Irish Court of Appeal

harp graphic.

THE COURT OF APPEAL

Neutral Citation Number [2020] IECA 175

Appeal No. 2018/139

High Court Record No. 2014/89CA

Haughton J.

Ní Raifeartaigh J.

Binchy J.

 

IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003

IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26

OF THE DATA PROTECTION ACTS, 1988 & 2003

 

BETWEEN/

 

PETER NOWAK

APPELLANT

 

- AND -

 

THE DATA PROTECTION COMMISSIONER

RESPONDENT

 

-AND-

 

PRICEWATERHOUSE COOPER

            NOTICE PARTY

 

 

THE COURT OF APPEAL

 

Appeal No. 2018/140

High Court Record No. 2014/118CA

 

IN THE MATTER OF THE DATA PROTECTION ACTS, 1988 AND 2003

IN THE MATTER OF AN APPEAL PURSUANT TO SECTION 26

OF THE DATA PROTECTION ACTS, 1988 & 2003

 

BETWEEN/

 

PETER NOWAK

APPELLANT

 

- AND -

 

THE DATA PROTECTION COMMISSIONER

RESPONDENT

 

-AND-

 

THE INSTITUTE OF CHARTERED ACCOUNTANTS IN IRELAND

            NOTICE PARTY

 

JUDGMENT of Mr. Justice Binchy delivered in the first appeal record no. 2018/139 on the   1st day of July 2020

Introduction

1.       This judgment relates to the first of the above entitled appeals.  Judgment in the second of the above entitled appeals is also being delivered today by Haughton J. Both appeals arise out of decisions given by Coffey J. in the High Court in relation to requests made by the appellant of the notice party pursuant to s. 4 of the Data Protection Acts, 1988 and 2003 (the “Data Protection Acts”).  The appeals came on for hearing, by way of remote hearing in each case, on 5th May, 2020.

Background to this appeal

2.       The appellant had been employed as a trainee accountant by the notice party. His employment was terminated by the notice party in 2009, the appellant having failed to pass certain exams. He was subsequently successful in proceedings for unfair dismissal arising out of the termination of his employment, but nothing of consequence turns on those background events for the purposes of these proceedings. The appellant was also successful in proceedings previously brought against the respondent in which he sought access to his exam papers. Those proceedings resulted in a reference to the Court of Justice of the European Union (the “CJEU”), which court determined that his exam papers, including markings and comments by the examiners, constituted personal data for the purpose of EC Directive 95/46/EC on the protection of individuals with regard to processing of personal data (the “Directive”). I mention that now because the decision of the CJEU in that case is an authority relied upon by the respondent in these proceedings, and I return to it later in this judgment.

3.       In September 2011, the appellant made a complaint to the Chartered Accountants Regulatory Board (“CARB”) against the notice party, whereby he made certain allegations of non-compliance on the part of the respondent with accounting and auditing standards in respect of two specific audits.  Following upon receipt of the appellant’s letter, CARB wrote to the notice party for its observations, and the notice party replied by letter of 13th September, 2012 to CARB, attaching to its letter memoranda addressing the complaints made by the appellant. It is these memoranda (hereinafter referred to as the “Memoranda”) that are the subject of these proceedings.

4.       Following upon receipt of the Memoranda, CARB decided that the complaints of the appellant did not merit further investigation.  That decision in turn gave rise to further litigation which it is not necessary to address in this judgment, but it was arising out of that decision that the appellant, on 10th April, 2013, made a data access request of the notice party, and it is the response of the notice party to that request that has given rise to these proceedings.

5.       The notice party responded to the data access request by letter of 15th May, 2013, whereby it supplied the appellant with a copy of his personnel file and other documentation.  Further correspondence between the appellant and the notice party followed, but he remained dissatisfied with the response of the notice party to his data access request. Accordingly, the appellant made a complaint to the respondent, on 20th June, 2013, to the effect that the notice party had failed to provide him certain documents which the appellant maintained constituted his personal data for the purposes of the Data Protection Acts, and access to which, therefore, the appellant was entitled.  Following upon this complaint, the notice party, on 12th July, 2013 provided additional data/documentation to the appellant.  On 15th July, 2013, the appellant wrote again to the notice party saying that it had failed to provide him with the memoranda attached to the letter sent by the notice party to CARB in response to the complaint of the appellant to that body (i.e. the Memoranda), although the notice party had provided a copy of the cover letter whereby it sent the Memoranda to CARB.  The appellant again requested a copy of the Memoranda.  By letter of 17th July, 2013, the notice party wrote to the appellant informing him that the Memoranda do not constitute the personal data of the appellant and that he was not entitled to a copy of the same. The appellant then resumed his complaint with the respondent, the principal focus of the complaint being the failure to furnish him with the Memoranda.

