Court of Appeal dismisses appeal where appellant failed to prove data was not a faithful reproduction.

APPROVED

NO REDACTION REQUIRED

THE COURT OF APPEAL

Record Number: 2024/262

Neutral Citation Number [2025] IECA 195

Faherty J. Allen J.

Meenan J

BETWEEN/

PETER NOWAK

APPELLANT

- AND -

THE DATA PROTECTION COMMISSIONER

RESPONDENT

JUDGMENT of Ms. Justice Faherty delivered on the 29th day of September 2025

1. This is an appeal from the judgment of the High Court (Bradley J. hereafter “the Judge”) delivered on 2 July 2024 ([2024] IEHC 428) and consequent order made on 8 October 2024 dismissing the appellant’s appeal against the judgment of the Circuit Court dismissing his appeal under s. 26(1)(d) of the Data Protection Acts 1988 – 2003 (hereafter for ease of reference “the 1988 Act” or “the Data Protection Acts”) against the decision of the Data Protection Commission (hereafter “the DPC” or “the Commissioner”) dated 21 April 2022.

Overview

2. The appeal is rather tangled. Before unravelling it, it is useful to take a step back to the event which gave rise to the appellant’s engagement with the DPC.

3. In 2009 the appellant sat a professional examination set by the Institute of Chartered Accountants in Ireland: which styles itself Chartered Accountants Ireland (“CAI”). He was judged to have failed: and following an appeal to the CAI Appeals Panel, that result was confirmed.

4. In 2010 the appellant submitted a personal data access request to CAI for release of all personal data held by CAI, and specifically for a copy of his examination scripts. He was provided with a bundle of copy documents and correspondence. CAI declined to provide the appellant with a copy of his examination scripts on the ground -it contendedthat these were not personal data.

5. The appellant filed a complaint with the DPC which culminated in a judgment of the Court of Justice of the European Union in 2017 which found that the appellant’s examination scripts were personal data: and in 2018 he was provided with copies and offered an opportunity to inspect the originals.

6. In the meantime, the appellant had made other complaints to the DPC which were the subject of protracted litigation. By the time of the reference to the CJEU, the focus of attention on the appellant’s complaint was on the examination scripts and the DPC took the view that it had been finally disposed of by the provision of the copy scripts to the appellant. The appellant, however, did not share this view and in 2020 pressed the DPC to address a number of issues which he contended were outstanding.

7. The foundation of the appellant’s appeal to this Court is his insistence that his 2010 complaint, as reformulated or explained in 2020, was not adequately addressed.

Background

8. On 1 July 2010, the appellant made a complaint to the DPC under the 1988 Act, which complaint was restated on 14 July 2010. The complaint concerned issues arising from the appellant’s data subject access request to CAI on or around 12 May 2010 seeking access to personal data of the appellant held by CAI arising from his enrolment and participation in a training scheme operated by CAI. In particular, he sought access to a copy of his examination scripts relating to his (then) recent “CAP2” examination and personal data concerning his appeal to the appeals panel relating to his failure of that examination.

9. On 1 June 2010, CAI responded to that request, enclosing copies of seventeen documents. However, CAI declined to release the appellant’s examination scripts as it took the view, based on legal advice, that the examination scripts were not personal data.

10. In the complaint the appellant filed with the DPC on 1 July 2010 he objected to the refusal to provide access to the examination scripts and expressed concerns about the “legitimacy” of certain documentation which had been released to him in response to his subject access request. As deposed to in the affidavit of Ms. Sandra Skehan of the DPC, upon an initial examination of the complaint the DPC agreed with CAI’s view that the examination scripts did not contain or comprise the appellant’s personal data and was of the view that the issues around the “legitimacy” of certain documentation furnished by CAI did not fall within the remit of the DPC. On that basis, the Office of the DPC declined to investigate the complaint on the merits. This was set out in correspondence sent by DPC to the appellant on 21 July 2010. In short, the appellant was advised that the Commissioner “has examined all the papers on this matter and has not identified any matter arising for investigation under the Data Protection Acts. The material over which you are seeking to exercise a right of correction is not personal data to which s. 6 of the Data Protection Acts applies. In accordance with s. 10(1)(b)(i) of the Data Protection Acts, we are not obliged to investigate a complaint where no breach of the Acts can be identified.” As the DPC took the view that the complaint was not sustainable it was considered by the DPC to be in a technical sense “frivolous and vexatious” and that the Office was not obliged to further investigate it.

11. The appellant contested this position in the courts. On his appeal under s. 26(1)(d) of the 1988 Act, the Circuit Court accepted the DPC’s argument that no appeal lay from a complaint that had been found to be frivolous and vexatious and so determined that it did not have jurisdiction to hear the appeal. On appeal, the High Court upheld that decision ([2012] IEHC 449). The appellant further appealed to the Court of Appeal which upheld the decision of the High Court in an ex tempore judgment and by order dated 24 April 2015. The appellant sought and was granted leave to appeal to the Supreme Court. In Nowak v. The Data Protection Commissioner [2016] IESC 585 the Supreme Court held that the fact that the DPC determined that a complaint was ill-founded did not preclude the appellant from bringing a statutory appeal pursuant to s. 26 of the 1988 Act.

12. On a preliminary reference from the Supreme Court, in Case C-434/16, Nowak v. The Data Protection Commissioner EU:C:2017:994, the CJEU held that Article 2(a) of Directive 95/46/EC of 24 October 1995 “On the protection of individuals with regard to the processing of personal data and on the free movement of such data” “must be interpreted as meaning that in circumstances such as those in the main proceedings, the written answers submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data, within the meaning of that provision”. (para. 62)

13. Following the CJEU’s ruling, on 13 March 2018, the Supreme Court made an Order on consent quashing the DPC’s decision not to investigate the appellant’s 2010 complaint and remitting the matter to the DPC “for investigation of the Appellant’s complaint”.

14. On 30 May 2018, CAI wrote to the appellant offering him copies of his examination scripts. Under cover of letter dated 18 June 2018, CAI’s solicitors furnished the appellant with copies of his scripts and receipt of same was confirmed by the appellant. By letter of

11 July 2018, CAI offered to facilitate an inspection by the appellant of the original scripts under controlled conditions. The appellant declined to take up that offer.

15. It is common case, that in tandem with his appeals from the DPC’s May 2010

decision, the appellant chose to pursue separate litigation to try to establish a right, under data protection law, to the original scripts.

16. Following correspondence received from CAI on 19 November 2013 to the effect that it had retained “copies” of the appellant’s examination data in response to the appellant’s earlier request for confirmation that CAI continued to hold the “originals” of his personal data, on 13 January 2013, the appellant lodged a further complaint with the DPC which stated inter alia that from CAI’s letter he had inferred that “the originals of the data were destroyed”. The DPC wrote to the appellant in relation to this complaint on 27 January 2014 wherein it reiterated its contention that examination scripts did not consist of personal data within the meaning of the Data Protection Acts and stating that the right of access under s. 4 was a right to request a copy of personal data held by a data controller. The letter concluded that as the DPC had not identified grounds for investigation, a formal investigation would not be commenced.

17. The appellant’s appeal in respect of this issue was dismissed by the Circuit Court (Deery J.) on 3 June 2014 from which the appellant then brought an appeal to the High Court on a point of law raising, inter alia, whether the Circuit Court judge was correct to determine that the appellant’s exam scripts did not constitute personal data and whether a data subject was entitled to access the originals of his or her personal data pursuant to s. 4 of the data Protection Acts.

18. Prior to that appeal coming on for hearing in the High Court, the first by those issues had been determined in the appellant’s favour by the CJEU’s ruling, in 2017, in Case C- 434/16, Nowak v. The Data Protection Commissioner on foot of the reference made by the Supreme Court in respect of the appellant’s 2010 complaint. Ultimately, the only issue that fell to the High Court to determine in the context of the appellant’s 2014 complaint was whether the appellant was entitled to access or obtain the originals of his examination scripts. The High Court (Coffey J.) found against the appellant on that issue from which the appellant duly appealed, and which culminated in a written judgment of this Court on 1 July 2020 in Nowak v Data Protection Commissioner [2020] IECA 174.

