MFSA responsible for data leak, appeals court confirms

An appeals court has confirmed a decision by the data protection appeals tribunal holding the Malta Financial Services Authority responsible for a data leak pertaining to a confidential regulatory decision it had taken.

Lawyer Christian Ellul and accountant Karl Schranz had filed a complaint with the data protection commissioner, alleging that the MFSA had leaked sensitive information regarding confidential decisions it had taken against them.

They claimed that personal data and information regarding the decisions had been leaked to a journalist from the ‘Offshore Alert’ website before such information had even been published by the authority itself and communicated to the persons concerned.

Although the commissioner found no breach of the relevant regulation, an appeal was filed before the data protection appeals tribunal.

At this juncture, the tribunal considered a report produced by a digital forensic expert which provided that the authority decision had been published on the ‘Offshore Alert’ before it was even communicated.

It was concluded that this confidential data had been published by the website before being officially published by the MFSA, when the latter was  supposed to be responsible for this disclosure.

Both the data protection commissioner and the MFSA lodged an appeal. The commissioner argued that the tribunal decision should be overturned inasmuch as it had not abided by the parameters of the original complaint.

The MFSA, in its own appeal, agreed with the submissions raised by the Commissioner and emphasised upon various points including that there had been a manifest error in the conclusions of the expert. The authority said that the tribunal went beyond its sole administrative role. 

On 5 February, the court of appeal, presided over by Mr Justice Lawrence Mintoff, rejected the arguments put forward by the commissioner and MFSA.

It upheld that although the original article did not appear on the website given that it had seemingly been deleted or unable to be tracked, the expert was correct in investigating further, with these investigations ultimately leading to the original article and its publication date.

The court also said it expected the expert analysis to be carried out by the commissioner himself, rather than relying on declarations made by third parties.

The tribunal decision was confirmed in its entirety.

A separate appeal lodged by the MFSA was declared time-barred and null.

Ellul and Schranz were represented by lawyers Jacob Daniel Portelli, Vincent Micallef and Stephanie Abela.