Privacy and data protection in universities: recent ECJ and ECtHR rulings

Professor Steve Peers, University of Essex

Privacy and data protection are different legal concepts, derived from different legal instruments, applied by different courts at European level. But the two concepts often overlap, and the relevant courts (the ECJ, interpreting the EU data protection Directive and other relevant EU laws, and the European Court of Human Rights, interpreting the right to privacy in the ECHR) sometimes make reference to the other’s case law and legal texts.

In the last month, each court has given a ruling on the respective rights in the context of universities or other academic institutions. This is a good opportunity to contrast the two courts’ different approaches in comparable cases, and to draw broader conclusions about the importance of these rights in the context of education.

Students and exam scripts: the Nowak case

In today’s judgment in Nowak, the ECJ ruled on the application of the EU’s current data protection Directive to exam scripts. The Directive will be replaced by the General Data Protection Regulation – the ‘GDPR’ – from next May, but the outcome of this judgment would likely be the same under the Regulation, especially since (as noted below) the Court makes some mention of the GDPR already in this judgment. 

Mr Nowak is a trainee accountant in Ireland who failed a crucial exam four times. He applied for all personal data held on him by the Institute of Chartered Accountants of Ireland, but it refused to send him a copy of the exam script. He complained to the Irish data protection supervisory authority, but it ruled that exam scripts were not personal data; moreover his complaint was vexatious. He challenged the authority through four levels of Irish courts, losing at every stage until the Supreme Court ruled that his complaint was inadmissible. But since that Court was uncertain as to whether exam scripts were personal data, it decided to ask the Court of Justice to interpret the relevant EU law.

The ECJ began its ruling by applying the Directive’s definition that ‘personal data’ is ‘any information’ relating to an identified or identifiable person. A student is either identified by name or necessarily identifiable via an examination number. (It’s fortunate that the Court confirmed the latter point, since I’ve used it in classes for years as an example of when an individual is ‘identifiable’).

According to the Court, it’s not relevant whether the examiner can identify the person at the time of marking, and it’s possible for the means of identification to be split up between different people, because the administrative staff will match the exam marks to each student later. This confirms the practice of anonymous marking – as well as many other aspects of life where registration numbers are used when processing data to preserve confidentiality.

But is the exam script (and the examiner’s comments on it) information relating to such a person? The Court reiterates that the Directive has a wide scope in general, and then confirms that the notion of ‘any information’ has a wide scope in particular: ‘not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions or assessments, providing that it ‘relates’ to the data subject’.

Applying that definition, exam candidates’ answers are linked to them personally, since they show (among other things) each candidate’s intellect, knowledge and judgment. The purpose of collecting the answers is to assess the candidate’s abilities and suitability, and the use of the answers can affect the candidate’s rights or interests, for instance to access a profession. All this is equally true if (as in this case) the exam is open book.

More significantly for academics, comments on the exam are also personal data. They constitute an opinion relating to the candidate, in particular an evaluation of the candidate’s abilities, and have an effect upon that candidate. It doesn’t matter that these comments are also personal data relating to the examiner, since information can constitute personal data relating to more than one person.

Nor does it matter that the rules on access and rectification of the data apply, once information is defined as ‘personal data’. The Court anxiously points out that rectification can’t mean that an exam candidate can alter incorrect exam answers, since the right to rectify is linked to the purpose why the data was collected – in this case, to assess the candidate’s abilities. What could be rectified is errors like a missing cover sheet, or one candidate’s exam script being confused with another candidate’s script. Moreover, exam sheets might have to be destroyed once they are no longer relevant, as a consequence of data protection law.

Furthermore the Court usefully points out that the candidate does not have a right to the exam questions (!) – presumably meaning access in advance of the exam – since those questions as such are not personal data in respect of the candidate.

The Court’s final – and very vague – point is that restrictions can be placed upon access to data, both under the Directive and (under more circumstances) the GDPR. Frankly, it’s not clear what point the judges are trying to make here, since this observation is not then applied to the facts of the case.

Comments

The practical outcome of the judgment is that markers of scripts will have to be careful what they write on them. Peevishly sniping “I’m sick of this student already” would be a bad idea; so would angrily scribbling “f*@! the Vice Chancellor!”. Rather the comments should relate to a fair assessment of the content of the script.

While some academics will be understandably concerned about their workload, there’s no reason why data protection law should impact on how detailed such comments should be – or indeed if there are any comments at all. That’s an issue for universities and other educational institutions to determine.  Having worked in a legal environment where exam scripts and comments are available to students for many years, in my experience at least there are no particular problems.