6.       The respondent then investigated the appellant’s complaint, and on 26th July, 2013, a Mr. Tony Delaney, Assistant Commissioner in the office of the respondent, attended at the offices of the notice party for the purpose of inspecting, inter alia, the Memoranda.  Having done so, Mr. Delaney concluded that the documents in question did not contain any personal data (within the meaning of that term as defined in the Data Protection Acts) relating to the appellant, nor did the documents otherwise refer to him in any way.  Mr. Delaney swore an affidavit to this effect on 27th February, 2014, in connection with the Circuit Court proceedings referred to below.

7.       As a result, the respondent refused the data access request of the appellant. The appellant then appealed that decision to the Circuit Court, pursuant to s. 26 of the Data Protection Act, 1988 (as amended), and on 2nd May, 2014, the President of that Court, his Honour Judge Deery, upheld the decision of the respondent.  The appellant then appealed that decision in the High Court.  That appeal is limited to an appeal on a point of law only.  The appeal came on for hearing before Coffey J. on 1st and 2nd February, 2018, and he very promptly delivered a decision, being the decision under appeal, on 26th February, 2018.

Judgment of Coffey J.

8.       In his judgment, Coffey J. noted that the appellant accepted that the test to be applied by a court in an appeal from a statutory decision-maker is that set out by Finnegan P. in Ulster Bank v. McCarren [2006] IEHC 323, which had also been referred to by the President of the Circuit Court in his decision.  Coffey J. cited the following passage from Ulster Bank v. McCarren:-

               “To succeed on this appeal the Plaintiff must establish as a matter of probability that, taking the adjudicative process as a whole, the decision reached was vitiated by a serious and significant error or a series of such errors. In applying the test, the Court will have regard to the degree of expertise and specialist knowledge of the Defendant. The deferential standard is that applied by Keane C.J. in Orange v The Director of Telecommunications Regulation & Anor and not that in The State (Keegan) v Stardust Compensation Tribunal.”

9.       At paras. 10 and 11 of his decision, Coffey J. records that:-

          “10.           As the appellant had asserted that no inspection had been carried out, the learned Circuit Court Judge considered the issue and determined as a fact that, as part of the investigation of the appellant’s complaint, Tony Delaney, an Assistant Commissioner, had attended the offices of PwC to inspect the documents. He found that the Assistant Commissioner had taken careful notes of the contents of the documents that formed the basis of the decision and that the documents did not constitute personal data relating to the appellant.

          11.            He further found as a fact that the investigation by CARB was not personally referable to the appellant’s complainant (sic) but was referable to the appellant’s complaint about two audits conducted by his former employer, PwC. On that basis, the learned Circuit Court Judge stated that the respondent’s decision that the material in dispute was not ‘personal data’ was a reasonable one, bearing in mind that the court must take due account of the respondent’s expertise in such matters such that the appellant had not discharged the burden of proof.”

10.     At para. 12, Coffey J. states that the appellant appealed the decision of the Circuit Court on the grounds that the materials (i.e. the Memoranda) do constitute his personal data, and that the Circuit Court judge erred in determining that the decision of the respondent was not vitiated by a serious error, or series of errors.

11.     At para. 24, Coffey J. noted:-

               “It is common case that the appellant’s complaint to CARB was in respect of alleged non-compliance by PWC with accounting and auditing standards in respect of two audits.  It is further agreed that, at the relevant time, the appellant was employed as a trainee in the firm and took part to whatever extent in the carrying out of the audits in that capacity. It is on this basis only that the appellant asserts that the information sought is ‘personal data’, to which he is entitled to access under the Act.”

12.     Coffey J. then considered the definition of “personal data” as defined in the Directive, and also the definition of “personal data” as set forth in s. 1 of the Data Protection Act, 1988 (as amended).  At para. 25 of his judgment he states that he inspected the relevant material at the request of the parties to the appeal.  Having done so, he was satisfied that the Memoranda did not contain any data of a personal nature relating to the appellant and did not refer to the appellant in any way.  Furthermore, he noted that there was nothing in the Memoranda that relates to the appellant as an identified or identifiable natural person which engages his right to privacy or which could in any meaningful way be amenable to objection, rectification, or erasure under the provisions of the Data Protection Acts.

13.     Coffey J. then concluded that there had been no error of law on the part of the Circuit judge in determining that the decision of the respondent was not vitiated by a serious error or a series of errors, and accordingly he dismissed the appeal. In doing so however, he decided to vacate the order made by the Circuit judge awarding the costs of that appeal to the respondent, and made no order for costs in the High Court.  The respondent has filed a cross appeal limited to that part only of the decision of Coffey J., and seeks an order for its costs in relation to both appeals.

Grounds of Appeal to this Court

14.     In his notice of appeal dated 9th April, 2018, the appellant (who was a litigant in person) set out just one ground of appeal, that being that the court below erred in holding that the Memoranda do not constitute the personal data of the appellant within the meaning of that term as set out in the Data Protection Acts and the Directive. On that basis, he seeks an order setting aside the order of Coffey J., and a declaration that the Memoranda do constitute his personal data, and also an order remitting the matter to the respondent for further investigation.