19. Writing for the Court, Haughton J. dismissed the appellant’s appeal, holding that the obligation on CAI to provide the appellant with personal data did not include an obligation to provide the data in its original form or, in the case of a document, to provide the original of that document. The appellant’s application for leave to appeal that judgment was refused by the Supreme Court ([2020] IESCDET 144).

20. Separate to the foregoing, it is common case that the appellant pursued a number of other issues against a range of parties, by means of litigation and by the filing of regulatory complaints, which issues can fairly be said to have their origin in his failure to pass his CAP2 examination. In relation to some of those issues, parallel complaints were submitted by the appellant to the DPC, including a fresh complaint against CAI made on 26 July 2017, as well as separate complaints against the Courts Service (made on 14 August 2017) and the Irish Auditing and Accounting Supervisory Authority (made on 21 August 2017).

21. At the point of release of the appellant’s examination scripts in June 2018, the appellant was continuing to pursue each of the 2017 complaints and the appellate process in relation to his 2014 complaint as referred to above.

22. In February and April 2019, a series of applications for judicial review were made by the appellant in which the High Court was asked to make orders compelling the DPC to deliver decisions in respect of his complaints. In the event, each of the applications for judicial review were struck out with no order on 3 December 2019, without a hearing on the merits, decisions having been delivered by the Commissioner in the intervening period in connection with the 2017 complaints.

23. The appellant, however, continued to agitate his 2010 complaint against the CAI. Against the backdrop of threatened further litigation, and in light of certain submissions made by the appellant at a hearing before this Court on 5 May 2020 in the context of his appeal against the order of Coffey J., the DPC’s solicitors, by email of 7 May 2020, called on the appellant to clarify what issues he considered to be outstanding from his 2010 complaint. In his email response to this correspondence on 12 May 2020, the appellant identified five issues which he claimed were outstanding. The five issues were expressed as follows:

“I already communicated what should have been investigated by the DPC. Outstanding issues still to be investigated by the DPC are as such:

a. Whether examination answers data existed in law in the context of the 1988 Act in light of the ICAI (Charter Amendment) Act 1966 (a new point that arose since the complaint was lodged);

b. whether all personal data was provided in response to the access request of 12 May 2010, such as confirmation by the Appeals Executive that the appeal in [sic.] ineligible, an Appeal Panel’s report or any other record proving the consideration of my appeal by it, the marking scheme supporting the marks awarded by the Examiner and Moderator…;

c. whether the copies of the marking schemes and the reports of [sic.] Examiner and Moderator were legitimate;

d. whether the ICAI implemented all necessary and required by law security measures and controls preventing the unauthorised amendments to the Examination marks data (recording and storing such data in pencil in my case is rather unacceptable and susceptible to fraud);

e. whether the ICAI was correct to refuse access to originals of

personal data to include the marking schemes”.

24. In light of that correspondence, the DPC issued its decision of 21 April 2022. Prior to that the DPC had afforded the appellant an opportunity to make submissions on a draft

decision. The appellant had declined that offer. Whilst counsel for the DPC sought to rely on this fact, nothing turns on it, in my view. The fact that the appellant may have declined to make submissions on the draft decision did not affect his entitlement to pursue the appellate processes provided for in the Data Protection Acts.

The 21 April 2022 decision

25. In its decision of 21 April 2022, the DPC concluded that none of the five points identified by the appellant as outstanding arising from his 2010 complaint could be sustained.

26. In relation to the first issue raised by the appellant in his 12 May 2020 email, the DPC understood this to comprise an allegation that CAI had failed to comply with its obligations under the Institute of Chartered Accountants in Ireland (Charter Amendment) Act, 1966, (No. 2 (Private) of 1966) as amended (“the 1966 Act”) in that it neglected to obtain certain required forms of approval for such of its examinations, appeals and training regulations which were operative between 2006 and 2009 with the result that CAI was acting unlawfully when it conducted the examinations in question the results of which were also alleged by the appellant to be “unlawful, invalid, of no legal effect and nonexisting in law”. The decision noted the appellant’s acknowledgement that this was a new point which had arisen after the lodging of the original 2010 complaint, a fact which, of itself, the DPC considered would justify the rejection of the complaint. However, without prejudice to that preliminary view, the DPC considered the substance of the first issue and was of the view that the point failed in circumstances where the very same point had been rejected by the DPC in a decision of 3 December 2019 in response to a separate complaint brought by the appellant against CAI on 26 July 2017.

27. The 3 December 2019 decision had, in turn, been the subject of a statutory appeal brought by the appellant to the Circuit Court which appeal was dismissed by order of the Circuit Court (His Honour Judge O’Connor) on 23 November 2021. The DPC noted that no further appeal from that order was extant. In all of those circumstances, the DPC was satisfied that it could dispose of the first point on the basis of its prior decision of 3 December 2019 which was to the effect that the DPC had no authority or jurisdiction to make any finding in relation to any alleged failure on the part of CAI to comply with its obligations under the 1966 Act. Accordingly, the allegations made by the appellant against CAI were “not sustainable and so must be dismissed”. The DPC further noted that in correspondence with the DPC in March 2018, the appellant himself had acknowledged that CAI’s compliance or otherwise with its obligations under the 1966 legislation was a matter outside the jurisdiction of the DPC.

28. In relation to the second issue alleged to be outstanding from 2010, viz, whether all the appellant’s personal data had been provided in response to his access request of 12 May 2010, the DPC concluded, having reviewed the documentation with which the appellant was provided on 1 June 2010 and 18 June 2018, that the documents released to him on those dates contained the full extent of the personal data held by CAI arising from or relating to the subject access request.

29. The DPC addressed the third issue raised, namely whether the copies of the marking schemes and the reports of the examiner and moderator were legitimate, by stating that issues in relation to the legitimacy of CAI’s schemes and reports did not fall within the DPC’s statutory remit, the scope of which was set (as far as the appellant’s complaint was concerned) primarily by reference to the Data Protection Acts.

30. Insofar as the appellant had expressed concerns that the documents the subject of the appellant’s complaint may have been “the subject of some sort of manipulation”, the DPC had regard to the judgment of this Court in Nowak v Data Protection Commissioner [2020] IECA 174 (which concerned the appellant’s 2014 complaint against CAI) where Haughton

J. was satisfied, as regards similar assertions of manipulation and “doctoring” of documents, that “the appellant cannot pursue the ‘doctoring’ argument as it is based on hypothetical facts. The DPC, and the Circuit Court on appeal, can only determine the complaint on the facts presented to them”.

31. Accordingly, in the present case, the DPC concluded that “it is not a matter for the DPC to engage with or seek to determine entirely speculative allegations, based on hypothetical facts to the effect that one or more documents containing [the appellant’s] personal data may have been doctored. No evidence of any such doctoring has been put forward by [the appellant]”. Furthermore, the DPC noted that CAI had provided the appellant with an opportunity to inspect the original versions of the key documents to which his allegations related, an opportunity which the appellant declined to avail of. For the reasons it set out, the DPC was satisfied that the third issue raised by the appellant could not be sustained.

32. In relation to the fourth issue, namely whether CAI had implemented “all necessary and required by law security measures and controls preventing the unauthorised amendments to the examination marks data”, the DPC was of the view that for the same reasons as outlined in respect of the appellant’s third issue, it could not be required to investigate “speculative allegations of fraud having their origin in hypothetical facts, and relating, not to any discernible data protection issue, but rather to the integrity of the CAI’s exam procedures. Such an investigation is simply not within the statutory remit of this office”. Accordingly, it found the fourth issue not sustainable.

33. In relation to the fifth issue, viz, whether CAI was correct to refuse access to originals of personal data, the DPC noted that this issue was addressed in Nowak v Data Protection Commissioner [2020] IECA 174 where Haughton J. held, on the facts before the Court, that the appellant was not entitled to access the originals of any examination scripts or related documents containing his personal data. The DPC was of the view that precisely the same held true in respect of the marking schemes relevant to the examination, save that, in the DPC’s view, an additional point also arose in that there was nothing before the DPC to suggest that the marking scheme contained any personal data relating to an identified exam candidate in any event. For those reasons the DPC found the fifth issue raised by the appellant in his May 2020 email also unsustainable.

34. In summary, the DPC found none of the five matters which the appellant alleged remained to be dealt with arising from his 2010 complaint could be sustained and so the complaint as advanced by the appellant by reference to those five points was dismissed.

