High Court of Ireland Decisions

APPROVED

THE HIGH COURT

 

[2024] IEHC 428

Record No. 2023/179CA

BETWEEN/

 

PETER NOWAK

APPELLANT

-AND-

 

THE DATA PROTECTION COMMISSIONER

 

RESPONDENT

JUDGMENT of Mr. Justice Conleth Bradley delivered on the 2^nd day of July 2024

INTRODUCTION

 

Preliminary

1.      This is Mr. Nowak’s appeal on a point of law against the judgment and Order of the Circuit Court (His Honour Judge John O’Connor) dated 9^th October 2023 dismissing Mr. Nowak’s appeal of the decision of the Respondent (“the DPC”) dated 21^st April 2022.

 

2.      Mr. Nowak (“the Appellant”) is a litigant in person. David Fennelly BL represented the DPC.

 

Background

 

3.      The Appellant had been employed as a trainee accountant by the Institute of Chartered Accountants in Ireland. He had successfully brought proceedings against the DPC, which concerned inter alia a complaint (made on 1^st July 2010 and restated on 14^th July 2010) in relation to his personal data access request to Chartered Accountancy Ireland (“CAI”) on or about 12^th May 2010 seeking access to personal data which inter alia included access to the Appellant’s examination script relating to his CAP2 examination.

 

4.      The Appellant exhibited in evidence before me (in an Affidavit sworn on 3^rd May 2024) a copy of his complaint to the DPC dated 1^st July 2010 and 14^th July 2010 together with relevant documentation. The Appellant’s complaint dated 1^st July 2010 attached a number of ‘exhibits’ and, inter alia, addressed matters under the following sub-headings: (1) Exhibit 11 – a copy of the breakdown of marks awarded in the original marking – Autumn session, subparagraphs (a) to (e); (2) Exhibit 12 – a copy of the breakdown of marks awarded in the original marking – Summer session, subparagraphs (a) and (b); (3) Exhibit 10A – Appeals process documentation, sub-paragraphs (a), (b) and (c); and (4) Exhibit 10B – Appeals process documentation, sub-paragraphs (a), (b), (c) and (d). The Appellant’s complaint dated 14^th July 2010 inter alia referred to the fact that CAI, through their solicitors, had notified him on 13^th July 2010 that they would not accede to the request in his letter dated 1^st July 2010.

 

5.      The proceedings initiated by the Appellant culminated in a reference by the Supreme Court to the CJEU which in turn determined, in Case-434/16, Nowak v The Data Protection Commissioner, EU:C:2017:994, that the Appellant’s exam papers (i.e., the written answers submitted by a candidate at a professional examination) and any comments made by an examiner, including markings in relation to those answers, constituted personal data for the purpose of EC Directive 95/46/EC on the protection of individuals with regard to processing of personal data.

 

6.      In light of the judgment of the CJEU, the Appellant’s appeal before the Supreme Court was successful, and consequently, the 2010 complaint was remitted to the DPC for further examination. The gravamen of the Appellant’s appeal in this application concerns how the DPC addressed the matter consequent upon the remittal. The Appellant was furnished with a copy of his script and was offered the opportunity to inspect the original script, but declined this offer and sought to pursue separate litigation seeking to establish a legal right to the original scripts. The Court of Appeal in Nowak v Data Protection Commissioner [2020] IECA 174 upheld the decision of the High Court (Coffey J.) that the obligation on the Institute of Chartered Accountants in Ireland (“ICAI”) to provide the Appellant with personal data, whether arising from section 4(1)(a)(iii) or section 4(9) of the Data Protection Act 1988, as amended (“DPA 1988”) did not include an obligation to provide the data in its original material form or, in the case of a document, to provide the original of that document. The Supreme Court issued a determination on 16^th December 2020 in Nowak v The Data Protection Commissioner [2020] IESCDET 144 refusing leave to appeal the decision of the Court of Appeal. In its determination, the Supreme Court stated that the Appellant had been furnished with a copy of his script and had been offered the opportunity to inspect the original script but had not chosen to take up this option, and that he had not made out any argument that the copy might not be a true copy of the original. The Supreme Court did not consider that the interests of justice justified the grant of leave to appeal, or that a matter of general public importance had arisen. The court added that it did not rule out the possibility that the question of whether a data subject is entitled to an original document might raise a matter of general legal public importance or one that might justify leave in the interests of justice, such as when issues of data erasure or rectification arise that the Appellant’s application must be refused on account of its factual context where no legal basis had been made out that might justify a consideration of that point.

 

7.      In the years following the judgment of the CJEU, the Appellant has been involved in other litigation and has filed additional regulatory complaints to the DPC against other bodies.

 

8.      The immediate background to this appeal arises from the Appellant’s initial complaint against CAI first made on 1^st July 2010 and restated on 14^th July 2010.

 

9.      The DPC wrote to the Appellant on 7^th March 2022 in response to his contentions that the DPC had failed or refused to investigate all of the points raised in the initial 2010 complaint. While the DPC was satisfied that all issues arising from the 2010 complaint had been addressed in full, it agreed to re-examine and consider each of the five issues raised by the Appellant. The DPC’s letter of 7^th March 2022 stated, on a provisional basis, its view that each of the five issues was inadmissible and/or unsustainable on its own terms and should be dismissed, but invited the Appellant to consider the DPC’s position on each of the five issues and to make representations in response within 21 days from 7^th March 2022. On 28^th March 2022, the DPC extended the time period for a response to  8^th April 2022 and stated that if the Appellant did not reply by that date, the DPC’s intention was to proceed in issuing a final decision in the week beginning 11^th April 2022. The DPC did not receive a response from the Appellant to its letter dated 7^th March 2022 and issued its final decision by letter dated 21^st April 2022 pursuant to section 10(1)(b)(ii) of the DPA 1988.