15.     In his written submissions dated 29th June, 2018, the appellant purports to expand on those grounds of appeal by adding thereto a claim that the notice party is an illegal entity and as a consequence the Memoranda relate to illegal and invalid audit work. He made additional submissions arising out of this argument, but at the outset of the hearing of this appeal, Haughton J. presiding, informed the appellant that it was not open to him to raise this ground of appeal, for the first time, by way of submissions to this Court, and ruled that the appellant would not be allowed to address the Court in relation to this new ground of appeal, or to rely upon it in any way.

16.     The appellant advanced three grounds as to why the Memoranda should be considered his personal data:-

(1)     The information contained in the Memoranda was generated in response to a complaint that the appellant had made to CARB, and in turn related to audit work performed by the appellant himself in the course of his employment with the notice party;

(2)     The Memoranda should have been stored by the notice party on his (the appellant’s) personnel file;

(3)     The Memoranda should be considered in conjunction with the cover letter whereby the notice party sent it to CARB. The cover letter specifically identifies the appellant as well as the file reference number allocated to the appellant as complainant by CARB.

17.     In support of these arguments, the appellant relies upon guidance issued by the Working Party established pursuant to Article 29 of the Directive, being, according to Article 29(1) of the Directive, a “Working Party on the Protection of Individuals with regard to the Processing of Personal Data”. This guidance was provided in an opinion issued by the Working Party dated 20th June, 2007, (Opinion 4/2007, and hereafter the “Opinion”). Specifically, the appellant relies upon an example given by the Working Party in the Opinion as to what might constitute personal data for the purposes of the Directive. This is example number 6 of the Opinion (to be found at p. 10 thereof) and is in the following terms, under the heading “car service record”:-

               “The service register of a car held by a mechanic or garage contains the information about the car, mileage, dates of service checks, technical problems, and material condition. This information is associated in the record with a plate number and an engine number, which in turn can be linked to the owner. Where the garage establishes a connection between the vehicle and the owner, for the purpose of billing, information will ‘relate’ to the owner or to the driver. If the connection is made with the mechanic that worked on the car with the purpose of ascertaining his productivity, this information will also ‘relate’ to the mechanic.”

          The appellant submits that this example makes clear that one set of data can constitute the personal data of two data subjects. He considers this example to be analogous to the circumstances in which the Memoranda were generated by the respondent.

18.     The appellant further relies on guidance issued by the UK Information Commissioner in which it is stated: “records relating to the consideration and investigation of complaints can be personal data about the person making the complaint, but this will depend upon the circumstances.” He then goes on to quote two examples given by that Commissioner, the second of which states: “where an individual complains that a government department has not responded properly to a Freedom of Information request, and that therefore the individual’s right to receive the requested information has been breached, the case file is likely to be personal data relating to the individual complaint.”

19.     Although not referred to in his written submissions, the appellant purported to make submissions in relation to inconsistencies in the records of the respondent which were generated in consequence of the inspection by the respondent of the Memoranda which took place at the offices of the notice party on 22nd July, 2013.  The general thrust of the submissions was to attempt to undermine the veracity of the record kept by Mr. Delaney of that inspection.  All of this concerns a matter of fact which has already been determined by the Circuit Court i.e. that Mr. Delaney carried out an inspection at the offices of the respondent on 22nd July, 2013 and reviewed the Memoranda.  On that date he determined that the Memoranda did not refer in any way to the appellant.  In his judgment, Coffey J. referred, at paras. 10 and 11 thereof (which I have quoted in full above) to the findings of fact of the Circuit Court judge.  These findings of fact did not and could not form any part of the appeal to the High Court, and by extension, to this Court.  The only matter with which the High Court, and this Court, are concerned is whether or not the Memoranda constitute “personal data” for the purposes of the Data Protection Acts and/or the Directive. 

20.     In advancing his arguments to this Court that the Memoranda do contain personal data as aforesaid, the appellant put forward an argument that he had not made before the High Court, and that is that, since he is the author of the work that was the subject of the complaint to CARB, he is entitled to verify for himself the accuracy of the response of the notice party to his complaint, as set forth by the notice party in the Memoranda, and also that his complaint was lawfully processed by CARB.  He submitted that this entitlement arises under the Directive.  He further submitted that even if he is not referred to by name in the Memoranda, the fact that he is identified in the letter enclosing the Memoranda to CARB is sufficient to render the Memoranda his personal data. 

21.     The appellant relies upon section II, p. 4, of the Opinion which states that it was the intention of the European Commission when drafting the Directive that a broad definition of personal data should be adopted in order to ensure that it encapsulates all information which may be linked to an individual.  He refers to the definition of personal data set out in s. 1 of the Data Protection Act, 2008, (as amended) which provides:-

               “‘Personal Data’ means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the Data Controller.”

