Zrinzo Azzopardi’s resignation, Labour apology demanded after IDPC ruling

Independent politician Arnold Cassola has demanded an official apology from the Labour Party and for the resignation of Minister Stefan Zrinzo Azzopardi in the wake of an Information and Data Protection Commissioner ruling on C-Planet IT Services.

The company was involved in a data breach that exposed the personal data of 337,384 voters.

In a ruling, Information and Data Protection Commissioner Ian Deguara gave the company 20 days to release the information held on one complainant and to explain where the data had been sourced from, short of which a “proportionate and dissuasive” fine would be issued.

The finding comes after Cassola reported the matter to the IDPC back in 2021.  In January 2022, the Commissioner found the company guilty and fined it €65,000.

The leak held a voter database that contained personal information such as names, addresses and ID card details of more than 337,000 Maltese citizens – some 75% of Malta’s population.

The data also included indicators as to whether individuals were more inclined to vote for the Labour or the Nationalist Party.

Moreover, the monitoring service that revealed the leak had said the data was available for everyone to access freely without the need for a password or identification.

At €65,000, it was the largest IDPC fine on record, with the previous record having been held by the €5,000 fine meted out to the Lands Authority.

‘Zrinzo Azzopardi must resign’

The company in question is owned by Philip Farrugia, a former production director at the Labour Party media, ONE Productions. He is also the brother-in-law of Minister Stefan Zrinzo Azzopardi.

“Our political profiling was done when Zrinzo Azzopardi was the Labour Party President,” Cassola said this morning of the ruling. Zrinzo Azzopardi was PL president between 2003 and 2013.

“The Labour Party must apologise and Zrinzo Azzopardi must resign.”

The company had refused Cassola’s freedom of information request by citing ongoing legal proceedings after NGO Repubblika, the Daphne Caruana Galizia Foundation and over 600 claimants initiated court proceedings into the March 2020 leak.

The company had refused the request, citing ongoing legal proceedings, as well as claiming it did not have access to the data at the time since it was in the possession of the police and the IDPC.

The IDPC, however, put paid to the excuse by saying the company “was processing the personal data pertaining to the complainant at the time of receipt of the request”.

Nor did the IDPC find any validity to the company’s claim that court proceedings could stand to be jeopardised if the information was released, finding that, “A mere reference to an existing investigation… is certainly not sufficient to restrict the fundamental right of the complainant.”