Nowak: When an Exam Answer Becomes Personal Data

Case C-434/16 | Peter Nowak v Data Protection Commissioner | Court of Justice of the European Union | Second Chamber | 20 December 2017

Practice Takeaways: ① “Personal data” is deliberately broad. It can include virtually any kind of information, not merely information that is private or sensitive. ② Ask whether information relates to a person by content, purpose, or effect. A connection through any of these dimensions may bring information within the definition. ③ Opinions and assessments can be personal data. Information does not have to be objectively verifiable to qualify. ④ Information can relate to more than one person. The examiner’s comments could be personal data relating both to the candidate and to the examiner. ⑤ Pseudonymization does not necessarily take information outside data-protection law. An identification number was sufficient where the examination body could connect the script to the candidate. ⑥ Classification comes before access. Information should not be excluded from the definition of personal data merely because recognizing it as such may give the individual rights of access, rectification, or erasure.

Can an answer written on a professional examination be personal data?

At first glance, an exam answer may seem to be information about accounting, law, mathematics, or another subject—not information about the person who wrote it. But in Nowak, the Court of Justice rejected such a narrow understanding of personal data.

The Court held that “personal data” is a deliberately broad concept. Information may relate to an individual because of its content, purpose, or effect, and it may include not only objective facts but also subjective information, such as opinions and assessments. Applying that approach, the Court held that both a candidate’s written examination answers and the examiner’s comments about those answers constituted the candidate’s personal data. (Judgment, paras. 33–45.)

The significance of Nowak extends far beyond examination papers. Its content-purpose-effect test provides an important framework for determining when information that does not look obviously personal nevertheless falls within EU data-protection law.

What Happened

Peter Nowak was a trainee accountant who had passed several examinations administered by the Institute of Chartered Accountants of Ireland (CAI), but failed its Strategic Finance and Management Accounting examination four times. After unsuccessfully challenging his fourth result, he submitted a data-access request seeking all personal data relating to him that the CAI held. (Judgment, paras. 18–19.)

The CAI provided 17 documents but refused to give him his examination script, taking the position that the script did not contain personal data. Nowak complained to the Irish Data Protection Commissioner, who similarly concluded that examination scripts did not generally constitute personal data and declined to investigate his complaint. (Judgment, paras. 20–23.)

Nowak challenged that decision through the Irish courts. The case eventually reached the Irish Supreme Court, which asked the CJEU whether answers submitted by a candidate in a professional examination could constitute personal data and, if so, what factors should determine that classification. (Judgment, paras. 24–27.)

The question therefore went beyond whether Nowak was entitled to see his examination paper. At its core was something more fundamental: what does it mean for information to “relate to” a person?

Why the Case Matters

EU data-protection law defines personal data broadly as “any information relating to an identified or identifiable natural person.” But the difficult part is often not determining whether a person is identifiable. It is determining whether particular information “relates to” that person.

Nowak supplied an important framework for answering that question.

The Court emphasized that “any information” is intended to give the concept of personal data a wide scope. It is not limited to private, sensitive, or biographical facts. It can encompass objective information as well as subjective information, including opinions and assessments, provided that the information relates to the individual. (Judgment, paras. 33–34.)

And information may relate to someone when, because of its content, purpose, or effect, it is linked to that person. (Judgment, para. 35.) That analysis closely tracks the framework discussed in What Is “Personal Data” Under EU Data Protection Law?, which explains that the “relating to” element may be satisfied through content, purpose, or result, and that those are alternative rather than cumulative conditions.

That formulation makes Nowak important well beyond examinations. Scores, assessments, evaluations, observations, profiles, recommendations, and other information generated about a person may be personal data even when they are not facts supplied by that individual.

The Key Holding

The Court held that both the candidate’s written answers and the examiner’s comments about those answers constituted personal data. (Judgment, paras. 36–45, 62.)

The candidate was identifiable even if the examiner did not know his identity while marking the examination. The examination body could connect the identification number on the script with the particular candidate. (Judgment, paras. 29–31.)