The appeal to the Circuit Court

35. As provided for by s. 26 of the 1988 Act, the appellant appealed to the Circuit Court against the DPC’s decision. It is well established that the appeal provided for is not on the merits but rather an appeal against error. In line with the principles set out in Orange Limited v. Director of Telecoms (No. 2) [2000] 4 I.R. 159 and Nowak v The Data Protection Commissioner [2016] 2 I.R. 585, the burden was on the appellant to establish on the balance of probabilities that, taking the adjudicative process as a whole and paying appropriate deference to the expertise of the decision maker, the decision under appeal was vitiated by a serious or significant error or a series of such errors such as would justify setting aside the decision.

36. In a judgment delivered on 9 October 2023 the Circuit Court (His Honour Judge O’Connor) was satisfied that the decision was not vitiated by a serious and significant error or series of such errors which justified setting aside the decision. The Circuit Court judge was satisfied that the DPC in its decision of 21 April 2022 had correctly set out the application of the law and the facts. He considered the appellant’s arguments “at best a subjective analysis of hypothetical facts of which he believes to be the issues of law and facts applicable”. In the view of the Circuit Court judge, this was done “without demonstrating any error of law or significant error of fact which would justify this court setting aside the decision under appeal”. The Circuit Court also found no basis for stating a case to the Court of Appeal.

The appeal to the High Court

37. By s. 26(3)(b) of the 1988 Act, an appeal lies to the High Court on a point of law against the judgment and order of the Circuit Court. In his notice of appeal, the appellant asserted the following points of law: - “1. The learned Circuit Court judge erred in law in upholding the Commissioner’s

decision who failed to determine that the Institute of Chartered Accountants in Ireland breached the Data Protection Acts 1988 & 2003 by releasing a copy of the examination exam script outside of the statutory time-frame;

2. Did the Data Protection Commission have jurisdiction to rule on the legal status of the Institute of Chartered Accountants in Ireland’s [‘Institute’s’]Examinations Regulations or make a factual finding in this respect in the course of the investigation of the complaint?

3. If the Institute’s Examinations Regulations concerning examinations conducted between 2006 -2009 were unlawful, invalid and of no legal effect, did the invalid regulations caused [recte. cause], in turn, the processing of the examinations and training contact data unlawful in the context of the Data Protection Acts 1988 & 2003 and 95/46/EC Directive?

4. Whether a mere assessment of a letter of complaint and supporting documentation by the Commissioner amounted to an investigation of the complaint pursuant to Section 10 of the Data Protection Acts 1988 & 2003;

5. Whether the examinations answers (examinations scripts) data could be regarded as personal data in light of disallowed Examinations Regulations pursuant to Section

6 of the Institute of Chartered Accountants in Ireland (Charter Amendment) Act 1966;

6. Further or other point of law advanced at the hearing of the appeal”.

The High Court judgment

38. At para. 19 of his judgment, the Judge helpfully set out the principles, as developed in the case law, applicable to an appeal to the High Court on a point of law, noting (citing on the decision of this Court in Fox v. The Data Protection Commissioner [2024] IECA 92) that in an appeal point of law, the High Court is “significantly more confined than an appeal to the Circuit Court”. He referred to Nowak v Data Protection Commissioner [2022] IECA 95 where this Court cited with approval the dictum of Clarke J. (as he then was) in Fitzgibbon v. The Law Society of Ireland [2015] 1 I.R. 516 that in appeals on a point of law, a higher degree of deference, so far as the facts are concerned, is paid by the appellate body to the decision made by the body of first instance, as opposed to the case in an appeal against error. He noted also the judgment of the Supreme Court in Attorney General v. Davis [2018] 2 I.R. 357 where McKechnie J. outlined the circumstances whereby a court may intervene to overturn a decision on a point of law, summarised by the Judge as follows: -

(a) In cases of errors of law as generally understood, to include those mentioned in Fitzgibbon;

(b) In cases involving errors such as would give rise to judicial review, including illegality, irrationality, defective or absence of reasoning and procedural errors of some significance;

(c) Errors which may arise in the exercise of discretion which are plainly wrong, notwithstanding the latitude inherent in such exercise; and

(d) Certain errors of fact.

39. The Judge also quoted Deely v. Information Commissioner [2001] IEHC 91; [2001] 3 I.R. 439 which involved an appeal on a point of law under the Freedom of Information Act 1997, where the High Court (McKechnie J.) observed, at p. 452: - “There is no doubt but that where a court is considering only a point of law, whether by way of a restricted appeal or via a case stated, the distinction in my view being irrelevant, it is, in accordance with established principles, confined as to its remit, in the manner following: -

(a) It cannot set aside findings of primary fact unless there is no evidence to support such findings;

(b) It ought not set aside inferences drawn from such facts unless such inferences were ones which no reasonable decision making body could draw;

(c) It can however reverse such inferences, if the same were based on the interpretation of documents and should do if incorrect; and finally;

(d) If the conclusion reached by such bodies shows that they have taken an erroneous view of the law, then that also is a ground for setting aside the resulting decision.”

40. I note that in Sheedy v. Information Commissioner [2005] 2 I.R. 272, the Supreme Court broadly approved the principles in Deely, Fennelly J. observing that “the vehicle of appeal on a point of law cannot have been intended to involve the High Court, or, a fortiori, this court in detailed review of the respondent’s conclusions of fact”.

41. In the present appeal, I do not understand the appellant as suggesting that the Judge erred in setting out the remit of the High Court in an appeal under s. 26(3)(b), rather, he asserts that the Judge wrongly applied the relevant principles to his case. I turn now to the Judge’s consideration of the issues before him.

42. At the outset of the “Assessment and Decision” portion of the judgment, the Judge outlined his view that the appellant had not established that the judgment and order of the Circuit Court was wrong in holding that the decision of the DPC was not vitiated by serious and significant error or a series of such errors. Specifically, the Judge found that the appellant had not established that the decision of the Circuit Court involved a point of law pursuant to s. 26(3)(b) of the 1988 Act (para. 22). The bases for the Judge’s conclusion in this regard are found in the balance of the judgment and are addressed below.

43. With regard to the five issues which the appellant claimed remained extant from his 2010 complaint, by way of overview, the Judge considered that the first, third and fourth issues as raised in the appellant’s 12 May 2020 email related to the legality or legitimacy of CAI’s regulations, measures, and marking schemes, rather than data protections issues and, so were outside of the DPC’s statutory remit (para. 26). He was of the view that the second issue comprised a complaint about the adequacy of CAI’s response to the initial subject matter request which request, in the opinion of the Judge, had to be viewed “in the context of what has occurred in the decade since that initial request”. I will return to the Judge’s observation in this regard when discussing the appellant’s complaint that the investigation undertaken by the DPC was a “mere assessment”. The Judge noted that the fifth issue dealt with a further separate matter, which was whether the appellant was entitled to the originals of the documentation furnished to him.

44. After reprising the salient aspects of the DPC’s decision of 21 April 2022 (already set out above), and the decision reached by the Circuit Court, the Judge, at paras. 52-68 went on to address the points of law asserted by the appellant in his notice of appeal to the High Court.

45. Insofar as point 1 – the provision of data outside the statutory timeframe – was concerned, the Judge found that this did not form any part of the appellant’s reformulated complaints or the DPC’s decision of 21 April 2022. Whilst he noted that the appellant had referred to this point in his written submissions to the Circuit Court, “[i]t was not identified as a ground of appeal”. In those circumstances, the Judge considered that where it was never a part of the reformulated complaint or the decision in the first instance, point

1 could not have formed part of the appeal to the Circuit Court and “cannot now be part of this appeal”. In any event, the Judge went on to note the point made by counsel for the DPC that as a matter of fact, the access request made on 12 May 2010 had been replied to within less than one month of that date by CAI on 1 June 2010, which was within the 40- day timeframe set out in s. 4 of the 1988 Act.

46. The Judge next considered point 4 of the notice of appeal, viz, whether a “mere assessment” of a letter of complaint and supporting documentation by the DPC amounted to an investigation of the appellant’s complaint pursuant to s. 10 of the Data Protection Acts.