 

10.  In addition to these matters, the Appellant submitted two further complaints against the CAI. As mentioned, the first was a complaint from 27^th January 2014 – as to whether the Appellant was entitled to be furnished with the original documentation – which was the subject of an appeal to the Circuit Court on 3^rd June 2014, a further appeal on a point of law to the High Court on 26^th February 2018, and ultimately came before the Court of Appeal and was addressed in the decision of Haughton J. in 2020 (see Nowak v DPC [2020] IECA 174).

 

11.  In the Appellant’s further additional complaint dated 26^th July 2017, he sought to impugn the legality of the CAI’s rules, regulations and measures put in place for examinations. This was the subject of a decision of the DPC of 3^rd December 2019, with an appeal taken by the Appellant on 23^rd November 2021, which was later dismissed. The dispute in relation to the rejection of Mr. Nowak’s notice of appeal to the High Court is the subject matter of additional litigation against, inter alia, the Courts Service, which is now under further appeal to the Court of Appeal and a leapfrog appeal to the Supreme Court.

 

E-mail dated 12^th May 2020

12. The five issues were described by the Appellant in an e-mail exchange with Philip Lee, solicitors for the DPC on 12^th May 2020 (10 years after the initial complaint) which inter alia stated as follows:  

“Dear sir

I already communicated what should have been investigated by the DPC. Outstanding issues still to be investigated by the DPC are as such:

a) whether examination answers data existed in law in the context of the 1988 Act in light of the ICAI (Charter Amendment) Act 1966 (a new point that arose since the complaint was lodged);

b) whether all personal data was provided in response to the access request of 12 May 2010, such as confirmation by the Appeals Executive that the appeal in [sic.] ineligible, an Appeal Panel’s report or any other record proving the consideration of my appeal by it, the marking schemes supporting the marks awarded by the Examiner and Moderator (Exhibit 10 and 10a to my complaint);

c) whether the copies of the marking schemes and the reports of Examiner and Moderator were legitimate;

d) whether the ICAI implemented all necessary and required by law security measures and controls preventing the unauthorised amendments to the Examination marks data (recording and storing such data in pencil in my case is rather unacceptable and susceptible to fraud);

e) whether the ICAI was correct to refuse access to originals of personal data to include the marking schemes”.

 

The statutory regime

 

Right of access to data

13. Section 4(1)(a)(i) and (ii) of the DPA 1988 provides that “subject to the provisions of DPA 1988” an individual shall, if he or she so requests a data controller by notice in writing — (i) be informed by the data controller whether the data processed by or on behalf of the data controller includes personal data relating to the individual, (ii) if it does, be supplied by the data controller with a description of — (I) the categories of data being processed by or on behalf of the data controller, (II) the personal data constituting the data of which that individual is the data subject, (IV) the recipients or categories of recipients to whom the data are or may be disclosed.

 

14. Section 4(1)(a)(iii) of the DPA 1988 provides that “subject to the provisions of DPA 1988”, an individual shall, if he or she so requests a data controller by notice in writing have communicated to him or her in intelligible form (I) the information constituting any personal data of which that individual is the data subject, and (II) any information known or available to the data controller as to the source of those data unless the communication of that information is contrary to the public interest.

 

 

15. Section 4(1)(a)(iv) of the DPA 1988 provides that where the processing by automatic means of the data of which the individual is the data subject has constituted or is likely to constitute the sole basis for any decision significantly affecting him or her, be informed free of charge by the data controller of the logic involved in the processing, as soon as may be and in any event not more than 40 days after compliance by the individual with the provisions of this section and, where any of the information is expressed in terms that are not intelligible to the average person without explanation, the information shall be accompanied by an explanation of those terms.

 

 

16. Accordingly, the right of access is the right of access to the information constituting personal data and it is not a right of access to specific documents, to copies of documents or the originals of such documentation. The data controller is required to respond to such a request as soon as may be and not more than 40 days after compliance by the individual with the provisions of this section.

 

Appeals to the Circuit Court

17. Section 26 of the DPA 1988 provides for appeals to the Circuit Court as follows:

“26 (1) An appeal may be made to and heard and determined by the Court against —

 

(a) a requirement specified in an enforcement notice or an information notice,

 

(b) a prohibition specified in a prohibition

 

(c) [Deleted]

 

(d) a decision of the Commissioner in relation to a complaint under section 10(1)(a) of this Act, and such an appeal shall be brought within 21 days from the service on the person concerned of the relevant notice or, as the case may be, the receipt by such person of the notification of the relevant refusal or decision.

 

(2) The jurisdiction conferred on the Court by this Act shall be exercised by the judge for the time being assigned to the circuit where the appellant ordinarily resides or carries on any profession, business or occupation or, at the option of the appellant, by a judge of the Court for the time being assigned to the Dublin circuit.

 

(3) (a) Subject to paragraph (b) of this subsection, a decision of the Court under this section shall be final.

 

(b) An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court.

 

(4) Where— (a) a person appeals to the Court pursuant to paragraph (a) or (b) of subsection (1) of this section,

 

(b) the appeal is brought within the period specified in the notice or notification mentioned in paragraph (c) of this subsection, and

 

(c) the Commissioner has included a statement in the relevant notice or notification to the effect that by reason of special circumstances he or she is of opinion that the requirement or prohibition specified in the notice should be complied with, or the refusal specified in the notification should take effect, urgently,

 

then, notwithstanding any provision of this Act, if the Court, on application to it in that behalf, so determines, non-compliance by the person with a requirement or prohibition specified in the notice during the period ending with the determination or withdrawal of the appeal or during such other period as may be determined as aforesaid shall not constitute an offence.”

 

18. An appeal to the Circuit Court is not a rehearing on the merits. The burden is on an appellant to establish on the balance of probabilities that, taking the adjudicative process as a whole and paying the appropriate deference to the expertise of the decision-maker, the decision in question was vitiated by serious and significant error or a series of such errors: see Orange v ODTR [2000] 4 IR 159 per Keane C.J. At pages 184 -185; the Orange v ODTR decision was applied in Fox v The DPC [2024] IECA 92 at paragraph 8 per Noonan J. (the Court of Appeal comprised Noonan J., Binchy J. and Butler J.).