More importantly, the answers themselves related to the candidate. Their content reflected his knowledge, competence and, in some circumstances, his thought processes and judgment. Their purpose was to evaluate his professional abilities. And their effect could determine whether he passed the examination and potentially influence his ability to enter the profession or obtain a position. (Judgment, paras. 36–41.)

The examiner’s comments likewise related to the candidate because they recorded an assessment of his individual performance and could affect his interests. (Judgment, paras. 42–44.)

The Court’s Analysis

1. “Any Information” Really Is Broad

The Court began from the breadth of the statutory language.

The expression “any information” demonstrates that the EU legislature intended personal data to have a wide scope. The concept is not confined to sensitive or private information and does not require the information to be an objectively verifiable fact. It potentially includes “all kinds of information,” including opinions and assessments. (Judgment, paras. 33–34.)

That distinction matters. A statement does not cease to be personal data merely because it represents someone else's judgment about the individual rather than an objective characteristic of that person.

An examiner's assessment of a student, for example, may therefore be personal data even though it records the examiner's opinion.

Practice Tip: Do not limit a personal-data inventory to facts collected from the individual. Evaluations, scores, ratings, observations, recommendations, and other information generated about a person may also be personal data.

This aspect of Nowak would later become particularly important in CRIF, where the Court relied on Nowak when explaining that the broad concept of personal data can encompass information resulting from processing, including an assessment of an individual's creditworthiness or ability to pay.

2. The Content-Purpose-Effect Test

The Court then provided the central analytical framework of the judgment: information relates to an individual where, by reason of its content, purpose, or effect, it is linked to that person. (Judgment, para. 35.)

All three connections existed in Nowak's examination answers.

• Content. The answers reflected the candidate's knowledge and competence and potentially his intellect, thought processes, and judgment. A handwritten examination also conveyed information about his handwriting. (Judgment, para. 37.)
• Purpose. The answers were collected specifically to evaluate the candidate's professional abilities and suitability to practice the profession. (Judgment, para. 38.)
• Effect. The information was used to determine whether the candidate passed or failed, potentially affecting his opportunity to enter a profession or obtain employment. (Judgment, para. 39.)

The Court therefore looked beyond what the words on the page literally described. The relevant question was also why the information existed and what was done with it.

Practice Tip: When it is unclear whether information “relates to” an individual, do not examine the content alone. Ask three questions: What does the information say about the person? Why is it being collected or used? What consequences can its use have for that person?

This is perhaps Nowak's most transferable lesson.

3. Identifiability Does Not Require a Name

The fact that an examiner might not know whose paper was being graded did not make the answers anonymous.

A candidate could be identified directly by name or indirectly through an identification number. And the examination body possessed the information necessary to connect that number with the candidate. The Court emphasized that all information necessary to identify the data subject does not have to be held by a single person, relying on its earlier judgment in Breyer. (Judgment, paras. 29–31; judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, para. 43.)

The relevant question was therefore not whether the examiner personally knew that Peter Nowak had written the answers, but whether the individual was identifiable within the relevant processing environment.

4. The Examiner’s Comments Are Personal Data Too

The Court went a step further and held that the examiner's comments on the examination script also constituted the candidate's personal data.

Their content reflected the examiner's opinion or assessment of the candidate's performance. Their purpose was to record that evaluation. And they could have effects on the candidate. They therefore related to the candidate under the same content-purpose-effect analysis. (Judgment, paras. 42–43.)

But the Court made another important observation: the same information can constitute personal data relating to more than one person.

The examiner's comments could simultaneously contain information relating to the examiner and information relating to the candidate. One characterization did not exclude the other. (Judgment, paras. 44–45.)

Practice Tip: Personal data does not necessarily belong to only one person. An email, evaluation, complaint, interview note, or performance review may simultaneously contain personal data relating to several identifiable individuals. Access and disclosure decisions may therefore require consideration of overlapping rights.