47. The case the appellant advanced in the High Court on this ground was that the DPC did not carry out any investigation, which he said represented a serious error of law in circumstances, it was submitted, where the Supreme Court had directed that his 2010 complaint be investigated afresh. Whilst there had been an “assessment” of his complaint by the DPC, there was no investigation or inspection. The appellant based his claim that there was no investigation in accordance with s. 10 of the 1988 Act by referring to the lack of recorded action by the DPC which would show any steps taken to deal with his complaint. Much of his complaint before the DPC, he said, related to his efforts to obtain information from CAI about his examination marks and documentation in relation to this, including original documentation, as he believed such documentation to be inaccurate. The appellant’s case in the High Court was that the DPC had dismissed his arguments and had based her decision in reliance on the decision of Haughton J. in Nowak v. The Data Protection Commissioner, a decision which the appellant contended related to different circumstances.

48. As the Judge noted, the appellant was of the belief that the original documents were not accurate and that, in order to assess their accuracy, the DPC required access to this documentation. The appellant further contended that the arguments he had made before the Circuit Court had not been addressed in the judgment of the Circuit Court.

49. The Judge (at para. 56) found that the complaint that there was an inadequate investigation was not borne out by the facts of the case, and that the appellant’s engagement with the DPC was reflected in the decision letter of 21 April 2022. He also found the complaint of the absence of a formal notice of the investigation by the DPC and the alleged failure of the DPC to communicate with CAI to be without merit “having regard to the extensive engagement with the CAI and its legal advisors” and that the appellant’s argument “discounts the fact that this was a re-stated complaint arising from an initial 2010 complaint.” Accordingly, the Judge was satisfied that the assertion that there was an inadequate investigation “does not constitute a point of law pursuant to section 26(3)(b) …which constitutes an error, error of law or error of fact” which merited his overturning the decision of the Circuit Court.

50. The Judge was also satisfied that the exercise by the DPC of her discretion “was entirely in accordance with her statutory mandate”, noting that in terms of the enforcement of data protection, s. 10(1)(a) of the 1988 Act provides that the Commissioner may investigate, or cause to be investigated, whether any of the provisions of the 1988 Act had been, are being or are likely to be contravened. He noted the provisions of s. 10(1)(b)(i) and (ii) of the 1988 Act which provides that the Commissioner’s discretion is informed in the circumstances where a complaint is made to the Commissioner under s.10(1)(a) he/she is required to (“shall”), inter alia, investigate the complaint. Whilst the appellant had referred to certain provisions of the Data Protection Act 2018 (“the 2018 Act”) (which were not applicable to this case), the Judge considered that “it is for the DPC, in the exercise of his or her statutory discretion (whether unamended or as it applies today) to determine the extent and scope of the investigation that it considers appropriate in any given case”.

51. The Judge next considered points 2, 3 and 5 of the appellant’s notice of appeal all of which, in the view of the Judge, raised questions in relation to the DPC’s jurisdiction to rule on the legal status of CAI’s regulations and/or the legality of CAI’s internal rules or measures. He noted that these three points appeared to relate to the first of the five issues set out in the appellant’s email of 12 May 2020. He was of the view that the attempt by the appellant to raise the legality or legitimacy of CAI’s own measures, which the DPC had reiterated were outside of her statutory remit, would involve the DPC “potentially acting ultra vires”, something which had been pointed out by the DPC to the appellant and which the appellant had indeed previously acknowledged.

52. At para. 64, he said that, after an interval of a decade, the appellant had sought in 2020 to incorporate new elements into a 2010 complaint and that the DPC was entitled to come to the view there was no evidence to suggest that CAI had failed to comply with the subject access request or that there was any outstanding documentation which remained to be given to the appellant. In those circumstances, he found no basis for overturning the

decision of the Circuit Court in its consideration of those matters. Furthermore, assessing the decision of the Circuit Court “through the prism of Attorney General v. Davis and Deely v. Information Commissioner”, the Judge also had regard to the fact that the appellant had been offered the facility to inspect the documentation but had not availed of that facility.

53. Insofar as the appellant was seeking his original examination scripts, relying on the

decision of the CJEU in joined cases, C- 141/12, Y.S. v. Minister Voor Immigratie, Integratie en Asiel and C-372/12, Minister Voor Immigratie, Integratie en Asiel v M and S (ECLI: EU: C: 2014: 2081), [2015] 1 W.L.R. 609 and the decision of this Court in Nowak v. Data Protection Commission [2020] IECA 174 the Judge found that the appellant had no right to personal data in its original form.

54. Hence, for the reasons he set out in the judgment, by order dated 8 October 2024 (as perfected on 1 November 2024) the Judge dismissed the appellant’s appeal against the judgment and order of the Circuit Court dated 9 October 2023.

The Appeal

55. The appellant’s notice of appeal to this Court advances six grounds which are, in summary, that the Judge:

• Erred in fact in holding that the appellant was employed by CAI (ground 3.1).

• Failed to determine whether examination scripts could be regarded as personal data “in light of the unapproved Examination Regulations pursuant to Section

6 of the Institute of Chartered Accountants in Ireland (Charter Amendment) Act 1966” (ground 3.2).

• Erred in fact in holding that there was a reformulation of the 2010 complaint and that “the provision of data outside the statutory time-frame never formed part of the reformulated complaint and cannot now be part of this appeal” (ground 3.3).

• Erred in law in holding that the appellant failed to identify serious and significant errors (ground 3.4).

• Erred in law in holding that the appellant had sought to incorporate new elements into a 2010 complaint and in finding that there was no basis for overturning the decision of the Circuit Court (ground 3.5).

• Erred in law in failing to determine whether a data subject is entitled to access the originals of his or her personal data in circumstances where there are suspicions of data erasure, unauthorised amendment or unlawful interference with such data (ground 3.6).

Discussion and Decision

56. From the notice of appeal and the parties’ submissions (written and oral), I consider that the following issues arise for consideration. Each of those issues (as identified hereunder) will be addressed in turn. (i)– The alleged error in holding that the appellant was employed by CAI

57. There is no dispute between the parties in respect of this ground. It is acknowledged by the DPC that the Judge erred in fact when he described the appellant as having been employed by CAI in circumstances where the appellant was simply undergoing a course of study facilitated by CAI and was not an employee. The DPC submits that the error is not material to the issues that fell to be decided by the Judge. I agree. As the DPC says, this was simply an error by the Judge in setting out the background to the proceedings. It had no bearing on the issues that fell to be considered by the Judge. More, particularly, as again the DPC points out, this ground of appeal discloses no error in the decision of 21 April 2022 or in the decision of the Circuit Court which upheld the DPC’s decision. I also agree with the submission that the appellant could have sought to have this error corrected by making the appropriate application before the Judge prior to the perfecting of the High Court order. Moreover, this matter was not pursued by the appellant in his written or oral submissions to the Court.

(ii) Alleged breach of s. 4(7) of the 1988 Act

58. Section 4(7) of the 1988 Act provides: -

“A notification of a refusal of a request made by an individual under and in compliance with the preceding provisions of this section shall be in writing and shall include a statement of the reasons for the refusal and an indication that the individual may complain to the commissioner about the refusal.”

59. In his oral submissions to this Court, the appellant asserted that the Judge erred in failing to address and find that CAI breached the 1988 Act by failing to provide him with the reasons for its determination that his examination scripts did not constitute personal data and by reason of its failure to advise him that he could complain to the DPC about this issue, as provided for by s. 4(7) of the 1988 Act.

60. This issue was not addressed by the appellant in his notice of appeal to the High Court. The appellant, however, maintains that this issue was covered by ground 6 of his notice of appeal and that, in the course of the hearing in the court below, he made oral submissions in respect of same but that the issue was not determined by the Judge. The appellant asserts that ground 3.5 of his notice of appeal to this Court encompasses his complaint against the Judge in this regard.

61. The DPC says that the s. 4(7) issue was not raised by the appellant before the DPC or before the Circuit Court or the High Court and was only first articulated at the hearing of the within appeal. It submits that the appellant could have raised this issue in May 2020 when he was asked by the DPC to identify issues he claimed remained extant from his 2010 complaint but did not do so.