 

19. In accordance with section 26(3)(b) of the DPA 1988, this application constitutes the Appellant’s appeal to this court on a point of law. As restated by the Court of Appeal (Noonan J.) in Fox v The DPC [2024] IECA 92 at paragraphs 14 to 16, (which I paraphrase as follows), in contrast to an appeal to the Circuit Court, an appeal to the High Court is limited to a point of law and consequently is significantly more confined than an appeal to the Circuit Court. Whilst a Circuit Court appeal is governed by the Orange decision, the issue of appeals to the High Court on a point of law was considered in Nowak v Data Protection Commissioner [2022] IECA 95, where the Court of Appeal cited with approval the decision of the court in Fitzgibbon v The Law Society of Ireland [2015] 1 I.R. 516, where Clarke J. (as he then was) stated that with appeals on a point of law, a higher degree of deference, so far as the facts are concerned, is paid by the appellate body to the decision made by the body of first instance in an appeal of on a point of law only, as opposed to an appeal against error. The Court of Appeal also referred to the judgment of the Supreme Court in Attorney General v Davis [2018] 2 I.R. 357, where McKechnie J. held that a court may intervene to overturn a decision on a point of law in the following circumstances: (a) in cases of errors of law as generally understood, to include those mentioned in Fitzgibbon; (b) in cases involving errors such as would give rise to judicial review, including illegality, irrationality, defective or absence of reasoning and procedural errors of some significance; (c) errors which may arise in the exercise of discretion which are plainly wrong, notwithstanding the latitude inherent in such exercise; and (d) certain errors of fact.

 

20. Similarly, the case of Deely v Information Commissioner [2001] IEHC 91; [2001] 3 IR 439 involved an appeal on a point of law under the Freedom of Information Act 1997, where the High Court (McKechnie J.) at page 452 observed that “[t]here is no doubt but that when a court is considering only a point of law, whether by way of a restricted appeal or via a case stated, the distinction in my view being irrelevant, it is, in accordance with established principles, confined as to its remit, in the manner following:- (a) it cannot set aside findings of primary fact unless there is no evidence to support such findings; (b) it ought not to set aside inferences drawn from such facts unless such inferences were ones which no reasonable decision making body could draw;(c) it can however reverse such inferences, if the same were based on the interpretation of documents and should do so if incorrect; and finally; (d) if the conclusion reached by such bodies shows that they have taken an erroneous view of the law, then that also is a ground for setting aside the resulting decision.”

 

21. In addition to the above, in Fox v The DPC [2024] IECA 92 at paragraph 16, the Court of Appeal (Noonan J.) observed as follows:

“(16) McKechnie J.[ [1]] went on to identify three categories of error of fact which may lead to intervention by an appellate court, being:

“(1) Findings of primary fact where there is no evidence to support them;

(2) Findings of primary fact which no reasonable decision-making body could make; and

(3) Inferences or conclusions:

-Which are unsustainable by reason of any one or more of the matters listed above;

-Which could not follow or be deducible from the primary findings as made; or

-Which are based on an incorrect interpretation of documents.””

 

ASSESSMENT & DECISION

 

26(3)(b) DPA 1988

22. I consider, for the following reasons (set out in the remainder of this judgment), that the Appellant’s appeal in this case should be dismissed. The Appellant has not, in my view, established in this appeal that the judgment and Order of His Honour Judge O’Connor dated 9^th October 2023 was wrong in holding that the decision of the DPC dated 21^st April 2022 was not vitiated by serious and significant error or a series of such errors. In this regard, the Appellant has not established that the decision of the Circuit Court dated 9^th October 2023 involved points of law pursuant to section 26(3)(b) of the DPA 1988 which constitute errors, errors of law, or errors of fact which merit my overturning the decision of the Circuit Court.

 

23. I have had regard inter alia to the following matters (which are expanded upon in the remaining part of this judgment) in coming to this determination that the decision of the Circuit Court on 9^th October 2023 did not comprise an error of law or of fact: the consideration by the Circuit Court of the decision of the DPC dated 21^st April 2022 in the judgment dated 9^th October 2023 (the Orders of the Circuit Court dated 9^th October 2023 and 4^th December 2023), the decision of the DPC dated 21^st April 2022, the Appellant’s Notice of Appeal dated 11^th October 2023, the Appellant’s written submissions (and oral submissions at the hearing of this appeal), the submissions made on behalf of the DPC, both written and oral, the Book of Pleadings and Submissions to the Circuit Court including affidavits and exhibits on behalf of both parties and the Affidavit of Mr. Nowak dated 3^rd May 2024 exhibiting further evidence comprising a copy of the complaint to the DPC dated 1^st July 2010 and 14^th July 2010.

 

24. The decision of the Circuit Court on 9^th October 2023 inter alia found that the DPC in its decision dated 21^st April 2022 had correctly set out the proper application of the law and facts and the Appellant had failed to demonstrate any error of law or significant error of fact and refused the Appellant’s request to state a case.

 

25. To recap, the five issues which the Appellant claims remained extant from his 2010 complaint are stated to be as follows:

(a)   whether the examination answers data existed in law in the context of the 1988 Act in light of the ICAI (Charter Amendment) Act 1966;

(b)   whether all personal data was provided by the CAI in response to the subject access request dated 12^th May 2010 such as: (i) a confirmation by the Appeals Executive that the appeal is eligible; (ii) an Appeals Panel’s report or any other record proving the consideration of Mr. Nowak’s appeal by it; and (iii) the marking schemes supporting the marks awarded by the Examiner and Moderator (Exhibit 10 and 10a to the 2010 Complaint);

(c)   whether the copies of the marking schemes and the reports of (the) Examiner and Moderator were legitimate;

(d)   whether the CAI implemented all necessary and required by law security measures and controls preventing the unauthorised amendments to the examination marks data (recording and storing such data in pencil in (Mr. Nowak’s) case is rather unacceptable and susceptible to fraud); and

(e)   whether the CAI was correct to refuse access to originals of the personal data to include the marking schemes.

