Peter Nowak v Data Protection Commissioner

• Jurisdiction: Ireland
• Judge: Mr. Justice Birmingham
• Judgment Date: 07 March 2012
• Neutral Citation: [2012] IEHC 449
• Court: High Court
• Date: 07 March 2012

Nowak v Data Protection Commissioner

IN THE MATTER OF THE DATA PROTECTION ACTS 1988 AND 2003, IN THE MATTER OF AN APPEAL PURPORTEDLY PURSUANT TO SECTION 26 OF THE DATA PROTECTION ACTS 1988 AND 2003

BETWEEN

PETER NOWAK

APPELLANT

AND

DATA PROTECTION COMMISSIONER

RESPONDENT

[2012] IEHC 449

230 CA/2010

THE HIGH COURT

DATA PROTECTION

Appeal

Data Protection - Data access - Personal data - Complaint - Decision by commissioner that complaint frivolous or vexatious - Jurisdiction of Circuit Court to hear appeal of such decision - Interpretation of âÇÿfrivolous' - Deferential standard of review of decision of statutory body - Whether examination script personal data - Refusal to give access to examination script of applicant - Appeal to Circuit Court unsuccessful on ground no jurisdiction to hear appeal - Appeal to High Court - Whether Circuit Court jurisdiction to hear appeal - Whether examination script personal data - Whether complaint frivolous or vexatious - Orange Communications v Director of Telecommunications Regulation (Unrep, SC, 18/5/2000) and State (Keegan) v Stardust Compensation Tribunal [1986] IR 642 applied - R v North West Suffolk (Mildenhall) Magistrates' Court, ex p Forest Heath District Council [1997] EWCA Civ 1575, (Unrep, CA, 16/5/1997) and Ulster Bank Investment Funds Limited v Financial Services Ombudsman [2006] IEHC 323, (Unrep, Finnegan P, 1/11/2006) approved - Data Protection Act 1988 (No 25), ss 10, 26 and Sch 7 - Data Protections Acts 1988 to 2003 - Council Directive 95/46/EC of 24/10/1995, articles 20 and 28 - Appeal dismissed (2010/230CA - Birmingham J - 07/03/2012) [2012] IEHC 449

Nowak v Data Protection Commissioner [2013] 1 ILRM 207

Facts: The appellant was a registered student and unsuccessful in an examination and submitted a personal data access request. He submitted thereafter a formal complaint to the Data Protection Commissioner who found no breach in the circumstances. An appeal was brought to the Circuit Court against this decision. The Circuit Court held that it did not have jurisdiction pursuant to s. 26 Data Protection Acts 1998 and 2003 to hear an appeal as the Data Protection Commission had declined to investigate the appeal, pursuant to s. 10(1)(b) of the Acts.

Held by Birmingham J. affirming the order of the Circuit Court. The Court was in respectful agreement with the Circuit Court judge that the jurisdiction of the Circuit Court was to hear an appeal against a decision that had been arrived at after there had been an investigation. Absent investigation of the complaint and a decision relating to the investigation, the Circuit Court had no jurisdiction. The effect of ss. 10(1)(b)(i) and 26(1) when read together was quite clear. On the substantive issue, had it been possible to appeal to the Circuit Court, the Court would have been correct to uphold the conclusions of the Commissioner that the material in question did not amount to personal data and accordingly would dismiss the appeal.

DATA PROTECTION ACT 1988 S10(1)(B)(ii)

DATA PROTECTION ACT 1988 S10(1)(B)(i)

DATA PROTECTION ACT 1988 S26

DATA PROTECTION ACT 1988 S10(1)(B)

DATA PROTECTION ACT 1988 S26(3)(B)

DATA PROTECTION ACT 1988 S26(1)

DATA PROTECTION ACT 1988 S10(1)(A)

DATA PROTECTION ACT 1988 S10(1)

EEC DIR 95/46 ART 28(1)

EEC DIR 95/46 ART 28

EEC DIR 95/46 ART 28(3)

EEC DIR 95/46 ART 28(4)

ULSTER BANK INVESTMENT FUNDS LTD v FINANCIAL SERVICES OMBUDSMAN UNREP FINNEGAN 1.11.2006 2006/56/11976 2006 IEHC 323

ORANGE COMMUNICATIONS LTD v DIRECTOR OF TELECOMMUNICATIONS REGULATION & METEOR MOBILE COMMUNICATIONS LTD (NO 2) 2000 4 IR 159 2000/15/5538

DATA PROTECTION ACT 1998 SCHED 7 (UK)

R v NORTH WEST SUFFOLK (MILDENHALL) MAGISTRATES COURT, EX PARTE FOREST HEATH DISTRICT COUNCIL 1998 ENV LR 9 1997 161 JP 401

