Data leak used to select only Labour-voting public service job applicants

A database holding the massive breach of the details and political preferences of 337,384 voters from a company run by relatives of then-Labour Party President Stefan Zrinzo Azzopardi was used by ministries to select only Labour-leaning applicants for public calls for vacancies and at the exclusion of other candidates.

The massive data breach happened during Stefan Zrinzo Azzopardi’s time as party president between 2003 and 2013 and came from a company run and owned by his brother-in-law and in which his father was also involved.

From new information reaching The Shift since Sunday’s report that the minister’s father resigned from the company shortly after the scandal broke, it transpires that the database was used for even more nefarious purposes than merely gauging electoral sentiment.

Since Sunday, a number of sources with hands-on experience using the system have come forward to The Shift to explain how the database with the voting preferences of just about every voter in Malta was leveraged to ensure that only Labour Party supporters were recruited to the public service.

The system, The Shift is reliably informed, was used by the ministries and the public service across the board and was not limited to certain instances or for any particularly sensitive government job openings.

How it worked

The database was located at the Labour Party headquarters in Hamrun and it was not accessible remotely.

When a ministry would issue a public call for vacancies, a functionary would be sent to the Labour HQ with the shortlist of candidates to cross-reference the names with those on the database.

Voting preferences, The Shift is informed, were also clearly indicated: Labour voters were marked as ‘1’, Nationalist Party voters were marked as ‘2’ and those without a voting preference were marked as ‘0’.

Sources who have used the system for this exact purpose have told The Shift that when making the final selections to fill vacancies in the public sector, it was only the 1s who would be taken into consideration, in yet another reflection of the patron-client political system gone wild.

In other words, it was only the Labour Party-leaning applicants who would be chosen for final interviews and, consequently, for the job – irrespective of other candidates’ attributes such as experience, qualifications or aptitude for the position in question.

The Shift reported on Sunday how the father of former PL president and current Public Works and Planning Minister Stefan Zrinzo Azzopardi, Joseph Zrinzo, was also involved in C-Planet IT Services along with the minister’s brother-in-law Philip Farrugia but resigned from his position right after the electioneering data scandal broke.

Zrinzo had served as company secretary but resigned from the post after the political scandal broke and freedom of information requests on the company’s voter data breach were filed in April 2020.

Farrugia assumed Zrinzo’s position upon his exit from the scandal-tainted company and remains the company’s sole shareholder and director.

Zrinzo’s resignation was filed at the Malta Business Registry on 23 December 2020 but was backdated to an effective date of 3 June 2020. The company had first been registered in June 2007.

The data breach involved a voter database that held personal information such as names, addresses and ID card details of almost the entire electorate.

Online monitoring service – Under The Breach – had first revealed the breach when it tweeted that data had been left exposed by a Maltese IT company.

The minister’s brother-in-law and company owner Philip Farrugia is a former production director at the Labour Party media company ONE Productions.

Soon after the story broke at the beginning of April 2020, freedom of information requests were filed, one by independent politician Arnold Cassola.

The IDPC ruling

Information and Data Protection Commissioner Ian Deguara last week settled the complaint and gave the company 20 days to release the information held on the complainant and to explain where the data had been sourced from.

Anything short of that and a “proportionate and dissuasive” fine would be issued, the Commissioner warned.

Cassola has since demanded an official apology from the Labour Party and for Zrinzo Azzopardi’s resignation over the affair: “Our political profiling was done when Zrinzo Azzopardi was the Labour Party President. The Labour Party must apologise and Zrinzo Azzopardi must resign.”

The company had refused Cassola’s freedom of information request by citing ongoing legal proceedings after NGO Repubblika, the Daphne Caruana Galizia Foundation and over 600 claimants initiated court proceedings into the March 2020 leak.

The company had refused the request by citing ongoing legal proceedings, as well as claiming it did not have access to the data at the time since it was in the possession of the police and the IDPC.

The IDPC, however, put paid to the excuse by saying the company “was processing the personal data pertaining to the complainant at the time of receipt of the request”.

The finding comes after Cassola reported the matter to the IDPC back in 2020.  In January 2022, the Commissioner found the company guilty and fined it €65,000, the largest IDPC fine on record. The previous record was held by the €5,000 fine meted out to the Lands Authority.