 

26. By way of overview, the issues raised in paragraphs (a), (c) and (d), for example, relate to the legality or legitimacy of the CAI’s regulations, measures, and marking schemes rather than data protection issues and are outside of the DPC’s statutory remit. In this regard, the DPC is ‘a creature of statute’, and must act within its statutory powers i.e., intra vires. The issue raised in paragraph (b) comprises a complaint about the adequacy of the response regarding the initial subject matter request and must be viewed in the context of what has occurred in the decade since that initial request. The issue raised in paragraph (e) deals with a further separate issue which is whether the Appellant is entitled to originals of the documentation.

 

27. As mentioned earlier, many of these issues raised by the Appellant in fact overlap with matters previously raised by him and which have been the subject of further decisions and appeals.

 

The DPC’s decision dated 21^st April 2022

28. In relation to the first issue – whether examination answers data existed in law in the context of the 1988 Act in light of the ICAI (Charter Amendment) Act 1966 – the DPC understood this to comprise the Appellant’s allegation that the CAI failed to comply with its obligations under the 1966 legislation in that it neglected to obtain certain required forms of approval for such of its Examinations, Appeals and Training Regulations which were operable between 2006 and 2009, and that as a result, the CAI was acting unlawfully when it conducted the examinations in that three year period such that the examinations themselves, and the results, are all alleged to be “unlawful, invalid, of no legal effect, and non-existing in law.”

 

29. The DPC letter refers, as a preliminary matter, to the Appellant’s acknowledgement that this is a new point which has arisen after or post the lodging of the original 2010 Complaint, a fact alone which would justify the rejection of this complaint. However, without prejudice to this preliminary point, the DPC considered the substance of this first issue and inter alia stated that “[p]oint 1 fails in any event in circumstances when the very same point has previously been rejected by this office, for the reasons set out in detail in a recent decision delivered by this office on 3^rd December 2019 in response to a separate complaint brought by you against CAI, Ref.3/17/1348 (That complaint was first made by you on 26^th July 2017). The decision of 3^rd December 2019 was in turn the subject of a statutory appeal brought by you under (Dublin) Circuit Court Record No. 2020/712. As you are aware, that appeal was dismissed by Order of the Circuit Court (Judge O’Connor) made on 23^rd November 2021, and no further appeal is extant.”

 

30. At pages 5 and 6 of its decision letter dated 21^st April 2022, the DPC then sets out her conclusions on this first issue as follows:

“In the circumstances, and given that no new factual or legal material has been put before me that would warrant a different finding, I am satisfied that it is both necessary and appropriate that I would dispose of Point 1 on the basis of my prior decision of 3 December 2019, as upheld on appeal by the Circuit Court. That is to say: (i) The essence of the allegation you make is that the CAI failed to comply with its obligations under the ICAI (Charter Amendment) Act 1966, in that it failed to obtain certain required forms of approval for such of its Examinations, Appeals and Training Regulations as were in operation in the period between 2006 and 2009; (ii) You allege that, as a result, CAI was acting unlawfully when it conducted examinations in the period 2006 to 2009; the examinations themselves are also said to have been “unlawful, invalid, of no legal effect or non-existing in law” and so on; (iii) As previously advised, I have no authority or jurisdiction to make any finding in relation to any alleged failure on the part of the CAI to comply with its obligations under the 1966 Act. (iv) It is likewise not a matter for me to make findings on the legal consequences (if any) said to flow from any alleged failure on the part of CAI [sic.] to obtain the forms of approval referred to above; (v) Consistent with the position set out at points (iii) and (iv), you yourself said the following when I wrote to you on 7 November 2017 (in the context of my examination [sic.] your complaint against Chartered Accountancy Ireland, Ref. No. 3/17/1348)[ [2]] asking you to inform me if you were pursuing such issues with CAI or any other entity: –

“These matters fall outside the remit of the Commissioner, and I’m therefore not obliged to provide more information in relation to my own other legal proceedings”[ [3]]”.

 

31. The DPC in its decision letter dated 21^st April 2022 concludes that “[f]or all of these reasons, I find that the allegations made by you against the CAI, both in terms of the absence of one or more necessary regulatory approval(s), and the consequences said to flow from that alleged failure, are not sustainable and so must be dismissed.”

 

32. The reference in the above quoted extract to “[t]hese matters fall outside the remit of the Commissioner, and I’m therefore not obliged to provide more information in relation to my own other legal proceedings” is an acknowledgement by the Appellant, in March 2018, that this is a matter outside the jurisdiction of the DPC.

 

33. In relation to the second issue – whether all personal data was provided in response to the access request of 12^th May 2010, such as: (a) confirmation by the Appeals Executive that the appeal is eligible; (b) Appeal Panel’s report or any other record “proving consideration” of the Appellant’s appeal by it; and (c) the marking schemes supporting the marks awarded by the Examiner and Moderator – this is addressed at pages 6 and 7 of the DPC’s decision letter dated 21^st April 2022. Thus, a decade after the initial complaint in 2010, the Appellant was contending that there remained outstanding documentation in relation to these three specific subcategories of documentation each of which was said to contain personal data relating to the Appellant.

 

34. The DPC’s decision letter dated 21^st April 2022 treats of the first and second issues – i.e., (a) confirmation by the Appeals Executive that the appeal was eligible and (b) the Appeal Panel’s report or any other record “proving consideration” of the Appellant’s appeal – by referring to the CAI’s letter to the Appellant of 1^st June 2010, which enclosed a number of documents relating to the appeal process, including a copy of the letter dated 4^th March 2010 “confirming the outcome of your appeal”. Additionally, the letter enclosed a copy of a “report submitted by the Examiner and Moderator on re-mark of your Autumn script”.

