Professor Steve Peers, University of Essex

Privacy and data protection are distinct legal concepts originating from different legal frameworks and adjudicated by separate European courts. However, these concepts often intersect, and the relevant courts, namely the European Court of Justice (ECJ) interpreting EU data protection laws and the European Court of Human Rights (ECtHR) interpreting the right to privacy within the European Convention on Human Rights (ECHR), sometimes reference each other’s legal precedents and texts.

Recently, both courts issued rulings concerning these rights within the context of universities and academic institutions, presenting an opportunity to compare their approaches in similar cases and understand the significance of these rights in education.

Students and Exam Scripts: the Nowak Case

The ECJ’s judgment in the Nowak case addressed the applicability of the EU’s Data Protection Directive to exam scripts. Although the General Data Protection Regulation (GDPR) is set to replace the Directive, this judgment’s outcome would likely remain unchanged, as the Court referenced the GDPR in its reasoning.

Mr. Nowak, a trainee accountant in Ireland, repeatedly failed a crucial exam and requested access to all personal data held by the Institute of Chartered Accountants of Ireland. The Institute refused to provide a copy of his exam script, leading Mr. Nowak to file a complaint with the Irish data protection authority, which deemed exam scripts as non-personal data and the complaint vexatious. Mr. Nowak’s challenges through the Irish court system were unsuccessful until the Supreme Court, while finding his complaint inadmissible, raised uncertainty about the classification of exam scripts as personal data and referred the matter to the ECJ for interpretation.

The ECJ’s ruling began by invoking the Directive’s definition of “personal data” as “any information” related to an identified or identifiable individual. A student is considered either identified by name or identifiable through an examination number.

The Court affirmed that the examiner’s ability to identify the individual during marking is immaterial and acknowledged that identification methods can be distributed among different personnel, as administrative staff would later link exam scores to individual students. This confirms the legitimacy of anonymous marking practices and the use of registration numbers in data processing to maintain confidentiality.

The Court then addressed whether exam scripts and examiner comments constitute information related to a specific individual. The Court emphasized the broad scope of the Directive and the term “any information,” stating that it encompasses all types of information, including opinions and assessments, as long as they “relate” to the data subject.

Applying this definition, the Court determined that exam candidates’ answers are personally linked to them, revealing their intellect, knowledge, and judgment. The collection of these answers aims to assess candidates’ abilities and suitability, and their use can impact candidates’ rights and interests, such as access to a profession. This holds true even for open-book exams.

Significantly for academics, the Court also classified comments on exams as personal data, as they represent an opinion about the candidate, specifically an assessment of their abilities, with potential consequences for the individual. The fact that these comments also constitute personal data relating to the examiner is irrelevant, as information can be personal data for multiple individuals.

The Court clarified that once information is classified as “personal data,” rules regarding data access and rectification apply. It emphasized that rectification doesn’t grant exam candidates the ability to modify incorrect answers, as the right to rectification is tied to the purpose of data collection—in this case, assessing the candidate’s abilities. Rectification would apply to errors like a missing cover sheet or mixing up exam scripts. Additionally, data protection law might necessitate the destruction of exam scripts once they are no longer relevant.

The Court further clarified that candidates do not possess a right to access exam questions (meaning access before the exam), as these questions are not considered personal data concerning the candidate.

Lastly, the Court vaguely stated that data access restrictions are permissible under both the Directive and the GDPR. However, the judges’ intended point remains unclear, as this observation is not applied to the case.

Comments

Practically, the judgment mandates that examiners exercise caution when writing comments on exam scripts. Personal opinions or irrelevant remarks would be inappropriate. Instead, comments should focus on a fair and objective assessment of the script’s content.

While some academics might be concerned about potential workload implications, data protection law should not dictate the level of detail or necessity of comments. This remains at the discretion of universities and educational institutions. Experience suggests that providing access to exam scripts and comments does not pose significant challenges.