          In this case the appellant was identified in the letter enclosing the Memoranda to the respondent and, therefore, he submits that the Memoranda must constitute personal data for the purposes of this definition. 

Submissions of the respondent

22.     In general terms, the respondent submits that the Memoranda do not constitute the personal data of the appellant because:-

(i)      They do not refer to him or identify him in any way;

(ii)      They are not concerned with his work, and do not constitute an assessment of his work;

(iii)     They have no consequence for him.

23.     The respondent submits that the focus of the appellant in seeking to obtain the Memoranda is to test the response of CARB to his complaint.  Accordingly, it is apparent that he is concerned not about his privacy, directly or indirectly, but rather whether CARB appropriately handled his complaint and/or whether the information provided by the notice party was accurate.  It is submitted that such a concern is not the purpose of the Directive and in this regard the respondent relies upon the case of YS v. Minister Voor Immigratie, Integratie en Asiel (Case C-141/12) being a decision of the CJEU dated 17th July, 2014.  The respondent also submits that the purpose of the Memoranda is to address compliance by the notice party with its obligations, and only the notice party is affected by the Memoranda.  The Memoranda are in no way concerned with the privacy of the appellant, and for this reason they do not constitute his personal data. 

24.     The respondent relies on the decision of the Supreme Court in Attorney General v. Davis [2018] 2 I.R. 357 in which case the Supreme Court considered the jurisdiction of a court in an appeal on a point of law, and in particular whether an appeal on a point of law may include an appeal against an error of fact.  McKechnie J. held, at para. 54 thereof that a court may intervene to overturn a decision on a point of law in the following circumstances:-

(1)     In cases of errors of law, as generally understood;

(2)     In cases involving errors such as would give rise to judicial review, including, illegality, irrationality, defective or absence of reasoning and procedural errors of some significance;

(3)     Errors which may arise in the exercise of discretion which are plainly wrong; and

(4)     Certain errors of fact.

25.     As regards errors of fact, McKechnie J. identified three categories:-

(1)     Findings of primary fact where there is no evidence to support the same;

(2)     Findings of primary fact which no reasonable decision-making body could make; and

(3)     Inferences or conclusions:

•        Which are unsustainable by reason of any one or more of the errors already listed;

•        Which could not follow or be deductible from the primary findings as made; or

•        Which are based on an incorrect interpretation of documents.

26.     The respondent submits that the above are parameters defining the jurisdiction of the High Court to interfere with the judgment of the Circuit Court in these proceedings.  The respondent also relies on the decision of Finnegan P. in the case of Ulster Bank v. McCarren [2006] IEHC 323 referred to at para. 8 above.

27.     Counsel for the respondent also drew to the attention of the Court the recent decision of Murray J. in this Court in Stanberry Investments Limited v. Commissioner of Valuation [2020] IECA 33. This was a case which involved an appeal by way of case stated from a decision of the Valuation Tribunal. Addressing the matter of curial deference owed to expert statutory bodies, on appeal, he stated, at para. 49:-

               “Administrative tribunals, expert or otherwise, obtain no deference on pure issues of law (see Millar v. Financial Services Ombudsman [2015] IECA 126 at - in particular - para. 62). The remarks of Kelly J. in Premier Periclase Limited v. Commissioner of Valuation [1999] IEHC 8, makes it clear that errors of fact simpliciter do not present any issue of curial deference either;

         ‘When conclusions are based on an identifiable error of law or an unsustainable finding of fact by a Tribunal, such conclusions must be corrected’ (at para 25).”

28.     Having drawn those qualifications to the attention of the Court, the respondent then relies upon further passages in the judgment of Murray J. in which, having identified by way of example issues that he considered to be within the particular expertise of the Tribunal, and which, on review by a Court would, accordingly, attract deference, he said (at para. 51) that where an appeal:-

               “presents an issue of underlying fact or inference in relation to matters within those zones of expertise, the Courts should certainly afford very significant weight to the decision of the expert body”,

          and then at para. 52 where he stated that:-

               `“Deference means that in those areas touching on the Tribunal's expertise, the Court should be slow to interfere with the Tribunal's reasoning.”

          It is submitted that the matters at issue in these proceedings present mixed questions of law and fact and as such fall within the area of fact or inference in relation to matters within those zones of expertise that merit affording very significant weight to the decision of the expert body.

29.     The respondent refers to Article 1(1) of the Directive which states:-

               “In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.”

30.     “Personal Data” is then defined in the Directive as meaning:-

               “Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic or social identity.”

31.     The respondent accepts that the concept of personal data, for the purposes of the Directive, is wide, as recognised by the Opinion, which states that:-

               “The Directive contains a ‘broad notion of personal data’ which should be ‘as general as possible’.” 

