Summary

The Irish Court of Appeal has clarified the scope of the definition of personal data – noting that, while the definition is deliberately very broad, it does not facilitate access by an individual to reports stemming from a complaint for the sole reason that the complaint was made by that individual.

On 1 July 2020, the Court of Appeal issued a judgment in the case Nowak v Data Protection Commissioner. The matter concerned an appeal from the High Court’s decision in relation to a data access request made by Mr Nowak to his former employer PwC in 2013 pursuant to the Data Protection Acts 1988 and 2003 (the Acts). PwC was a notice party to the proceedings.

In dismissing Mr Nowak’s appeal, the Court of Appeal held that a document provided by PwC in response to a complaint made by Mr Nowak, a former employee, to the statutory body which regulates PwC’s activity, relating to the conduct of the employer in respect of two audits and which did not identify Mr Nowak by name or contain identifying information, did not constitute his personal data.

The Court of Appeal noted that complexities can arise from the requirement to apply a broad definition to the term “personal data”, and considered that the appeal centred around the meaning of the term “relating to” when determining whether the document in question, PwC’s response to a complaint made by Mr Nowak to the regulatory body, contained data “relating to” Mr Nowak.

Background  

Mr Nowak was employed by PwC as a trainee accountant and had his employment terminated in 2009 as he failed to pass particular exams. Mr Nowak has initiated various sets of proceedings, one which centred around his data access request for the relevant exam scripts, that went to the CJEU. This appeal however, relates to a complaint Mr Nowak made in 2011 to the Chartered Accountants Regulatory Board (CARB), the statutory body that regulates PwC, alleging non-compliance on PwC’s part with accounting and auditing standards in respect of two particular audits which he had worked on. Having been made aware of the allegation, PwC prepared a response (the Cover Letter) to the complaint and attached memoranda (the Memoranda), which are the subject of the appeal.

CARB decided no further investigation was required. Mr Nowak then submitted a data access request to PwC. Mr Nowak was dissatisfied with what he received (it did not include the Memoranda) and made a complaint to the Data Protection Commissioner (the DPC). Following this, PwC provided further information. Still dissatisfied, although he had received the Cover Letter, Mr Nowak specifically sought the Memoranda. When he received a response from PwC noting that the Memoranda did not constitute his personal data, he resumed his complaint with the DPC.

A representative from the DPC investigated the matter and inspected the Memoranda. He concluded that the Memoranda did not constitute Mr Nowak’s personal data as defined in the Acts and swore an affidavit to that effect. The DPC upheld PwC’s refusal to provide the Memoranda. Mr Nowak appealed the decision of the DPC to the Circuit Court who found against him. He then appealed to the High Court, on a point of law only. The High Court’s judgment, which upheld the DPC’s decision, was then appealed to the Court of Appeal.

Court of Appeal

High Court Decision

The Court of Appeal comments that the High Court judgment noted that Mr Nowak had accepted the test which is to be applied by a court in an appeal of a statutory body’s decision – that a plaintiff must establish as a matter of probability that the decision reached was vitiated by a serious and significant error or a series of such errors. The High Court also found that in applying the test, the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The High Court concluded that there had been no error of law on the part of the Circuit Court judge in determining that the decision of the respondent was not vitiated by a serious error or a series of errors, and accordingly dismissed the appeal.

Grounds of Appeal

In his Notice of Appeal, Mr Nowak asserted just one ground of appeal – that the High Court erred in finding that the Memoranda did not constitute personal data within the meaning of the Acts. Mr Nowak attempted to expand his grounds of appeal in written submissions but this was not allowed. Mr Nowak put forward three reasons why the Memoranda amounted to his personal data:

• The Memoranda were generated in response to a complaint he had made to CARB, and in turn related to audit work performed by him in the course of his employment;
• The Memoranda should have been stored by the notice party on his personnel file;
• The Memoranda should be considered in conjunction with the Cover Letter, which identifies Mr Nowak and the file reference number allocated to him as complainant by CARB.

Mr Nowak sought to rely on the broad definition of personal data and also attempted to call into question the record kept by the DPC of its investigation. The Court of Appeal noted that the investigation and other findings of fact determined by the Circuit Court could not be appealed.

Submissions

The DPC submitted that the Memoranda did not constitute Mr Nowak’s personal data because they did not identify him in any way nor did they refer to him or his work or have any consequence for him. The DPC also asserted that Mr Nowak was using the data access request as a method of testing CARB’s response to his complaint and that, while the definition of personal data is to be interpreted broadly, regard must to be had to the content, purpose or effect of the data. In support of this submission, the DPC made reference to the judgment of the CJEU in the case which Mr Nowak previously brought against the DPC and asserted that no privacy interest of Mr Nowak’s was engaged by the Memoranda. The DPC also submitted that the courts should be slow to intervene with the findings of an experienced statutory body,  regarding matters which relate to its particular expertise.

PwC submitted that Mr Nowak failed to identify any error of law on the part of the High Court judge and also that the investigation carried out by the DPC concluded that the Memoranda did not amount to personal data and the DPC’s expertise should be respected. With regard to Mr Nowak’s claim that the Memoranda related to work carried out by him, PwC asserted that this claim had not been advanced by Mr Nowak previously and also that it was accepted that the Memoranda related to the complaint made and contained no assessment of Mr Nowak’s work.

Decision

The Court of Appeal noted that Mr Nowak was not referred to by name nor was he identified in any way by the Memoranda. It commented, however, that this is not conclusive and went on to consider the content, purpose and effect of the Memoranda, noting that the matter centred around whether the Memoranda contained data “relating to” Mr Nowak. The Court of Appeal concluded that the Memoranda could not in any way engage Mr Nowak’s privacy interests and held that

“while the definition of personal data is deliberately very broad, to interpret the  Memoranda as being personal data for the purposes of the Data Protection Acts and/or the Directive [EC Directive 95/46/EC ], for the sole reason that it was generated as a result of a complaint made by the appellant would, in my opinion, be to “overstretch” the concept of personal data.”

Commentary

The decision will be welcomed by data controllers as it provides clarity on how the Irish Courts will approach questions on the breadth of the concept of personal data, including useful commentary from Mr Justice Binchy on key European data protection caselaw and guidance including the CJEU decision in YS v.Ors.(Case C-372/12) and the EDPB (then Article 29 Working Party) Opinion 4/2007 on the concept of personal data. Key to the court’s analysis was that, while the Memoranda related to a complaint generated by the data subject, the subject matter of that complaint related to  compliance by PwC with its professional and accountancy standards rather than anything related to the data subject, such as an assessment of his work as a trainee accountant. The decision also demonstrates a reluctance of the courts to look behind findings of fact made by the Data Protection Commission and is a reminder for both data subjects and data controllers of the need to raise all relevant arguments and facts at the investigation phase or upon first appeal.

By John Magee & Clodagh Butler