Data protection law judgments are often criticized for lacking common sense. However, this ruling demonstrates practicality by dismissing the notion of students correcting exam papers after submission or having pre-exam access to questions. However, it omits broader educational policy arguments supporting its judgment, such as marker accountability to students and the potential value of feedback provided through comments on exam scripts, which may have been Mr. Nowak’s objective. Naturally, the latter point depends on the detail of the comments; the judgment doesn’t preclude examiners from providing minimal feedback.

Privacy in Lecture Theaters: the Antovic and Mirkovic v Montenegro Case

While professors are accountable to students in exam marking, to what extent can attempts to ensure their accountability to university management affect their privacy? In this case, the Dean of a university’s mathematics school implemented lecture recordings for the stated purposes of safeguarding university property and “teaching surveillance.”

Instead of resorting to written complaints on exam scripts, some professors lodged complaints with the data protection supervisory authority, which eventually ruled that the university violated data protection law. Interestingly, the data protection authority outside the EU took more decisive action compared to the one within the EU in the Nowak case.

The professors then pursued legal action against the university, alleging a breach of their right to privacy during the period of video surveillance. After losing in the national court, they appealed to the ECtHR.

The ECtHR ruled in favor of the professors by a narrow 4-3 margin. However, the judges were divided on the crucial aspect of whether a right to privacy existed and its basis, with no single viewpoint achieving a majority. Given this close outcome, it remains to be seen whether Montenegro will seek a review by the ECtHR Grand Chamber.

All judges agreed that the pivotal question was whether a “reasonable expectation of privacy” existed. The majority ruled that, based on previous ECtHR judgments, such an expectation generally applied to workplaces.

Consequently, an interference with privacy rights was established, which could be justified under Article 8(2) ECHR if the interference was lawful and pursued a specified legitimate aim. In this case, the interference was deemed unlawful, as the law did not explicitly allow for the surveillance of teaching and stipulated a condition not met here: that property surveillance was permissible only if no other means were available. Therefore, the Court didn’t assess the existence of a legitimate aim.

Two concurring judges agreed that an interference with the right to privacy occurred but believed it should have been established based on different grounds. They argued that the focus should have been on the activities being conducted rather than the workplace surveillance aspect. Lectures involve the discussion of ideas and student interaction and are considered part of academic freedom. (It’s worth noting that the applicants did not claim a breach of Article 10 ECHR, concerning freedom of expression.)

Conversely, the dissenting judges argued that no interference with privacy rights occurred. They maintained that case law only protected a reasonable expectation of privacy in specific circumstances that didn’t apply here due to certain safeguards: the absence of audio recording, the blurring of faces to prevent professor identification, and limited subsequent use of the recordings.

Comments

The ECtHR judgment didn’t address EU data protection law, but EU regulations would likely have resulted in a comparable outcome (tailored to data protection law) for different reasons. The ECJ’s ruling in the Rynes case established that the Data Protection Directive applies to CCTV recordings except those exclusively capturing activities within a home (the “household exception”). This suggests that recordings of lecture theaters would fall under the Directive’s scope. The dissenting judges’ assessment of professor “identifiability” appears superficial in light of the Nowak judgment. Could it not be determined who was lecturing at a specific time using timestamps or other contextual information?

Of the two lines of reasoning supporting the application of the right to privacy, the concurring judges’ analysis appears more persuasive. The concept of “teaching surveillance” is concerning, particularly within the context of academic freedom and democratic values. Given that exceptions to Article 8 ECHR are permissible only if necessary in a “democratic society,” acknowledging the importance of academic freedom when assessing potential privacy breaches is logical. Additionally, it would have been beneficial to explicitly state that “teaching surveillance” does not constitute a legitimate ground for interfering with the right to privacy.

Regardless of safeguards, the announcement of teaching surveillance has a chilling effect on both professors and students. While university management has a legitimate interest in ensuring professor attendance and competence, numerous alternative approaches exist, such as student feedback mechanisms. Judgments like Nowak, as previously mentioned, contribute to ensuring academic accountability. It’s unfortunate that this judgment didn’t seize the opportunity to directly affirm the importance of academic freedom as a cornerstone of democracy, rejecting attempts to silence dissenting opinions.

Barnard & Peers: chapter 9

JHA4: chapter II:7

Photo credit: ZDnet