Are Handwritten Exam Scripts Personal Data?

08 January 2018


Yes, according to the European Court of Justice (ECJ), in relation to a case referred from the Irish Supreme Court (Nowak v Data Protection Commissioner).


Mr Nowak had failed his accountancy examinations run by the Institute of Chartered Accountants (CAI) four times. He submitted a request to the CAI seeking all of his personal data. He contacted the Irish Data Protection Commissioner for help. However, they advised that examination scripts would not generally be considered “personal data”. Mr Nowak brought the matter before the Irish courts, and the Supreme Court referred the following questions to the ECJ.

  • Are a candidate's answers given on an examination script during a professional examination capable of being personal data under the Data Protection Directive?
  • If all, or some, of the information may be personal data, then what factors are relevant in determining this, and what weight should be given to such factors?

Decision of the Court

The Court held that a candidate’s handwritten script, and the examiner’s corrections, did constitute personal data. The test for whether personal data relates to a person is whether “the information, by reason of its content, purpose, or effect, is linked to a particular person”. The fact that the examiner cannot identify the candidate is irrelevant, as the exam board can. Both the examination script, and the examiner comments, relate to the candidate as both tell the reader something about the candidate’s intellect, handwriting, thought processes, and professional abilities, and the exam is likely to have an effect on the person’s interests. The Court said that failing to classify this information as personal data would mean that data controllers would not be obliged to comply with the principles and safeguards of Data Protection legislation, and individuals would be denied the attendant rights of access, rectification and objection to processing their personal data.

The ECJ did not think that there was a risk that a candidate could seek to use their right to rectification under Data Protection legislation to rectify incorrect answers, as errors in the answers given at the time are not “inaccurate data”.

Implications for UK Exams Bodies

In the UK, the soon to be defunct Data Protection Act 1998, states that information recorded by candidates during examinations is exempt from subject access requests. However, candidates are entitled to request their mark, and examiner comments. The General Data Protection Regulation (GDPR) will apply from 25th May 2018. Article 23 GDPR allows restrictions on the right to obtain a copy of personal data. The ECJ confirmed in the Nowak case, that it is open to Member States (including under the GDPR) to restrict access to personal data, including in the context of examinations. The draft UK Data Protection Bill, which expands upon, and modifies certain provisions of the GDPR in UK law, contains an exemption which means that many of the rights conferred by the GDPR (e.g. right to object to processing, right to erasure) will not apply to information recorded by candidates during examinations. The draft Bill also modifies the right to request copies of other personal information in the context of examinations, so that examinations bodies are not obliged to supply this information within the usual one month time period, but rather 40 days following the announcement of results. It may be that Parliament will review the provisions of the draft Bill in relation to examination scripts, in light of this recent ECJ decision.