5. Classification Should Not Depend on the Consequences

Ireland and the Data Protection Commissioner raised a practical concern: if examination answers and comments were personal data, candidates could potentially invoke data-protection rights of access and rectification in relation to their examination papers.

The Court rejected using those consequences to narrow the definition.

Classification as personal data triggers an entire system of data-protection obligations and safeguards—not merely access and rectification. Excluding examination answers from the definition would remove them from rules governing matters such as data quality, lawful processing, security, objection, supervisory oversight, and other protections. (Judgment, paras. 46–50.)

In other words, whether information is personal data must be determined by the definition of personal data—not by whether the consequences of that classification are convenient.

6. Personal Data Does Not Mean the Individual Can Rewrite the Record

Recognizing the examination answers as personal data did not mean that Nowak could use data-protection law to change incorrect answers after taking the examination.

Accuracy has to be evaluated in light of the purpose for which the information was collected. The purpose of retaining the answers was to record the candidate's knowledge and competence at the time of the examination. An incorrect answer therefore accurately records that the candidate gave an incorrect answer. (Judgment, paras. 51–53.)

Rectification could nevertheless become relevant if the record itself were inaccurate—for example, if another candidate's answers were mistakenly attributed to Nowak, pages were lost, or the examiner's comments did not accurately record the evaluation actually made. (Judgment, para. 54.)

This produces an important distinction:

Data-protection accuracy concerns whether the record accurately represents what occurred—not whether the underlying opinion, answer, or performance recorded in it was substantively correct.

7. Retention Is Part of the Analysis Too

The Court also connected classification as personal data with the principle of storage limitation.

It observed that there could come a point when retaining identifiable examination answers and comments was no longer necessary once the examination process was definitively closed and could no longer be challenged. At that stage, the material might have lost its relevant evidentiary value. (Judgment, para. 55.)

The Court did not establish a universal retention period for examination papers. But the point illustrates why classification matters: once information is personal data, the full set of data-protection principles potentially applies to its lifecycle, not merely the right of access.

The Advocate General’s Opinion

Advocate General Juliane Kokott reached essentially the same conclusion and proposed that a handwritten examination script attributable to a candidate, including the examiner's corrections, should constitute personal data. (Opinion, para. 70.)

Her reasoning provides useful additional context.

The Advocate General emphasized that an examination is designed to identify and record the individual performance of a particular person. The answers therefore cannot be viewed merely as abstract solutions to examination questions. They document how that particular candidate performed. (Opinion, paras. 21–25.)

She also rejected the argument that recognizing examination scripts as personal data would improperly transform data-protection law into an alternative examination-appeal process. The existence of other procedures governing access to or challenges against examination results does not determine whether information is personal data. Any legitimate limitations on data-protection rights must instead be addressed through the rules governing those rights and their permitted restrictions. (Opinion, paras. 31–50.)

The Court ultimately followed the Advocate General's central conclusion, while articulating the broader content-purpose-effect framework that has become the judgment's most important doctrinal contribution.

What the Court Did—and Did Not—Decide

The Court did hold that the concept of personal data extends beyond private or sensitive facts and can encompass subjective information, including opinions and assessments.

It did establish that information may relate to an individual through its content, purpose, or effect.

It did hold that a candidate's examination answers and the examiner's comments about those answers were personal data.

And it did recognize that the same information may simultaneously constitute personal data relating to more than one individual.

But the Court did not hold that every piece of information appearing in an examination document is necessarily the candidate's personal data. It expressly noted, for example, that the examination questions themselves did not as such constitute the candidate's personal data. (Judgment, para. 58.)

It did not give candidates a right to use rectification to replace wrong examination answers with correct ones.

And it did not hold that classification as personal data produces an unlimited right of access. Both Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Directive (Directive 95/46)), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (GDPR) permit restrictions in appropriate circumstances, and Article 15(4) GDPR expressly provides that the right to obtain a copy must not adversely affect the rights and freedoms of others. (Judgment, paras. 59–61.)