 

35. The DPC’s decision letter dated 21^st April 2022 refers, separately, to the letter of 18^th June 2018, where CAI’s solicitor furnished the Appellant with a copy of the report of the appeal regarding the marking of the Autumn 2009 script and referred to CAI’s position that the documents released to the Appellant on 1^st June 2010 and 18^th June 2018 contained the full extent of the personal data it held arising from or relating to the Appeal Panel’s consideration of the Appellant’s appeal. The DPC came to the view that there was no factual or evidential basis to suggest that CAI was withholding material that ought to have been properly disclosed to the DPC and reiterated that her role was “limited to examining whether or not the personal data held by the CAI referable to the categories and subcategories has been released in response to your request. It is not for me to interrogate whether, when or how an Appeal Panel considered your appeal, or to seek to look behind documents, which on their face indicate that an Appeal Panel did in fact consider and report on your appeal. Those are matters which manifestly fall outside the scope of my statutory remit. Nor, indeed, is it my role to assess whether CAI has complied with its own internal rules in connection with the conduct of appeals. As such, the absence of a stand-alone document confirming the eligibility of your appeal is not, in and of itself, evidence of a failure on the part of CAI to comply with your request.”

 

36. The DPC’s decision then refers to Gore & Grimes, Solicitors’ letter to the Appellant dated 18^th June 2018 which also enclosed copies of the marking plans for the Summer and Autumn SFMA exams and concluded on the basis of the available information that the Appellant’s request under this second issue had been satisfied and therefore the complaint under point 2 was not sustainable and must be dismissed.

 

37. In relation to the third issue – whether the copies of the marking schemes and the reports of Examiner and Moderator were legitimate – this matter is addressed on pages 8 and 9 (beginning on the last line of page 7) of the DPC’s letter dated 21^st April 2022, which points out that issues in relation to “the legitimacy” of the schemes and reports did not fall within the DPC’s statutory remit.

 

38. In this context, the decision letter of the DPC then refers to the judgment of the Court of Appeal (Haughton J.) in Nowak v DPC [2020] IECA 174 (1^st July 2020), where the Court of Appeal (Haughton J.) addressed this issue at paragraphs 42 to 44, as follows:

“(42) At paragraph 24 of the appellant’s written Submission to this court the appellant includes the following:-

“24. ... Access to the originals of personal data would be specifically desirable if there are suspicions of manipulation, re-engineering of copies provided or fraud.”

 

 At hearing the appellant argued that when a copy document is “doctored” then access to the original is desirable, and (more broadly) that unless the data subject has access to the original he/she cannot “check to see whether the data is accurate”. He said he “had concerns about the original scripts” and “believed that the copy was not correct” and that he “wanted the originals because of the risk of manipulation...[they] can be doctored. Data can be manipulated”. In so doing the appellant relied on his first request for the original script, which was not acceded to by ICAI, and his concerns about the original. He thus asserted “The right of the data subject to check for accuracy”.

(43) I am satisfied that the appellant cannot pursue the ‘doctoring’ argument as it is based on hypothetical facts. The DPC, and the Circuit Court on appeal, can only determine the complaint on the facts presented to them. The High Court on appeal, and now this court on further appeal, under section 26 can only determine a point of law. It must take the facts presented on affidavit and as found by the Circuit Court, and determine the point of law raised on those facts.

(44) In respect of the Second Complaint, there was never any evidence before the DPC or the Circuit Court to ground a suspicion of “manipulation”, “re-engineering”, or “doctoring” of the original script, and still less any hard evidence to support such allegations or any allegation of fraud.”

 

39.  The DPC’s decision letter further emphasised the extract from the quotation referenced by Haughton J. to “I am satisfied that the appellant cannot pursue the ‘doctoring’ argument as it is based on hypothetical facts. The DPC, and the Circuit Court on appeal, can only determine the complaint on the facts presented to them”. In this regard, the Appellant’s seeks to question, again hypothetically, the legitimacy of the documentation in the context of this complaint. In seeking to do so, the Appellant’s argument is contrary to the decision of the Court of Appeal in Nowak v DPC [2020] IECA 174. On page 9 of its decision letter, the DPC points out by reference to the decision in Nowak v DPC [2020] IECA 174, that the Court of Appeal “accepted that it is not a matter for the DPC to engage with or seek to determine entirely speculative allegations, based on hypothetical facts, to the effect that one or more documents containing your personal data may have been doctored. No evidence of any such doctoring has been put forward by you” and that the court had also noted that the Appellant had been “provided with an opportunity to inspect the original versions of key documents to which your allegations relate” and that the Appellant had declined to avail of that opportunity. The DPC concluded, for the reasons which she had set out, that the complaint made under Point 3 could not be sustained and it was dismissed.

 

40. In relation to the fourth issue – whether the ICAI implemented all necessary and required by law security measures and controls preventing the unauthorised amendments to the Examination marks data (recording and storing such data in pencil in my opinion is rather unacceptable and susceptible to fraud) – this matter is addressed on page 9 of the DPC’s decision letter and similar to its response to the Appellant’s third point, the DPC considered that it was being asked to engage with what were hypothetical facts, not relating to any discernible data protection issue, but rather the integrity of the CAI’s exam procedures. The letter repeated that this fell outside of the statutory remit of the DPC and determined that the complaint made under Point 4 could not be sustained and it was dismissed. The Circuit Court, in its judgment of 9^th October 2023, at paragraph 11.1, also referred to the Appellant’s submission as being “at best a subjective analysis of hypothetical facts of what he believes to be issues of the law and facts available”.

