranda did not refer to Mr Nowak by name but the accompanying letter did and Mr Nowak is identified by the Memoranda taken in conjunction with the cover letter. However, in order to constitute personal data, it must be established that the Memoranda constituted data “relating to” Mr Nowak.
The Court of Appeal found that information is deemed to “relate to” an individual when it is about the identity, characteristics or behaviour of that individual.
Mr Nowak did not claim that his complaint was linked to the performance of his duties as a trainee accountant on the complained-of audits. There was no link between his work on the audits and his complaint. The effect of the Memoranda and the determination of the complaint could only affect his former employer and not Mr Nowak.
The Court of Appeal determined:
- the Memoranda did not in any way engage the interests of Mr Nowak and as they did not refer to him in any way;
- the Memoranda were not “about” Mr Nowak or “refer to the identity, characteristics or behaviour of” him;
- to claim the Memoranda were personal data simply because it was created as a result of Mr Nowak’s complaint would be to “overstretch” the concept of personal data; and
- therefore the Memoranda do not “relate to” Mr Nowak and do not constitute his personal data.
What are the possible implications of this decision?
Up until now, the definition of personal data appeared to be ever expanding – particularly since the first Nowak decision from the CJEU found, in relation to exam scripts, that the examinee’s handwriting and even the examiner’s margin notes, constituted personal data.
Now in response to DARs, organisations may argue that simply because an employee makes a complaint does not mean that all documentation related to that complaint constitutes personal data – unless the complaint involves an assessment of the character or behaviour of that employee.