          At the same time however, the Opinion stated that the data protection rules should not be over-stretched.  Coffey J. noted each of these observations at paras. 20 and 23 of the decision under appeal. 

32.     Counsel for the respondent also relies upon the decision of the CJEU in YS v. Ors. (Case C-372/12).  That case was concerned, inter alia, with a claim by the applicant to an entitlement to certain documentation generated and retained by the Immigration and Naturalisation Service of the Netherlands in the course of dealing with an application for a residence permit.  The documentation concerned included a minute in which an administrative officer explained the reasons for his draft decision in the matter, and also included a legal analysis of the application, in light of the applicable legal provisions and the factual background.  The applicant sought access to the minute of the decision, but in accordance with the procedure at the time, this was declined on the basis that a summary of the data contained in the minute was instead provided, along with other information.  The CJEU was then asked by the relevant court, the Rechtbank, Middelburg Court to rule on a number of issues, including whether or not the legal analysis included in the minute constitutes personal data within the meaning of the Directive.  The CJEU held that the data relating to the applicant for a residence permit contained in the minute, and, where relevant, data relating to the applicant in the legal analysis contained in the minute were “personal data” within the meaning of Article 2(a) of the Directive, but, by contrast, the legal analysis itself is not personal data for the purposes of the Directive. At para. 42 of its judgment, the CJEU noted that:-

               “In accordance with Article 1 of that directive, its purpose is to protect the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data, and thus to permit the free flow of personal data between Member States.”

33.     At para. 43, the CJEU noted that the Directive confers the right on individuals whose data is being processed, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances.  At para. 44, the court noted that:- 

               “[T]he protection of the fundamental right to respect for private life means, inter alia, that that person may be certain that the personal data concerning him are correct and that they are processed in a lawful manner.  As is apparent from recital 41 in the preamble to that directive, it is in order to carry out the necessary checks that the data subject has, under Article 12(a) of the directive, a right of access to the data relating to him which are being processed.  That right of access is necessary, inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the controller and consequently to exercise the right set out in Article 12(b) of that directive…”

34.     At para. 47 of its judgment, the court, by analogy, considers its decision in Commission v. Bavarian Lager (Case C-28/08), in which it held that Regulation No. 45/2001 on the protection of individuals with regard to the processing of personal data by the community institutions and bodies and on the free movement of such data is not designed to ensure the greatest possible transparency of the decision making process of public authorities and to promote good administrative practices by facilitating the exercise of the right of access to documents. The court stated that that finding applies equally to the Directive. 

35.     The respondent submits that, in considering whether or not data constitutes personal data for the purposes of the Directive, it is necessary to consider the content, purpose or effect of the data in question.  In this regard, the respondent relies upon the decision of the CJEU in the case brought by the appellant himself against the respondent, referred to in para. 2 above, case C-434/16, whereby the appellant sought access to a corrected examination script.  At para. 33 of its judgment, the CJEU noted that the scope of the Directive is very wide, and at para. 34 stated that the concept of personal data:-

               “potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject.”

          At para. 35, the CJEU stated:-

               “as regards the latter condition, it is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person.”

36.     The CJEU then considered those criteria in the context of a professional examination script at paras. 37-40 as follows:-

          “37.           First, the content of those answers reflects the extent of the candidate’s knowledge and competence in a given field and, in some cases, his intellect, thought processes, and judgment. In the case of a handwritten script, the answers contain, in addition, information as to his handwriting.

          38.            Second, the purpose of collecting those answers is to evaluate the candidate’s professional abilities and his suitability to practice the profession concerned.

          39.            Last, the use of that information, one consequence of that use being the candidate’s success or failure at the examination concerned, is liable to have an effect on his or her rights and interests, in that it may determine or influence, for example, the chance of entering the profession aspired to or of obtaining the post sought.

          40.            It is, moreover, equally true that the written answers submitted by a candidate at a professional examination constitute information that relates to that candidate by reason of its content, purpose or effect, where the examination is, as in this case, an open book examination.”

37.     It is further submitted on behalf of the respondent that, when considering whether or not data is “personal data”, the matter should be considered in the light of the purpose of the Directive which, it is submitted, is the protection of the right to privacy of the individual.  The respondent refers to the decision of the CJEU in case C-553/07, College van Burgemeester en Wethouders van Rotterdam v. Rijkeboer where the CJEU stated, at para. 46, that the purpose of the Directive is:-

               “to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.”

          This is also stated by the CJEU in its judgment in the case of YS, at para. 42 (referred to at para. 32 above).