1 Judgment of Mr. Justice Birmingham delivered the 7th day of March, 2012

2 1. This matter comes before the Court by way of an appeal from the judgment of Judge Linnane of the 16 ^th November, 2010. The background to the matter may be stated briefly. The appellant has registered as a student with Chartered Accountants Ireland (hereinafter "CAI") with a view to gaining a professional qualification as a chartered accountant. He sat an examination on the 7 ^th October, 2009 but was unsuccessful. By letter dated the 12 ^th May, 2010, Mr. Nowak submitted a personal data access request in which he asked CAI to release to him all personal data within the meaning of that term as set out in the Data Protections Acts 1988 to 2003 (hereinafter "the Data Protection Acts"). The letter specified that in particular he was seeking a copy of his examination script, all personal data relating to his appeal to the Appeals Panel with regard to his failure in that examination to include any personal data in existence concerning that appeal, any data compiled by the External Examiner and Appeals Panel and any data sent or received by CAI whether in manual or electronic format.

3 2. A very considerable volume of material was furnished to Mr. Nowak by CAI but in correspondence it was made clear to him that the material that would be provided to him would not include his examination script because CAI had received legal advice that the Data Protection Acts did not extend to that material. In passing, it may be noted and it is certainly a very strange feature of this case that although the procedures in relation to examinations conducted by the CAI provided exam candidates with an opportunity to read their scripts at a particular time and under controlled conditions, that Mr. Nowak never availed of this option. By letters dated the 1 ^st July, 2010 and the 14 ^th July, 2010, Mr. Nowak submitted a formal complaint to the Data Protection Commissioner, the respondent. CAI, it may be noted is registered as a "data controller" with the respondent,. These written complaints supplemented an earlier online complaint that had been submitted by him on the 17 ^th June, 2010. While Mr. Nowak in the form he completed and in correspondence had raised a number of issues, his principal concern, and this is the only matter that arises on the appeal hearing, was the refusal of CAI to provide him with a copy of his examination script based on the view that it had formed that the script did not constitute "personal data" within the meaning of the Acts. On the 21 ^st July, 2010, the respondent wrote to the appellant and informed him that having examined all the papers in the matter it had been concluded that Mr. Nowak had not identified any substantive breach of the Data Protection Acts. The letter stated:

"In accordance with s. 10(1)(b)(i) of the Data Protection Acts we are not obliged to investigate a complaint where no substantive breach of the Act remains to be investigated".

4 3. By a notice of motion dated the 11 ^th August, 2010 an appeal was brought to the Circuit Court. By letter of even date, the respondent wrote to the appellant's solicitors stating as follows:-

"It is noted that you intend to make an appeal to the Circuit Court under the provisions of the Data Protection Acts 1988 and 2003. You should be aware that the Data Protection Commissioner has not made an appealable decision under the provisions of s. 10(1)(b)(ii) of the Data Protection Acts 1988 and 2003. The Commissioner chose not to investigate your client's complaints as he had formed the opinion, in accordance with s. 10(1)(b)(i) of the Acts, that they were frivolous or vexatious. The Data Protection Acts do not provide for a right of appeal in such circumstances".

5 4. The matter came on for hearing before Judge Linnane on the 16 ^th November, 2010. She determined that the Court did not have jurisdiction pursuant to s.26 of the Data Protection Acts to hear an appeal as the Data Commissioner pursuant to s. 10(l)(b) of the Acts had declined to investigate the appellant's complaint having formed the view that the complaint was "frivolous or vexatious". She went on to hold that if she had jurisdiction to hear the appeal that she would have upheld the decision arrived at by the Commissioner and would have agreed with his views that the examination script did not constitute personal data.

6 5. Section 26(3)(b) of the Data Protection Acts provides that an appeal may be brought to the High Court on a point of law against a decision of the Circuit Court in relation to an appeal that had been brought to it. The notice of appeal in the present case which is dated the 26 ^th November, 2010 does not specify on what point of law the appeal is brought to the High Court but instead simply states that Mr. Nowak appeals the whole of the order of the Circuit Court declaring that the Circuit Court did not have jurisdiction to hear the appeal pursuant to s. 26 of the Data Protection Acts and dismissing the appeal and granting the respondent, the Data Protection Commissioner the costs of the proceedings. However, written submissions have been exchanged and by reference to those and more particularly by reference to the submissions delivered on behalf of the appellant it emerges that the following points of law are said to arise on the hearing of the appeal to this Court.

7 (1) Was the Circuit Court correct to conclude that it had no jurisdiction to hear an appeal in circumstances where the Data Commissioner had not embarked upon an investigation of the merits of the complaint but had declined to do...