62. I am satisfied that the appellant cannot pursue this ground of appeal at this remove in circumstances where demonstrably the s. 4(7) issue never featured before the DPC, or in the appeal to the Circuit Court. Insofar as he contends that ground 6 of his notice of appeal to the High Court brought the matter to the attention of the Judge, it will be recalled that ground 6 merely asserts: “Further or other point of law advanced at the hearing of the appeal”. This is not a valid ground of appeal. The purpose of a notice of appeal is to identify the grounds on which the decision under appeal is challenged. It is not permissible to seek to introduce at the hearing of an appeal grounds or issues of which the respondent has had no prior notice. Even if ground 6 could be said to encompass the appellant’s grievance regarding s. 4(7) (which it does not), it remains the case that since the s. 4(7) issue did not feature before the DPC or the Circuit Court, the Judge could not be expected to embark on a consideration of something which never featured before the Circuit Court or the first instance decision maker.

63. I would also add, merely by way of comment, and not seeking to detract from the legal requirements imposed on a data controller by s. 4(7), that even if the matter had been brought to the attention of the DPC it would undoubtedly have observed that CAI’s letter of 1 June 2010 did in fact set out the reason (even if that reason was subsequently found to not be correct in law) why the examination scripts were not being furnished. It might also have adverted to the fact that, even if for the sake of argument, CAI had breached the provisions of s. 4(7), the appellant had nevertheless availed of his legal entitlement under s. 10(1)(a) to complain to the DPC about CAI’s refusal to provide his examination scripts.

(iii) The alleged failure by the CAI to comply with the timeframe provided for in s. 4(1)

of the 1988 Act

64. Section 4(1)(a) of the 1988 Act provides, in relevant part: - “(a) Subject to the provisions of this Act, an individual shall, if he or she so requests a data controller by notice in writing—

(i) be informed by the data controller whether the data processed by or on behalf of the data controller include personal data relating to the individual,

(ii) if it does, be supplied by the data controller with a description of— (I) the categories of data being processed by or on behalf of the data controller, (II) the personal data constituting the data of which that individual is the data subject, (III) the purpose or purposes of the processing, and (IV) the recipients or categories of recipients to whom the data are or may be disclosed,

(iii) have communicated to him or her in intelligible form—

(I) the information constituting any personal data of which that individual is the data subject, and (II) any information known or available to the data controller as to the source of those data unless the communication of that information is contrary to the public interest, and

(iv) where the processing by automatic means of the data of which the individual is the data subject has constituted or is likely to constitute the sole basis for any

decision significantly affecting him or her, be informed free of charge by the data controller of the logic involved in the processing, as soon as may be and in any event not more than 40 days after compliance by the individual with the provisions of this section and, where any of the information is expressed in terms that are not intelligible to the average person without explanation, the information shall be accompanied by an explanation of those terms.”

65. At ground 3.3 of his notice of appeal to this Court, the appellant asserts, inter alia, that the Judge erred in holding that the provision of data outside the statutory timeframe provided for in the 1988 Act never formed part of the reformulated complaint and could not therefore be part of the appeal to the High Court.

66. This ground of appeal encompasses point 1 of the appellant’s appeal to the High Court on a point of law. It was addressed by the Judge at paras. 52 – 53 of the judgment. As we have seen, whilst the Judge acknowledged that there was reference to the issue in the appellant’s written submissions to the Circuit Court, he found that the issue did not form any part of the appellant’s reformulated complaints in May 2020, or any part of the DPC’s decision of 21 April 2022 or his appeal to the Circuit Court. Accordingly, in the view of the Judge, it could not properly be the subject of an appeal to the Circuit Court or constitute an appeal to the High Court on a point of law. In essence, the Judge considered that the point had not been identified as a ground of appeal.

67. The Judge was correct to find as he did. In circumstances where the alleged failure of CAI to respond to the appellant’s data request within forty days was not raised by the appellant in his email of 5 May 2020 and, consequently, never formed part of the DPC’s

decision or the appeal to the Circuit Court, I cannot see how the Judge erred in addressing the issue as he did at para. 52 of the judgment. Moreover, as the DPC points out, the appellant was very clearly asked on 7 May 2020 to identify the outstanding issues from his 2010 complaint, which he did without identifying any complaint concerning noncompliance with s. 4(1) of the 1988 Act. I agree with the DPC that it is not permissible for the appellant to introduce new grounds of appeal within the narrow confines of an appeal on a point of law: the DPC’s decision of 21 April 2022 having addressed the five complaints the appellant actually identified and the Circuit Court in turn having considered the appellant’s appeal against the DPC’s findings in respect of those five issues.

68. In any event, as we see from para. 53 of the judgment, the Judge went on to reprise the DPC’s submission that the appellant’s data request of 12 May 2010 was in fact replied to by CAI on 1 June 2010, which was within less than a month of the request. In other words, CAI responded to the subject access request within the 40-day time limit.

69. Whilst the appellant’s grievance relates to the furnishing by CAI of his examination scripts only in 2018, some seventeen documents were furnished to the appellant on 1 June 2010, well within the statutory timeframe. As is well rehearsed by now, in June 2010 CAI was of the view, based on legal advice, that the examination scripts did not constitute the appellant’s personal data, and that view was the subject of ongoing litigation. That issue was resolved by the CJEU’s ruling in 2017 consequent upon which the Supreme Court remitted the complaint to the DPC in March 2018. It is common case that CAI provided the appellant with copies of his examination scripts on 18 June 2018.

70. In my view, the circumstances in which the appellant only received his examination scripts in June 2018 do not undermine the fact that he received a response from CAI to his subject access request on 1 June 2010, which was well within the 40-day timeframe provided for in the 2018 Act. In any event, as the DPC and the Judge point out, had he wished to raise any issue in respect of compliance with the statutory timeframe as part of his 2010 complaint, he was afforded the opportunity to do so on 7 May 2020, but in his response to that request he did not raise any issue regarding compliance with the statutory timeframe.

(iv) The alleged error on the part of the High Court in failing to find that the DPC failed to investigate the appellant’s complaint and in holding that there was a reformulation in 2020 of the appellant’s 2010 complaint.

71. Paragraph 3.3 of the notice of appeal to this Court asserts that the Judge erred in fact in holding, effectively, that by the contents of his 12 May 2020 email the appellant had reformulated his original 2010 complaint. Notably, the claim that the DPC failed to investigate the appellant’s complaint is not specifically addressed in para. 3.3 or indeed elsewhere in the notice of appeal. The issue is, however, specifically addressed in his written and oral submissions to this Court and, to some extent, also incorporated in paras.

3.4 and 3.5 of his notice of appeal, as indeed the DPC acknowledged in its written and submissions to the Court.

72. It is fair to say that the argument that the Judge wrongly held that the 2010 complaint had been reformulated, and that he erred in failing to find that the DPC failed to investigate his complaint, constitute the nub of the appellant’s appeal to this Court.

73. In aid of his argument that the DPC had failed to investigate his complaint, the appellant points to the way the matter was dealt with following the Supreme Court’s remittal of the complaint to the DPC. He cites the fact that after the matter was remitted by the Supreme Court, no official letter was sent to him by the Office of the DPC advising that an investigation was being commenced. He says that in 2020, some two years after the Supreme Court order, he was asked by the solicitors for the DPC what he thought should be investigated, an approach, he contends, which was contrary to the provisions of the 1988 Act. Whilst he had responded as he had on 12 May 2020 to the request made by the DPC’s solicitors to set out what remained outstanding from his 2010 complaint, he submits that contrary to the views expressed by the DPC and the Judge, in responding as he did, he had not reformulated his 2010 complaint. He says that the fact that he had responded to the DPC’s request did not relieve the Commissioner of her obligation to investigate his 2010 complaint.

74. The appellant maintains that the DPC was obliged to investigate his 2010 complaint ab initio and that he had only set out the five items that appear in his 12 May 2020 email in response to the DPC’s request that he do so.

75. He asserts that the High Court’s (and the Circuit Court’s) findings that his complaint was investigated by the DPC were arrived at in circumstances where in fact no investigation pursuant to s. 10(1) of the 1988 Act took place between 2020 and 2022. He points to the lack of any extensive engagement by the DPC with CAI during this period. As the appellant puts it in his written submissions “none was requested and none was received by the Commission in order to independently establish facts in order to apply law later on”. The appellant’s contention is that “[t]he Commissioner’s investigation must be based on principles of fundamental and procedural fairness. This condition was not met”.

76. In essence, the appellant asserts that what the DPC did in the period 2020-2022 was not the investigation prescribed by the 2010 Act, and that what the DPC in fact engaged in was a “mere assessment” of his complaint.