38.     The respondent refers to a description of the Memoranda as set out in a second affidavit of the Assistant Commissioner, Mr. Delaney, of 25th March, 2014 wherein he describes the nature and content of the Memoranda. This description cross-refers to a description of the Memoranda provided by the notice party itself, at the request of Mr. Delaney and is in the following terms:-

               “This item contained a four-page Memorandum plus thirty pages of supporting documentation.  PWC described this as a Memorandum responding to complaints made by [the appellant] alleging a failure by PWC to comply with certain accounting standards in carrying out the audits of two client companies.  The response related to the accounting treatment applied in respect of the two audits.  I inspected this material to determine whether it contained any personal data of [the appellant].  I am satisfied that there is no personal data of [the appellant] in this item.”

39.     It is submitted that having regard to the test in Ulster Bank v. McCarren i.e. considering the “adjudicative process as a whole”, the respondent conducted a thorough investigation of the matter which included the inspection by the Assistant Commissioner and that it is unclear what further steps could have been taken by the respondent.

40.     In considering the purpose, content, and effect of the data, the respondent submits that the purpose of the Memoranda was to facilitate an assessment of the notice party’s compliance with professional and accounting standards.  The appellant himself acknowledges that his complaint to CARB alleges a breach of professional and accounting standards by the notice party, and the Memoranda are the response of the notice party to that allegation.  It follows that the content of the Memoranda relates to compliance by the notice party with applicable professional and accounting standards.  It further follows that the effect of the Memoranda relates to compliance by the notice party with its professional and accounting standards, and that there is no effect for the appellant.

41.     For all of these reasons, it is submitted that the Memoranda cannot be said to comprise or contain personal data relating to the appellant.  Furthermore, it is clear that no privacy interest of the appellant is engaged by the Memoranda.  Therefore, the release of the Memoranda to the appellant would not serve the purpose of the Directive.

42.     Insofar as the appellant submits that the Memoranda comprise his personal data by reason of the fact that he was involved in the audits about which he has made allegations, it is submitted on behalf of the respondent that this does not alter the position in any way because the appellant’s complaint concerned compliance by the notice party with its obligations, and not any obligations of the appellant himself.  Accordingly, the appellant was not implicated in any way by the manner in which the audits were conducted, nor affected in any way by his role in those audits.

43.     Counsel for the respondent, in her submissions, addresses the examples relied upon by the appellant, in his submissions, taken from the Opinion and also from the guidance published by the UK Information Commissioner.  In relation to the example from the Opinion, involving car service records, it is submitted that the appellant fails to appreciate that it is only when a connection is made between the customer and his/her car service records for billing purposes, or between the mechanic and assessing his/her productivity that the data concerned has effects for the individual, and thereby constitutes the personal data of the individual concerned.  That does not arise in this instance.

44.     As regards the example of the journalist who makes a complaint regarding the failure of a Government Department to disclose information pursuant to a freedom of information request, the connection is made through the identification of the journalist in making the request.  Counsel for the respondent then provides what she submits is a more relevant example provided by the UK Information Commissioner, involving a case where an individual complains that a company has been “fly-tipping”, giving rise to an investigation by the relevant regulatory authority.  In this instance, the guidance provided by the UK Information Commissioner states that the file opened as a result does not constitute the personal data of the complainant. 

Submissions of notice party

45.     The notice party submits that the appellant has failed to identify any error of law on the part of the High Court judge, and, so far as facts are concerned, the facts have been determined and this Court has no role in assessing the facts.

46.     In any case, the respondent carried out an inspection of the Memoranda and concluded that they did not contain “personal data” concerning the appellant.  The respondent is an expert body whose decisions in such matters are deserving of respect. 

47.     Counsel for the notice party further submitted, at the hearing of this appeal, that the argument of the appellant, advanced at this hearing, that he or his work is in some manner subject to assessment by the Memoranda has not previously been advanced by the appellant.  Moreover, there is no evidence that this is the case.  He did not raise this issue in any of the correspondence leading up to his complaint to the respondent, or thereafter.  Paragraph 4 of his own submissions to this Court make it clear that his complaint to CARB alleges breach by the notice party of its professional and accounting standards in the statutory audits of two clients.  There is no mention of any assessment of the appellant himself.

48.     It is not in dispute that the Memoranda were prepared in response to the complaint of the appellant about compliance by the notice party with applicable auditing standards.  The fact that the appellant was a member of the auditing team is not sufficient to render the Memoranda the personal data of the appellant.  This is entirely distinguishable from the assessment of a candidate in an examination.  A candidate in an examination is affected by the assessment; in this case the appellant could not be affected by the assessment undertaken by the respondent as to compliance by the notice party with its professional and accounting standards and obligations. 

49.     It is further submitted on behalf of the notice party that the Directive, and the Data Protection Acts which implement the Directive, are concerned with the right of an individual to access documents relating to that individual, and to have errors corrected, or to prevent further data processing in appropriate cases.  That does not arise in this case because the documentation concerned does not relate to the appellant. 