 

41. In relation to the fifth issue – whether the ICAI was correct to refuse access to originals of personal data to include the marking schemes – this is addressed on pages 9 and 10 of the DPC’s decision letter. Again, it is pointed out that this issue was also addressed in the judgment of the Court of Appeal (Haughton J.) in Nowak v DPC [2020] IECA 174. The court inter alia found that the Appellant was not entitled to have access to the original examination scripts and the DPC determined that “[p]recisely the same point holds true in respect of the marking schemes also, save that an additional point also arises, i.e. there is nothing before me to suggest that the marking scheme holds any personal data relating to an identified exam candidate in any event”. The DPC concluded for the reasons which she had set out that the complaint made under Point 5 could not be sustained and it was dismissed.

 

42. The matters which were raised by the Appellant in his Circuit Court appeal were addressed on behalf of the DPC in the Affidavit of Sandra Skehan, Deputy Commissioner and Head of Regulatory Activity in the DPC, sworn on 14^th December 2022.

 

43. As just referred to, for example, the Appellant alleged that the CAI had failed to comply with its obligations under the 1966 Act, in that it neglected to obtain certain required forms of regulatory approval under the regulations in operation under the Act at the time. The Appellant acknowledges that this is a new issue which was not raised in the 2010 complaint. Ms. Skehan, at paragraph 29 of her Affidavit sworn on 14^th December 2022, states that without prejudice to this fact, this issue had in fact been considered and previously rejected by the DPC in a reasoned decision dated 3^rd December 2019 in response to a separate complaint brought by the Appellant against the CAI, as one of the 2017 complaints, and which had subsequently been the subject of an unsuccessful statutory appeal. She avers that leaving these considerations aside, this first point fell outside the remit of the DPC under the DPA 1988 and accordingly, even if the 2010 complaint could be seen as encompassing this point, it was not sustainable and therefore, had to be dismissed.

 

44. Ms. Skehan, at paragraphs 13 to 17 of her Affidavit sworn on 14^th December 2022, summarises the broader context against which the appeal in this case should be viewed. As referred to earlier in this judgment, she states, for example, that parallel complaints were also submitted by the Appellant to the DPC, including a fresh complaint against the CAI, made on 26^th July 2017, as well as separate complaints against the Courts Service (made on 14^th August 2017) and the Irish Auditing and Accounting Supervisory Authority (made on 21^st August 2017) which she refers to as “the 2017 Complaints”. She states that at the point of the release of the Appellant’s examination scripts in June 2018, the Appellant was continuing to pursue each of the 2017 Complaints.

 

45. This broader context in which the Appellant’s appeal should be viewed is described by Ms. Skehan in paragraphs 15 and 16 of her Affidavit sworn on 14^th December 2022 as follows:

“(15) I say that, in February and April 2019, a series of applications for judicial review proceedings were in turn made by the Appellant, in which the High Court was asked to make orders compelling the Commissioner to deliver decisions in respect of the 2017 Complaints. (These included the judicial review proceedings referenced at paragraph 4 of the affidavit sworn herein by Mr. Nowak on 12 May 2022). In the event, each of the applications for judicial review was struck out with no order on 3 December 2019, without a hearing on the merits, decision having been delivered by the Commissioner in the intervening period in connection with the 2017 Complaints.

(16) Notwithstanding the fact that the issues raised in the 2010 Complaint had long since been addressed in the manner set out above, the Appellant also continued to agitate this particular complaint. Against the backdrop of a fresh threat of judicial review proceedings to compel the Commissioner to issue a decision in respect of the 2010 Complaint (made by emails dated 3 March 2020 and 4 May 2020), and in the light of certain submissions made by Mr. Nowak to the Court of Appeal on 5 May 2020 at the hearing of the appeal that resulted in the above-referenced Court of Appeal Judgment, the Commissioner’s Solicitors wrote to the Appellant by email of 7 May 2020, noting that the Commissioner considered that the 2010 Complaint had been fully dealt with and calling upon the Appellant to clarify whether he considered that certain issues arising from the 2010 Complaint remained outstanding and, if so, to identify each such issue said to be outstanding. In response to this correspondence, by email dated 12 May 2020… the Appellant identified five issues which he claimed to be outstanding, and which will be addressed in detail below. It is in light of this correspondence that the Commissioner issued the Decision, the subject of this appeal.”

 

46. This explains further the context in which the initial 2010 Complaint, in relation to the subject access request, was essentially merged into the complaint which was the subject of the decision of the DPC dated 21^st April 2022 and appealed, first, to the Circuit Court and then, to this court. Therefore, notwithstanding the DPC’s view that the issues in the 2010 complaint had been fully dealt with, she afforded the Appellant an opportunity to raise any further issues which he contended were outstanding.

 

The decision of the Circuit Court

47. The Appellant appealed the DPC’s decision of 21^st April 2022.

 

48. In its decision and judgment on the appeal in Nowak v Data Protection Commission (also referred to as The Data Protection Commissioner) (unreported, The Circuit Court (His Honour Judge John O’Connor), (Record No. 2022/003208), 9^th October 2023), the Circuit Court’s conclusions are set out at page 9 of the judgment at paragraphs 11.1 to 11.4, as follows:

“11.1 The court is satisfied that the Decision under appeal is not vitiated by a serious and significant error or a series of such errors, which justify setting aside the decision. The Appellant’s submission is at best a subjective analysis of hypothetical facts of what he believes to be issues of the law and facts applicable. In this court’s view this is done without demonstrating any error of law or significant error of fact, which would justify this court setting aside the decision under this appeal. In this regard the court believes the Respondent has correctly set out the proper application of the law and facts.

11.2 In addition, in the court’s view there is no basis for stating a case to the Court of Appeal. There is not in the court’s view, an arguable case of substance. In addition, the establishment of justice between the parties does not require a case stated.

11.3 The court in coming to its decision in this case carefully analysed the pleadings, the written and oral submissions and the case law furnished to the court. The court also considered the oral arguments made in court.

11.4 Accordingly, the Cour dismisses the Appellant’s appeal. The Court will hear the parties as to any application for costs.”