77. Whilst he acknowledges that reference is made by the DPC in her decision of 21 April 2022 to correspondence which passed between CAI and the appellant on 18 June 2018 and 1 July 2018 in which the appellant was furnished by CAI with copies of his examination scripts and afforded the opportunity to inspect the originals of same, the appellant contends that he does not know how the DPC obtained access to this correspondence. Although not part of his pleadings or addressed in his written submissions to the Circuit Court, the High Court or this Court, the appellant contends that the fact that such correspondence found its way to the DPC suggests bias on the part of the DPC.

78. It is far too late in the day for the appellant to allege bias on the part of the DPC, particularly in the absence of a shred of evidence to sustain such a serious allegation.

79. It is the case that that, after the Supreme Court remitted the complaint, the DPC did not issue a formal notice of the investigation to either the appellant or CAI. Counsel for the DPC submits that nothing turns on this and points to the fact that s. 10 of the 1988 Act says nothing about the nature or form of the investigation that is to be conducted by the DPC. Insofar as the appellant relies on the 2018 Act as to the steps the DPC should have undertaken, the DPC’s position is that the 2018 Act was not applicable to the complaint, as indeed the appellant himself acknowledged.

80. In any event, the DPC maintains that it did open an investigation after the Supreme Court remittal of the complaint. It says this is evidenced by the contents of an email sent to the appellant on 7 May 2020 by the solicitor for the DPC. The said email reads, in relevant part: - “You’ll recall that after the Court of Justice and Supreme Court rulings in 2017, 2018, the DPC opened an investigation, as directed by the Supreme Court. During that investigation, [CAI] agreed to give you copies of your exam scripts (and related materials). The DPC understands that [the CAI’s] confirmation that they would release the script etc to you had the effect of dealing with the substance of the complaint, so that there was nothing else left for the DPC to make a decision on. (Obviously there was still an issue between us as to whether or not you were entitled to the original script etc. but that’s a different point).”

81. Counsel for the DPC says that the investigation resolved quickly in circumstances where by June 2018 CAI had complied with the appellant’s request, provided him with copies of his examination scripts and offered him the opportunity to inspect the originals. Counsel submits that the DPC’s approach must also be viewed in the context where the balance of the appellant’s personal data had long before been furnished to him on 1 June 2010.

82. It is in those circumstances, together with the view adopted by the DPC as to the nature of the issues raised by the appellant on 12 May 2020, that the DPC contends that it was not necessary for it to correspond further with CAI in relation to the appellant’s complaint. It points to the fact that all of the matters raised by the appellant in his 12 May 2020 email were duly addressed in the 21 April 2022 decision. Accordingly, the DPC denies any breach of fair procedures on her part.

83. I consider that whilst it might have been better if some formal communication had been sent by the DPC to the appellant in 2018 after the 2010 complaint was remitted by the Supreme Court, the fact of the matter is that very shortly thereafter, CAI engaged in correspondence with the appellant. As we see, under cover of letter dated 18 June 2018, CAI’s solicitors agreed to furnish (and did in fact furnish) him with copies of his examination scripts. On 11 July 2018, it offered to facilitate an inspection of the original scripts. It bears repeating that this was done against a backdrop whereby in response to his May 2010 subject access request, the appellant had been furnished with copies of some seventeen documents on 1 June 2010 which were said by CAI at the time to constitute his personal data. As we know, in June 2010, CAI were of the view that the appellant’s examination scrips did not constitute his personal data.

84. That position of course changed after the CJEU’s ruling. However, prior to the CJEU’s ruling, the fact of the matter is that (insofar as the procurement by the appellant of his of personal data is concerned) the only issue outstanding from 2010 were the appellant’s examination scripts, which had to await the outcome of the appellate process in which the appellant engaged after the Circuit Court upheld the DPC’s decision to decline to investigate the 2010 complaint, part of which process included the reference made by the Supreme Court to the CJEU. There is nothing to suggest, in that timeframe, that the appellant was maintaining that there was other data with which he should have been furnished. To my mind, therefore, once the appellant was in fact furnished with copies of his examination scripts in June 2018, and in circumstances where CAI had furnished him with some seventeen documents on 1 June 2010, it is not unsurprising that there was little procedural engagement by the DPC with the appellant in the period June 2018 to May 2020.

85. As already referred to, it is the case that on 5 May 2020, in the course of a hearing before this Court in relation to the appellant’s appeal in relation to his 2014 complaint, it was brought to the attention of the DPC that the appellant considered that a number of matters remained outstanding arising from his 2010 complaint. Pursuant to a request made by the solicitor for the DPC on 7 May 2020, these matters were duly set out in the appellant’s 12 May 2020 email and duly addressed in the decision of 21 April 2022.

86. I turn now to the question whether, as the appellant contends, the High Court should have found procedural and/or substantive frailties in that decision, such as would warrant the setting aside by this Court of the respective orders of the High Court and the Circuit Court, bearing in mind that the appellant’s right of appeal to the High Court was solely an appeal on a point of law from the decision of the Circuit Court.

87. The decision of 21 April 2022 addressed the five issues raised by the appellant in his

12 May 2022 email. The first issue concerned the legality of the measures taken by CAI as regards the examinations undertaken by the appellant. What appears to have been behind this was a suggestion that the 2009 examinations had been conducted under bye-laws - or purported bye-laws - which had not been submitted to and allowed by the Government, as required by s. 6 of the 1966 Act. As found by the DPC, this fell outside its remit. In those circumstances, the DPC did not require CAI to be consulted on this issue.

88. The Judge identified points 2, 3 and 5 of the appellant’s notice of appeal as questioning the legality of CAI’s internal rules and regulations. These points essentially reprised the first of the five issues set out in the appellant’s 12 May 2020 email. As the Judge held, the appellant’s attempt to raise the legality or legitimacy of CAI’s own measures would involve the DPC potentially acting ultra vires. Moreover, as the Judge (and the DPC) observed, this first issue comprised a new point which had not been raised by the appellant in his 2010 complaint which, of itself, would justify the rejection of this complaint. In any event, the DPC went on to consider the substance of the complaint but found it to be outside of its remit.

89. I am satisfied that the Judge was entirely correct to uphold the DPC’s decision that it had no authority or jurisdiction to make any findings in relation to any alleged failure on the part of CAI to comply with its obligations under the 1966 Act. None of the arguments the appellant makes at paras. 14-21 or 33-35 of his written submissions persuade me otherwise.

90. This also holds true for the third issue raised by the appellant in his May 2020 email, and I am satisfied the Judge (and the DPC) were again correct to find that issues sought to be canvassed in relation to the legitimacy of CAI’s marking scheme and the reports of the examiner and moderator did not fall within the DPC’s statutory remit.

91. In determining the above issues, both the DPC and the High Court had the benefit of the decision of this Court in Nowak v. the Data Protection Commissioner [2020] IECA 174 where Haughton J. expressed the view, at para. 48, that questions as to the lawfulness of the regulations pursuant to which CAI conducted the relevant examinations “would seem to have no relevance to an appeal under section 26 of the Data Protection Acts 1988- 2003”. I concur with that view. Had the appellant wished to challenge CAI’s conduct and oversight of the relevant examination process, his remedy lay elsewhere.

92. It will be recalled that via the second issue raised in his 12 May 2020 email, the appellant contended that CAI failed to comply with his 2010 request in relation to three sub-categories of documents each of which, the appellant contended, contained personal data relating to him. In considering this issue, in its decision letter of 21 April 2022 the DPC noted that CAI’s letter of 1 June 2010 (which enclosed copies of seventeen documents) included a copy letter dated 4 March 2010 “confirming the outcome of [the appellant’s] appeal” and a “copy report submitted by Examiner & Moderator on remark of [the appellant’s] Autumn script”. The DPC also noted that, separately, under cover of the letter of 18 June 2018 from CAI’s solicitors, the appellant was provided with a “Copy of both reports on appeals re. Marking of the autumn Script 330316”. (That letter also enclosed the marking plan for script 330676 -the summer examinationand the marking plan for script 330316-the autumn script).