Discussion and decision

50.     First and foremost, it is appropriate to observe that the appellant is not referred to by name nor is he identified in any way by the Memoranda.  This has been found, as a matter of fact, by the Circuit Court judge.  Moreover, although he was not obliged to do so, Coffey J., at the request of the parties, reviewed the Memoranda and recorded the same conclusion in the judgment under appeal. 

51.     However, the fact that the respondent is not referred to by name or otherwise identified by the Memoranda is not conclusive as to whether or not they constitute personal data, because the definition of personal data as set forth in the Data Protection Act, 1988 (as amended) refers to the data concerned (in this case the Memoranda) “in conjunction with other information that is in, or is likely to come into, the possession of the data controller.”  The Memoranda were sent to CARB by the notice party by letter dated 13th September, 2012 (a copy of which letter the notice party made available to the appellant by letter dated 12th July, 2013).  This letter refers to the appellant by name and, accordingly, while the appellant is not identified in the Memoranda directly, he is identified by the Memoranda taken in conjunction with the cover letter, a copy of which is retained by the notice party.  However, that is not, in and of itself, sufficient to bring the Memoranda within the definition of personal data, because it must also be established that the Memoranda are data “relating to” the appellant as required by the definition of personal data set forth both in the Data Protection Acts and in the Directive.

52.     As to the meaning of “relating to” it is the meaning and application of those words that lie at the centre of this appeal and before that, of the appeal before the High Court.  This is a mixed question of fact and law. Of course this Court has no function in determining the facts (and nor did the High Court). They were determined by the respondent, and that determination was upheld, on appeal, by the Circuit Court. What remains to be determined on this appeal therefore can only be a matter of pure law, both because the facts are already determined and because the appeal to the High Court is on a point of law only. As Murray J. noted in Stanberry, “administrative tribunals, expert or otherwise, obtain no deference on pure issues of law.” The question for determination on this appeal therefore is whether or not there has been any error of law on the part of the Circuit Court, or the High Court, in upholding the decision of the Circuit Court, of the kind described by McKechnie J. in Attorney General v. Davis (see para. 24 above).

53.     One might have thought that the meaning of the words “relating to” would be straightforward and that it is not a term which lends itself to any difficulty of interpretation.  However, the requirement to apply a broad meaning to the definition of “personal data” in order to give full effect to the terms of the Directive makes it a somewhat more complex task than it might appear at first glance.

54.     The Opinion proposes a refreshingly simple interpretation in stating, as is does, at p. 9: “in general terms, information can be considered to ‘relate’ to an individual when it is about that individual.”  At p. 10 of the Opinion, there is a short, but helpful, extract from an earlier report prepared by the same Working Party concerning RFID technology in which it is stated that “data relates to an individual if it refers to the identity, characteristics or behaviour of an individual or if such information is used to determine or influence the way in which that person is treated or evaluated.” Can it be said that the Memoranda are about the appellant, or that they relate to him in the manner proposed by the Opinion? It is the appellant’s contention that the Memoranda relate to him because they were generated in response to his complaint and also because he, as a trainee accountant, worked on the very audits in respect of which he has complained that the notice party has failed to meet its professional standards.  

55.     In his submissions to this Court, the appellant argued (for the first time) that the Memoranda constitute an assessment of his work as a trainee accountant, and he claimed that there would be consequences for him if he failed to follow the applicable standards.  In his judgment, at para. 24, Coffey J. records that:-

               “It is common case that the appellant’s complaint to CARB was in respect of alleged non-compliance by PwC with accounting and auditing standards in respect of two audits.  It is further agreed that, at the relevant time, the appellant was employed as a trainee in the firm and took part to whatever extent in the carrying out of the audits in that capacity.  It is on this basis only that the appellant asserts that the information sought is “personal data”, to which he is entitled to access under the Act.”

56.     It is apparent therefore, that, before this Court, the appellant has expanded, at least to a certain degree, on the grounds upon which he asserts that the Memoranda constitute his personal data.  In any event, there is no evidence that the Memoranda include any assessment of the work of the appellant.  Indeed, the evidence is to the contrary, since Mr. Delaney, the Assistant Commissioner of the respondent, avers expressly in his affidavit of 27th February, 2014 that the Memoranda do not refer to the appellant in any way.  Nor is there any evidence that the appellant would suffer any adverse consequences if the Memoranda disclosed that he had failed (as a trainee) to follow applicable standards.  Moreover, the appellant excluded from his data access request the working papers that he prepared in conducting the relevant audits, and so the materials generated by the appellant himself do not form any part of his request.

57.     On the appellant’s own case, it is clear that the Memoranda were prepared in response to a complaint that he made to CARB alleging the breach, by the respondent, of its professional and accounting standards in the conduct of statutory audits of two of its clients. As already mentioned, it has been established as a matter of fact that the Memoranda do not refer to the appellant “in any way”.  In considering whether or not data is personal data, it is apparent from both the Opinion and the decision of the CJEU in YS, that amongst the matters to be taken into account are the content, purpose and effect of the data concerned. I turn now to consider the Memoranda in the light of those factors.