 

49. At paragraphs 10.1 to 10.7, the Circuit Court correctly identified the applicable test in an appeal pursuant to section 26 of the DPA 1988 as being that set out by Keane CJ. in Orange v ODTR [2000] 4 IR 159 at pages 184 -185 i.e., whether the decision of the DPC dated 21^st April 2022 was vitiated by serious and significant error or a series of such errors.

 

50. The Circuit Court set out the five points or issues raised by the Appellant and determined by the DPC on 21^st April 2022 at paragraph 9.4, pages 5 to 7 of the court’s judgment and incorporates the submissions made on behalf of the DPC in response to Appellant’s arguments, grouping them as follows: the first and fifth points; the second and third points; and the fourth point.

 

Appeal to the High Court

51. The Appellant’s Notice of Appeal to this court is dated 11^th October 2023 and inter alia provides as follows:

“And FURTHER TAKE NOTICE that the Appellant will raise, as required by Section 26 of the Data Protection Acts 1988 & 2003, the following points of law at the hearing of this appeal: (1) The learned Circuit Court judge erred in law in upholding the Commissioner’s decision who failed to determine that the Institute of Chartered Accountants in Ireland breached the Data Protection Acts 1988 & 2003 by releasing a copy of the examination exam script outside of the statutory time-frame; (2) Did the Data Protection Commission have jurisdiction to rule on the legal status of the Institute of Chartered Accountants in Ireland’s (‘Institute’s) Examinations Regulations or make a factual finding in this respect in the course of the investigation of the complaint ? (3) If the Institute’s Examinations Regulations concerning examinations conducted between 2006-2009 were unlawful, invalid and of no legal effect, did the invalid regulations caused, in turn, the processing of the examinations and training contract data unlawful in the context of the Data Protection Acts 1988 & 2003 and 95/46/ED Directive ? (4) Whether a mere assessment of a letter of complaint and supporting documentation by the Commissioner amounted to an investigation of the complaint pursuant to Section 10 of the Data Protection Acts 1988 & 2003; (5) Whether the examinations answers (examinations scripts) data could be regarded as personal data in light of disallowed Examinations Regulations pursuant to Section 6 of the Institute of Chartered Accountants in Ireland (Charter Amendment) Act 1966; (6) Further or other point of law advanced at the hearing of the appeal”.

 

 

 

Statutory time-frame (Point 1)

52.  Insofar as the first point of law sought to be advanced by the Appellant – in relation to ‘the provision of data outside the statutory timeframe’– is concerned, this did not form any part of the ‘reformulated complaints’ or the DPC’s decision dated 21^st April 2022 (i.e., the decision under appeal to the Circuit Court) and cannot therefore be properly part of either the appeal to the Circuit Court in the first instance or constitute an appeal to this court on a point of law within the meaning of section 26(3)(b) of the DPA 1988. Whilst a reference is made to this issue at paragraph 9 of the Appellant’s submissions before the Circuit Court, it was not identified as a ground of appeal. In those circumstances, therefore, where it was never a part of the reformulated complaint or the decision in the first instance, it could not have formed part of the appeal. Accordingly, I find that the argument sought to be made in relation to ‘the provision of data outside the statutory timeframe’ never formed part of the reformulated complaint and cannot now be part of this appeal.

 

53.  Whilst Mr. Nowak was ultimately successful on the issue as to whether his exam scripts constituted personal data, in Case-434/16, Nowak v The Data Protection Commissioner, EU:C:2017:994, Mr. Fennelly BL makes the further point that the request for the data made on 12^th May 2010 was replied to in less than one month of that date by the CAI on 1^st June 2010, i.e., within the 40-day timeframe set out in section 4 of the DPA 1988 referred to earlier in this judgment.

 

 

 

 

The DPC’s investigation (Point 4)

54. The fourth paragraph of the Notice of Appeal questions whether there was an adequate investigation, viz., “whether a mere assessment of a letter of complaint is sufficient”.

 

55. The Appellant contends that in reaching its decision dated 21^st April 2022 the DPC did not in fact carry out an investigation and this represented a serious error of law. It was submitted that the Supreme Court had directed that the matter be investigated afresh, and that notwithstanding the endorsement of a different reference number, that this was not in fact done and that there was an initial failure by the DPC to respond within the statutory time period and there were illegalities in how the CAI dealt with data. The Appellant also contended, in response to Mr. Fennelly BL, that it is not correct to state that there was a reformulation of the complaint and that, consequent upon the order of the Supreme Court, the DPC was required to carry out a fresh investigation but did not do so. He says that while there was an assessment of his complaint by the DPC, there was no investigation or inspection. The Appellant further contends that arguments which he made before the Circuit Court were not addressed in the judgment of the Circuit Court.

 

56.  The Appellant’s complaint that there was inadequate investigation by the DPC is not, however, borne out by the facts of this case and the Appellant’s engagement with the DPC as reflected, for example, in its decision-making letter dated 21^st April 2022. Further, the point urged by the Appellant that this alleged inadequacy was exemplified by an absence of a formal notice of investigation, having regard to the extensive nature of that engagement over a protracted period, or that an alleged error arose because there was no communication with the CAI, are without merit having regard to the extensive engagement with the CAI and its legal advisers and discounts the fact that this was a re-stated complaint arising from an initial 2010 complaint. The assertion that there was an inadequate investigation does not constitute a point of law pursuant to section 26(3)(b) of the DPA 1988 which constitutes an error, error of law or error of fact which merits my overturning the decision of the Circuit Court.

 

57.  The Appellant contends that there was no investigation in line with section 10 of the DPA 1988. He cites the lack of recorded action which would show any communication or steps which were taken to deal with his complaint. He made reference to the initial complaint dated 1^st July 2010 and 14^th July 2010 which were exhibited to his Affidavit sworn on 3^rd May 2024 and that he had more arguments to make than those which were initially made on his behalf when he was legally represented. He submitted that much of his complaint related to his seeking information about his marks and documentation in relation to this, including seeking original documentation as he believed these documents were inaccurate. He submitted that the DPC had dismissed his arguments but had based her decision on other documents.