93. The decision letter of 21 April 2022 went on to state that it was the Commissioner’s understanding that the documents released to the appellant on 1 June 2010 and 18 June 2018 comprised the full extent of the appellant’s personal data arising from the appeal panel’s consideration of his appeal. It was also said that the Commissioner was not in receipt of any information which on an objective and fair assessment could be said to support the contention that the appellant had identified other personal data that should have been released to him. In essence, the DPC’s position was that it was not for it to interrogate on how the examination appeal panel considered the appellant’s appeal, or to seek to look behind documents which on their face indicated his appeal had been considered. Nor, it was said, was it the Commissioner’s role to assess whether CAI had complied with its own internal rules in connection with the conduct of appeals.

94. It will be recalled that the DPC also observed, without prejudice to the views it expressed as to its remit, that it was not at all clear that the marking scheme (which was applicable to all candidates) could sensibly be said to contain personal data.

95. In this appeal, the DPC’s position is that the appellant has not, either before the High Court or this Court, pointed to any outstanding personal data being held by CAI which he has not received. As Ms. Skehan avers at para. 33 of her replying affidavit: - “In the Grounding Affidavit, the Appellant has failed to identify any factual basis in support of his contention that the CAI did not comply with the subject access request in respect of these specific sub-categories of documents”.

96. Counsel for the DPC also points to the fact that in a further affidavit sworn by the appellant on 11 January 2023, all the appellant says in relation to the second issue raised in his 12 May 2020 email is that “the evidence was provided to the Commissioner and that ‘it required however little logical thinking and analysis of documents provided under the letter of complaint. The officer of the Commission failed to do so”.

97. In the absence of the appellant pointing to some concrete evidence or information having been before the DPC which suggested that CAI was withholding other documents that contained the appellant’s personal data, I concur with the DPC’s argument that his averments in this regard are unclear and non-specific. Absent any clarity from the appellant, it is not apparent that there are outstanding documents being held by CAI.

98. That this is the position is, in my view, supported by the fact that from 1 June 2010 (when the appellant was first furnished with documentation by CAI), the sole issue of contention (as far as obtaining his personal data is concerned) was that his examination scripts had not been provided. As I have already observed, once copies of those documents were ultimately provided in June 2018, the appellant did not thereafter point to anything from which it could reasonably and objectively be deduced that CAI was still in possession of personal data pertaining to the appellant that had not been handed over.

99. In all of those circumstances, the Judge correctly determined that the DPC was entitled to come to the view that there was no evidence to suggest that there was outstanding documentation and that there was no basis to overturn the Circuit Court’s consideration of those matters. For all the reasons set out above, I am satisfied that the investigation conducted by the DPC was entirely adequate and well within the discretion afforded her under the Data Protection Acts as to the scope or extent of any particular examination required to be conducted by the DPC pursuant to s. 10(1) of the 1988 Act.

100. As we see from the notice of appeal and the appellant’s submissions, one of the matters with which he took issue was that the Judge had wrongly characterised his complaint as “reformulated”, and he submits that the Judge erred in law in this regard. For the avoidance of doubt, I find no such error on the part of the Judge. In truth, the appellant’s complaint was in fact reformulated by the inclusion of the first issue set out in his 12 May 2020 email which had not been canvassed in his original complaint. Furthermore, in my view, whatever matters the appellant wished to articulate in 2020, they were being articulated against a landscape which had changed substantially since he made his original complaint in May 2010. By June 2018, he was in receipt of copies of his examination scripts. Hence, whatever way one looks at it, his original complaint that he was entitled to his examination scripts was satisfied (whatever about the other issues such as access to the originals of the scripts he was complaining about) such that that factor, of itself, meant that the matters which the DPC addressed in its 21 April 2022 decision could never be the same complaint as that first presented in May 2010.

(v) The request for the originals of the appellant’s personal data

101. The fifth issue raised by the appellant in his 12 May 2020 email was whether CAI was correct to refuse him “access to the originals” of his personal data, to include the marking schemes. There was some confusion -on both sidesas to what this was all about. The objective fact of the matter is that the appellant was offered the opportunity to inspect his original examination scripts. That being so, the appellant’s argument could only be understood as being -as it was understood by the DPC to bethat he was entitled to be given the original scripts. The position advanced by the DPC in the court below in respect of this issue was that in Nowak v. the Data Protection Commissioner [2020] IECA 174 this Court had concluded that the appellant was not entitled to access the original of any examination scripts or related documentation containing his personal data. Having considered the case law of the CJEU on this issue, and the judgment of Haughton J. in Nowak v. Data Protection Commission [2020] IECA 174, the Judge came to the same

conclusion.

102. In his written submissions, the appellant asserts as follows: - “In light of the allegations of unlawful amendments to documents and the quality of copies provided in response to the [data access request], a data subject has a right to obtain access to the originals. If access to the originals is denied, then it is a matter for the Commissioner to decide whether such access is warranted following a proper investigation. As submitted above, there was no proper investigation undertaken.” He submits that the Data Protection Acts do not disallow access to the originals and that “it is logical when suspicions of irregularities on face of the copies provided in response to the data access request a data subject must have a right of access to the originals to check the copies against the originals especially in circumstances where the Act does not require a data controller or data process to provide certified copies of personal data.”

103. Leaving aside the absence of any basis for any suspicion of irregularity, the fact is that the appellant was afforded the opportunity to check the copies against the originals but had not availed of that opportunity.

104. Refuting any entitlement on the part of the appellant to access original documentation, the DPC points to the provisions of s. 4 of the 1988 Act which provides only that an individual is entitled to:

“Have communicated to him or her in intelligible form-

(i) The information constituting any personal data of which that individual is the data subject, and

(ii) Any information known or available to the Data Controller as to the source of those data unless the communication of that information is contrary to the public interest …”

105. The DPC also submits that there is no automatic right to specific documents, a position which has been confirmed by the CJEU, and by this Court in Nowak v. The Data Protection Commissioner [2020] IECA 174.

106. As is clear from Haughton J.’s judgment in the latter case, the appellant had argued in his written submissions in that case that “… access to the original of personal data would be specifically desirable if there are suspicions of manipulation, re-engineering of copies provided or fraud”. In his oral submissions in that case, he had argued that when a copy document is “doctored” then access to the original was desirable and that unless the data subject had access to the original, he/she could not “check to see whether the data is accurate”. The concerns communicated by the appellant included his belief that the copy he had received was not “accurate” and that he “wanted the originals because of the risk of manipulation … [they] can be doctored”. The appellant asserted “the right of the data subject to check for accuracy”.

107. However, Haughton J. was “satisfied that the appellant cannot pursue the ‘doctoring’ argument as it is based on hypothetical facts. The DPC and the Circuit Court on appeal, can only determine the complaint on the facts presented to them. The High Court on appeal, and now this Court on further appeal, under s. 26 can only determine a point of law. It must take the facts presented on affidavit and as found by the Circuit Court and determine the point of law raised on those facts.” He found that no evidence had been put before the DPC or the Circuit Court to ground a complaint of “manipulation”, “reengineering” or “doctoring”.

108. In Nowak v. The Data Protection Commissioner [2020] IECA 174, the appellant had also relied on the last sentence of para. 58 of the judgment of the CJEU in Y.S. to support his contention that he had an entitlement to “the original file”. In this regard it is instructive to quote (as indeed Haughton J. did) paras. 57 -58 of the judgment in Y.S.: “57. Although Directive 95/46 requires Member States to ensure that every data subject can obtain from the controller of personal data communication of all such data processed by the controller relating to the data subject, it leaves to the Member States to determine the actual material form that that communication must take, as long as it is ‘intelligible,’ in other words it allows the data subject to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that that person may, where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the directive (see to that effect, the judgment in Rijkeboer, (EU: C: 2009: 293, paragraphs 51 and 52).

58. Therefore, insofar as the objective pursued by the right of access may be fully satisfied by another form of communication, the data subject cannot derive from either Article 12(a) of Directive 95/46 or Article 8(2) of the Charter the right to obtain a copy of the document or the original file in which those data appear. In order to avoid giving the data subject access to information other than the personal data relating to him, he may obtain a copy of the document or the original file in which that other information has been redacted”.

109. Having regard to what was set out by the CJEU in Y.S., Haughton J. was of the view that the sentence relied on by the appellant required to be read “in the context of the earlier sentence where the CJEU was clearly stating that neither Article 12 of the Directive nor Article 8(2) of the Charter could support either the right to obtain a copy of the document, or the original file; it must also be read in the context of redaction from the original file of information other than personal data relating to the data subject. Moreover in Y.S. the CJEU was not called upon to consider or decide a claim for access to the original document containing personal data”.