58.     A description of the content of the Memoranda is to be found in exhibit TD 1 to the affidavit of Mr. Delaney of 27th February, 2014, as follows:-

               “PWC described this as a Memorandum responding to complaints made by [the appellant] alleging that failure by PWC to comply with certain accounting standards in carrying out the audits of two client companies.  The response related to the accounting treatment applied in respect of the two audits.  I inspected this material to determine whether it contained any personal data of [the appellant].  I am satisfied that there is no personal data of [the appellant] in this item…”

59.     It is apparent that this description draws from a description of the Memoranda provided by the notice party to Mr. Delaney. Of course Mr. Delaney inspected the Memoranda, and was plainly satisfied with the accuracy of the description provided. There is no reason to doubt that the Memoranda comprise a response by the notice party to the appellant’s complaint about non-compliance by the notice party with certain accounting standards. Indeed, it is precisely because of the nature and content of the Memoranda, as so described, that the appellant wishes to be able to review the same.  He said as much in his submissions to this Court, in stating that he wishes to verify the accuracy of the Memoranda i.e. the accuracy of the reply of the notice party to his complaint about its compliance with its professional standards and obligations.

60.     The purpose of the Memoranda was to respond to an allegation made by the appellant as regards compliance by the notice party with its professional and accountancy standards.  The appellant did not claim that his complaint was linked in any way to the performance of his own duties as a trainee on the audits to which he referred in his complaint.  As such, the appellant himself has not sought to link his own work on the audits concerned to the complaints that he advanced. 

61.     It is thus clear that any effect of the Memoranda can only impact upon the notice party.  It is not in dispute that the complaint that the appellant made to CARB concerned compliance by the notice party with its professional and accounting standards.  The determination of the complaint (or, as matters transpired, whether or not to admit the complaint) can only have had an effect on the notice party, and none at all on the appellant. 

62.     It is apparent from the analysis above, that the Memoranda could not in any way engage the privacy interests of the appellant. He could have no need to see the Memoranda to assess their accuracy, or to request amendments thereto, because they do not refer to him in “any way”, which must be taken to include his work on the audits concerned. In my opinion it is impossible to see how it could be said that the Memoranda are “about” the appellant or that they “refer to the identity, characteristics or behaviour of [the appellant]” or that the Memoranda are “used to determine or influence the way in which [the appellant] is treated or evaluated.” All of that being the case, while the definition of personal data is deliberately very broad, to interpret the Memoranda as being personal data for the purposes of the Data Protection Acts and/or the Directive, for the sole reason that it was generated as a result of a complaint made by the appellant would, in my opinion, be to “overstretch” (to borrow the word used by the Working Party in the Opinion) the concept of personal data. It is not necessary to do so in order to fulfil the purposes of the Directive. For all of these reasons, on the basis of the facts as found by the respondent and as upheld by the Circuit Court judge, I am satisfied that, as a matter of law, the Memoranda do not “relate to” the appellant, and do not constitute his personal data.

63.     To all of the above I add that in so far as the appellant may wish to see the Memoranda to consider whether it was an adequate or accurate response to his complaint, it is clear from the passage in YS referred to at para. 34 above that such purposes are outside the scope of the Directive. This is also reflected in the Opinion, in which it is stated at p. 5 that “[a]n undesirable result would be that of ending up applying data protection rules to situations which were not intended to be covered by those rules and for which they were not designed by the legislator.” In my opinion, the trial judge, in considering whether or not the Memoranda constitute the personal data of the appellant, properly applied and considered the meaning of the term, the purpose of the Directive, the relevant authorities, including domestic authorities on appeals from statutory bodies such as the respondent, and, having done so, arrived at the correct conclusion, i.e. that there was no error of law in the decision of the learned Circuit Court judge.  Accordingly, I would dismiss the appeal.

64.     As far as costs are concerned, it is first necessary to consider the costs incurred in the Circuit Court and High Court appeals, which are the subject of the respondent’s cross appeal. I can see no reason to depart from the normal rule that costs should follow the event in those proceedings. To that extent only therefore, I would overturn the decision of Coffey J. in the court below and order that the appellant shall discharge all of the costs incurred by the respondent in the Circuit Court and in the High Court, when taxed and ascertained.

65.     As regards the costs of this appeal, the appeal has failed, and subject to consideration of any submissions the appellant may wish to make within 14 days from the date hereof, the appropriate order is that costs should follow the event, and the respondent shall be entitled to recover from the appellant the costs incurred by it in this appeal, when taxed and ascertained.

66.     Since this decision is being delivered electronically, Haughton and Ní Raifeartaigh JJ. have authorised me to record their agreement with the terms of this judgment.

Result:     Appeal Dismissed.