Data protection law judgments are often criticised for a lack of common sense, but there’s some sign of that uncommon commodity here: the Court rules out the obvious absurdities of students correcting an exam paper after it has been handed back, or having a right to advance knowledge of the exam questions. It does not mention some of the broader educational policy arguments for its judgment though: the accountability of markers to students, and the potential usefulness of comments on exam scripts as feedback for students, which is perhaps what the frustrated Mr Nowak was seeking here. Of course, the latter point is dependent on how detailed the comments are: the judgment does not rule out markers simply writing the infamous phrase "Good as far as it goes".

Privacy in lecture theatres: the Antovic and Mirkovic v Montenegro case

So professors must be accountable to students in the context of exam marking; but to what extent can their privacy be affected by attempts to make them accountable to university management? In this case, the Dean of the mathematics school in a university decided to start taping university lectures, for the twin reasons of protecting university property and ‘surveillance of teaching’.

It’s not known if professors responded by writing “f*@! the Dean!” on exam scripts. Rather more pragmatically, some of them complained to the data protection supervisory authority, which ruled, after initial hesitation, that the university had breached data protection law. (Comparing this to the Nowak case, it’s striking that the watchdog based outside the EU barked louder than the watchdog based inside it).

The professors then challenged the university in court for breaching their right to privacy as regards the period when the video surveillance was applied. They lost in the national court, so challenged the state before the European Court of Human Rights (ECtHR) instead.

The ECtHR ruled in the professors’ favour by a 4-3 margin, although on the crucial issue – whether a right to privacy even existed, and if so, why – they split three ways, with no one view commanding a majority. In light of this close result, it remains to be seen whether Montenegro might ask the ECtHR Grand Chamber to review this ruling.

All judges agreed that the key question was whether there was a ‘reasonable expectation of privacy’. In this case, the majority ruled that in light of previous ECtHR judgments (most notably the recent Barbulescu ruling on employer monitoring of employee Internet use, discussed here), such an expectation usually applied to workplace spaces.

That meant there was an interference with privacy rights, which could be justified under Article 8(2) ECHR if the interference was in accordance with the law and had a specified legitimate aim. Here the interference was not in accordance with the law, since the law did not lay down the possibility for surveillance of teaching and set a condition (which was not met here) that surveillance could be used for surveillance of property only if no other means was possible. So there was no need to assess whether a legitimate aim existed.

For two concurring judges, the conclusion that there was an interference with the right to privacy was correct, but should have been reached on other grounds. Rather than focus on the surveillance taking place in the workplace, the key issue should have been the activities being carried out. Lectures are an occasion to discuss ideas and interact with students, and formed part of the expression of academic freedom. (Note that the applicants did not argue a breach of Article 10 ECHR, setting out the freedom of expression).

For the dissenting judges, there was no interference with the right to privacy at all. The case law, in their view, only protected a reasonable expectation of privacy in some circumstances, which did not apply here in light of certain safeguards: there was no audiotape; the professors were not identifiable due to blurring of faces; and there was limited further use of the tapes.

Comments

The ECtHR did not discuss EU data protection law, but EU rules would likely have led to a comparable result (adapted to dats protection law), for yet another different set of reasons. In its judgment in Rynes (discussed here), the ECJ ruled that the data protection Directive applies to CCTV recordings unless they only record activities inside a home (the ‘household exception’ in the Directive). That would suggest that recordings of lecture theatres are covered by the Directive. The dissenting judges’ analysis of whether the professors were ‘identifiable’ seems, with respect, superficial in light of the Nowak judgment: was there really no way to deduce, in light of time stamps for instance, who would have been lecturing at that time?

Of the two lines of reasoning in the judgment supporting the application of the right to privacy, the concurring judges’ analysis is more convincing. ‘Surveillance of teaching’ is a notion that excites authoritarians in general, and hard Brexiteers in particular. Given that the exceptions to Article 8 ECHR can apply only if necessary in a ‘democratic society’, it makes sense to take account specifically of the importance of academic freedom when assessing whether the right to privacy has been interfered with – and more broadly of a worrying shift toward illiberal democracy in too many countries across Europe. It would also have been useful to state that ‘surveillance of teaching’ is not a legitimate ground for interference with the right to privacy.

Regardless of the safeguards in place, the announcement of an intention to place teaching under surveillance has a chilling effect on professors and students alike. While university management has a legitimate interest in ensuring that professors turn up to teach, and do so competently, there are many other routes to this end – student complaint or feedback procedures, for instance. Indeed, judgments like Nowak, as I noted already, help to ensure academics’ accountability to students. It’s unfortunate that this judgment missed the opportunity to directly confirm the importance of academic freedom as one of the pillars of democracy – rejecting the ever-louder screeching of those denouncing those with different opinions as ‘enemies of the people’.

Barnard & Peers: chapter 9

JHA4: chapter II:7

Photo credit: ZDnet