110. In Nowak v. The Data Protection Commissioner [2020] IECA 174, the DPC relied on the judgment of the CJEU in Y.S. for the proposition that the data subject was only entitled under the Directive to a full summary of the data in an intelligible form sufficient to enable the data subject to exercise their rights under the Directive. In Y.S. the CJEU had been asked whether Article 12(2) could be interpreted to mean that there was a right to a copy of documents in which personal data had been processed. The CJEU answered that question in the following terms at para. 60 of its judgment, stating: “… Article 12(a) of Directive 95/46 and Article 8(2) of the Charter must be interpreted as meaning that an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities within the meaning of Article 2(b) of that directive. For that right to be complied with, it is sufficient for the applicant to be provided with a full summary of those data in an intelligible form, that is, a form which allows him to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by that directive.”

111. Having regard to the approach of the CJEU, Haughton J. was satisfied that “[f]ar from assisting the appellant, in my view the trial judge quite properly relied on the

decision in Y.S. which clearly supports the argument of the DPC that under the Directive the data subject’s entitlement is to access to the relevant information/personal data in an ‘intelligible form’, and does not support a right under the Directive to personal data in its original form”.

112. The DPC had also relied on the decision of the Court of Appeal of England and Wales in joint appeals Ittihadieh v 5-11 Cheyne Gardens RTM Company Limited/Deer v. University of Oxford [2017] EWCA CIV 121, where the Court was considering s. 7(1)(c) of the United Kingdom Data Protection Act, 1988, which is a counterpart of s. 4(1)(iii) of the 1988 Act. Having cited the decision of the CJEU in Y.S., Lewison L.J. went on to state, at para. 93: “93. The obligation under section 7(1)(c) includes an obligation to communicate in intelligible form the information constituting any personal data of which the individual is the data subject. This goes further than section 7(1)(b) which requires a description of the personal data. It is an obligation to supply the information itself. Even so, it is not an obligation to supply documents: Dunn v Durham County Council [2013] 1 WLR 2305, para 16. It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so. It is very easy, however, to slip from dealing with personal data into dealing with electronically generated or stored documents in which personal data are recorded. It seems from many of the reported cases (as well as these two appeals) that individuals who make SARs [Subject Access Requests] are, in truth, looking for copy documents. They are in my judgment aiming at the wrong target. This ties in with the definition of personal data. Accepting as I do that a person’s name is his personal data, it does not follow that every piece of information in a document in which his name appears is his personal information. In such a case it would, in my judgment, be enough for the data controller to inform the data subject that, for instance, his name is consistently recorded as ‘Charles Pooter’ and his address as “The Laurels, Brickfield Terrace, Holloway” in a specified number of documents between particular dates. There would be no obligation to disclose the documents themselves. This is, I think, borne out by article 12 of the Directive which requires the data controller to inform the data subject of the categories of data concerned”.

113. Haughton J. was satisfied that the trial judge had correctly cited the judgment in Ittihadieh/Deer “as a persuasive authority supportive of the purposive approach adopted in Y.S. and the notion that the Directive is concerned with access to personal data/information and not with targeting documents per se”. (para. 62)

114. It will be recalled that the fourth issue raised by the appellant in his May 2020 email, viz, “whether the CAI implemented all necessary and required by law security measures preventing unauthorised amendments to examination marks data”, was also held by the DPC (and the Judge) to fall outside the DPC’s statutory remit. I agree that that is so.

115. At para. 39 of the judgment, the Judge noted that by raising this issue the appellant was seeking to question “again hypothetically” the legitimacy of the examination documentation, as he had done in his separate complaint and in respect of which, in Nowak v. Data Protection Commission [2020] IECA 174, Haughton J. accepted that it was not for the DPC to engage with or seek to determine entirely speculative allegations based on hypothetical facts in circumstances where no evidence of “doctoring” had been put forward by the appellant.

116. In this appeal, the appellant seeks to revive the arguments he canvassed in Nowak v. The Data Protection Commissioner [2020] IECA 174 regarding the alleged manipulation or “doctoring” of his examination scripts and related material. At para. 10 of his written submissions, he contends that: - “the following point of law…is essential in the context of the within appeal.

a) Whether a data subject is entitled to access the originals of his/her personal data in circumstances where there are suspicions of data erasure, unauthorized amendment or unlawful interference with such data?”

117. Save stating to this Court that he has “suspicions”, the appellant did not, in the course of the appeal hearing, point to any evidence of the alleged “data erasure” “unauthorized amendment” or “unlawful interference”, or provide any reasonable basis upon which it could be concluded that such evidence might be forthcoming. Nor did he do so before the Commissioner even had the legitimacy of the examination process been something the Commissioner could have investigated.

118. Furthermore, as observed by the Judge at para. 40, the Circuit Court in its judgment of 9 October 2023, at para. 11.1, also considered the appellant’s argument as being “at best a subjective analysis of hypothetical facts”, in the absence of any evidence having been put to that court.

119. I also note that in his written submissions, in support of his argument that he should be provided with the originals of his examination scripts and related documents, he cites para. 68 of Nowak v. the Data Protection Commissioner [2020] IECA 174, where Haughton J. opined: “…It is conceivable that in certain circumstances a data controller may have an obligation to produce an original document containing personal data, for example, where it is required for rectification or erasure of data under section 6. Equally it may be that such document falls to be produced as a result of unlawful acts that give an entitlement to discovery or inspection for judicial review, plenary action or other legal proceedings, rather than under the Directive. Doubtless this is a question that will fall to be determined by another court on appropriate facts.”

120. The appellant also refers to the Determination of the Supreme Court [2020] IESCDET 144 which refused him leave to appeal against the judgment of Haughton J., and he quotes paras. 11-13 thereof: - “11. The applicant was furnished with a copy of his script and has been offered the opportunity to inspect the original script, but has not chosen to take up this option and he has not made out any argument that the copy might not be a true copy of the original.

12. In the circumstances, the Court does not consider that the interests of justice justify the grant of leave, or that a matter of general public importance arises.

13. The Court does not rule out the possibility that whether a data subject is entitled to an original document might raise a matter of general legal public importance or one that might justify leave in the interests of justice, such as when issues of data erasure or rectification arise. But the present application must be refused on account of its factual context where no legal basis has been made out that might justify a consideration of that point.”

121. In my view, neither the circumstances envisaged by Haughton J. nor the scenario contemplated by the Supreme Court assist the appellant given that he has not pointed to any factor which might support his contention that his personal data was unlawfully interfered with or otherwise manipulated.

122. Moreover, it bears repeating that in July 2018, the appellant was offered the opportunity to view the originals of his examination scripts. This was at a time when he had copies of those scripts which would have allowed him, at the very least, to test those copies against the originals. In my view, had he done so, he could have satisfied himself as to whether the “suspicions” he held were justified. He did not avail of that opportunity. I was not persuaded by explanation the appellant gave as to why he did not avail of the offer made by CAI. Whilst it may be the case that the offer was confined to the originals of his examination scripts and not the originals of the entirety of the documentation he received from CAI, that does not, to my mind, explain why the appellant did not avail of the offer.

Summary

123. In my view, in this case, based on the facts before the Court, and in the absence of the appellant having established before the DPC that the position was otherwise, everything points to the appellant having been provided with “a faithful and intelligible reproduction” of his personal data, to borrow the phraseology of the CJEU in case C- 487/21, FF v Österreichische Datenschutzbehörde, EU:C: 2023:369. For the reasons set out in this judgment, I would dismiss the appeal and affirm the Order of the High Court.

Costs

124. The appellant has not succeeded in his appeal. It would seem to follow that the DPC should be awarded her costs. If, however, either party wishes to seek some different costs order to that proposed they should so indicate to the Court of Appeal Office within 21 days of the electronic delivery of this judgment, and a short costs hearing will be scheduled, if necessary. If no indication is received within the 21-day period, the order of the Court, including the proposed costs order, will be drawn and perfected.

125. As this judgment is being delivered electronically, Allen J. and Meenan J. have indicated their agreement therewith and the orders I have proposed.