Nowak Today

Although Nowak was decided under Directive 95/46, its central interpretation remains highly relevant under the GDPR.

Article 4(1) GDPR continues to define personal data using the same essential formulation: “any information relating to an identified or identifiable natural person.” And the Court has continued to rely on Nowak when interpreting that definition.

CRIF provides a particularly clear example. In 2023 (once GDPR was already in effect), the Court cited Nowak for the proposition that personal data potentially encompasses all kinds of information, objective and subjective, including opinions and assessments, provided that it relates to the individual by reason of its content, purpose, or effect. The Court then applied that broad conception in interpreting the GDPR right of access.

The two cases therefore fit naturally together:

• Nowak asks: What counts as personal data?
• CRIF asks: Once it is personal data, what does it mean to provide the data subject with a “copy”?

Together, they reinforce a broader principle running through the Court's data-protection jurisprudence: personal data is defined by the relationship between information and an identifiable person—not simply by the form in which the information appears or by who originally created it.

Conclusion

Nowak began with an examination paper, but its importance extends much further.

The Court rejected a narrow conception of personal data limited to biographical facts, identifying information, or information supplied by the individual. Opinions, assessments, evaluations, and other information generated about a person can also be personal data.

The key question is whether the information relates to an identifiable person through its content, purpose, or effect.

That approach makes the definition contextual. A piece of information that appears impersonal when viewed in isolation may become personal data because of why it was created, how it is used, or what consequences it has for an identifiable individual.

And that is Nowak's enduring lesson: to determine whether information is personal data, look beyond what the information says and ask what relationship the information has to the person.

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-434/16, Peter Nowak v Data Protection Commissioner.

• Court of Justice of the European Union, Second Chamber, Case C-434/16, Peter Nowak v Data Protection Commissioner, Judgment of 20 December 2017, ECLI:EU:C:2017:994.
• Opinion of Advocate General Juliane Kokott, Case C-434/16, delivered 20 July 2017, ECLI:EU:C:2017:582.

Useful Reading from The De La Torre Review

• “What Is ‘Personal Data’ Under EU Data Protection Law?” An overview of the definition of personal data under the GDPR, including its four core elements and when information “relates to” an individual through its content, purpose, or result. It provides the broader framework for the definition applied by the Court in Nowak. Read the Article.
• CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List — Builds directly on Nowak's broad understanding of personal data. Relying on Nowak, the Court confirmed that personal data can include objective and subjective information, including assessments generated through processing, and explained what it means to provide a meaningful “copy” of those data under Article 15 GDPR. Read the Article.
• Rijkeboer: When the Right of Access Reaches Into the Past — An earlier chapter in the Court's access-rights jurisprudence, addressing how far into the past a data subject must be able to obtain information concerning the disclosure of personal data. Read the Article.
• Bavarian Lager: When Transparency Requests Become Data-Protection Questions — Examines the relationship from another direction: when access to government documents implicates the personal-data rights of individuals identified in those documents. Read the Article.
• Breyer: When an IP Address Becomes Personal Data — Provides an important foundation for Nowak’s analysis of identifiability. Nowak relies on Breyer in explaining that all information necessary to identify an individual need not be held by a single person, before turning to whether the information “relates to” that identifiable individual. Read the Article.

Other Reading

• Article 29 WP opinion 4/2007 on the concept of Personal Data. NOTE: The Article 29 Working Party adopted Opinion 4/2007 on the Concept of Personal Data (WP136) on 20 June 2007, interpreting the definition of personal data under Directive 95/46/EC. When the EDPB succeeded the Working Party on 25 May 2018, it adopted a number of WP29 guidelines developed in preparation for the GDPR. Opinion 4/2007 was not among the documents formally endorsed. Its continuing importance instead comes from the persistence of the same core definition of personal data in Article 4(1) GDPR and, importantly, from CJEU case law such as Nowak, which adopted substantially the same analytical approach.