 

58.  The Appellant in both his written and oral submissions contended that the decision of the Court of Appeal dated 1^st July 2020, relied upon by the DPC, related to different circumstances. In essence, the point made by the Appellant was that he believed the original documents were not accurate and in order to assess their accuracy, the DPC required access to this documentation.

 

59.  Notwithstanding the Appellant’s submissions, the exercise by the DPC of her discretion was entirely in accordance with her statutory mandate. In terms of the enforcement of data protection, section 10(1)(a) of the DPA 1988 provides that the Commissioner may investigate, or cause to be investigated, whether any of the provisions of the DPA 1988 have been, are being or are likely to be contravened in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of the opinion that there may be such a contravention. By virtue of section 10(1)(b)(i) and (ii) of the DPA 1988 which states that discretion is informed in the circumstances where a complaint is made to the Commissioner under section 10(1)(a) of the DPA 1988, he/she is required to (i.e., “shall”) (i) investigate the complaint or cause it to be investigated, unless they are of the opinion that it is frivolous or vexatious, and (ii) if he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter the subject of the complaint, notify, in writing, the individual who made the complaint of his or her decision in relation to it and that the individual may, if aggrieved by the decision, appeal against it to the Circuit Court under section 26 of the DPA 1988 within 21 days from the receipt by him or her of the notification.

 

60.  In giving effect to the EU Data Protection Directive (Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data), section 10(1A) of the DPA 1988 provides that the Commissioner may carry out or cause to be carried out such investigations as he or she considers appropriate in order to ensure compliance with the provisions of this Act and to identify any contravention thereof .

 

61.  In summary, whilst the Appellant refers to certain provisions of the 2018 Act (which are not applicable to this case), it is for the DPC, in the exercise of his or her statutory discretion (whether unamended or as it applies today) to determine the extent and scope of the investigation that it considers appropriate in any given case.

 

Extraneous Legal Issues (Points 2, 3 & 5)

62.  The second and third paragraphs of the Notice of Appeal dated 11^th October 2023 seek to raise questions in relation to the DPC’s jurisdiction to rule on the legal status of Regulations of the Institute of Chartered Accountants. Similarly, the fifth paragraph of the Notice of Appeal seeks to question further the legality of the Institute of Chartered Accountants’ internal rules or measures i.e., whether the exam answers constitute personal data, having regard to the disallowed exam regulations.

 

63.  First, these three points in the Notice of Appeal appear to relate to the first of the five issues set out in the e-mail dated 12^th May 2020. Second, as reflected in the decision-making letter of the DPC dated 21^st April 2022, set out earlier in this judgment, this attempt by the Appellant to raise the legality or legitimacy of the CAI’s own measures, which the DPC reiterated was outside of her statutory remit, would involve the DPC potentially acting ultra vires, a point previously pointed out by the DPC to the Appellant (which the Appellant previously acknowledged).

 

64.  Further, in this case, in relation to the subject access request, after an interval of a decade, the Appellant had sought to incorporate new elements in 2020 into a 2010 complaint and the DPC was entitled to come to the view that there was no evidence to suggest that the CAI had failed to comply with the subject access request or that there was any outstanding documentation in the manner suggested by the Appellant. There is, therefore, no basis for overturning the decision of the Circuit Court in its consideration of those matters.

 

65.  In assessing the decision of the Circuit Court through the prism of Attorney General v Davis [2018] 2 I.R. 357 and Deely v Information Commissioner [2001] IEHC 91; [2001] 3 IR 439, I also have had regard to the fact that the Appellant was offered the facility to inspect the documentation and never availed of that facility in 2018.

 

66.  Further, in its judgment in Nowak v DPC [2020] IECA 174, the Court of Appeal (Haughton J.) beginning at paragraph 53, referred to the decision of the CJEU in joint cases, C-141/12, Y.S. v Minister voor Immigratie, Integratie en Asiel and C-372/12, Minister voor Immigratie, Integratie en Asiel v M & S (ECLI:EU:C:2014:2081), [2015] 1 WLR 609, where the CJEU held at paragraph 58 that “a data subject cannot derive from either Article 12(a) of Directive 95/46 or Article 8(2) of the Charter the right to obtain a copy of the document or the original file in which those data appear. In order to avoid giving the data subject access to information other than the personal data relating to him, he may obtain a copy of the document or the original file in which that other information has been redacted.”

 

67.   In Nowak v DPC [2020] IECA 174 at paragraph 56, the Court of Appeal (Haughton J.) observed that the above extract from the decision of the CJEU in Y.S, “must be read in the context of the earlier sentence where the CJEU was clearly stating that neither Article 12 of the Directive nor Article 8(2) of the Charter could support either the right to obtain a copy of the document, or the original file; it must also be read in the context of redaction from the original file of information other than personal data relating to the data subject. Moreover in Y.S. the CJEU was not called upon to consider or decide a claim for access to the original document containing personal data”.

 

68.  At paragraph 58 of the judgment of the Court of Appeal, in Nowak v DPC [2020] IECA 174, Haughton J. found that “[f]ar from assisting the appellant, in my view the trial judge quite properly relied on the decision in Y.S. which clearly supports the argument of the DPC that under the Directive the data subject’s entitlement is to access to the relevant information/personal data in an “intelligible form”, and does not support a right under the Directive to personal data in its original form”.

 

69.  In the circumstances, I dismiss the Appellant’s appeal against the judgment of the Circuit Court (His Honour Judge O’Connor) dated 9^th October 2023.

 

PROPOSED ORDER

 

70.   I shall make an order dismissing the Appellant’s appeal against the judgment of the Circuit Court (His Honour Judge O’Connor) dated 9^th October 2023.

 

71.  I shall put the matter in for mention before me on Thursday 10^th October 2024 at 10:30 to address the question of costs and any further ancillary or consequential matters which arise.