Bank of Valletta challenged by director over data protection breach

An elected Bank of Valletta director is being pressured to give up court action he recently filed, after a data protection complaint against the bank.

The action was filed by James Grech, a former worker-director who has since 2015 been regularly returned to the board by shareholders. It concerns irregular handling of his individual assessment as director.

But Grech, who unsuccessfully contested the 2019 MEP election and 2022 general election with the Labour Party, was recently told by BOV chairman Gordon Cordina to “remedy” his conflict with the bank after his privacy complaint was not upheld by the Information & Data Protection Commissioner. Only one of his five points of contention were upheld, for which the bank was reprimanded.

The matter is still under appeal before the IDPC Appeals Board, while Grech – the longest-serving director on the BOV Board – is now pursuing legal action against the bank in the Maltese courts.

Draft assessment ‘emailed’ to ECB

Grech contends that an assessment of his directorship by external consultants Promontory in November 2019, was shared with the European Central Bank by former CEO Rick Hunkin without passing through the bank’s normal channels of reporting.

It was only through official data requests in 2022 that Grech found out that his somewhat negative individual assessment had been shared with the financial regulator MFSA and the ECB as early as December 2019, barely weeks after the interview.

And yet the Promontory assessments were later discarded by the bank.

But the upshot of this unorthodox sharing of his data could have been to undermine his prospects of being returned to the board. Grech believes this was clear enough when former bank chairman Deo Scerri informally told him, right after the Promontory interview, that he should not run for the directorship again due to “a lack of favour” from the regulators.

Grech said this advice was immediately contrasted by his green-lighting from the regulators in December 2019 for his re-election to director by shareholders in the previous AGM.

But right up till 2022, the bank denied having sent his individual assessment to the ECB.

Grech only received an official copy of the assessment in November 2021, after filing his data protection complaint with the IDPC, and a full six months since filing a data subject request with the bank.

Hunkin resigned in October 2022 shortly after his appointment as CEO for a transition period in 2020, and was paid over €380,000 in his final year of service.

That same year, Grech learnt through his own official data requests to the ECB and the MFSA that they had received his individual report in December 2019, just weeks after his Promontory interview.

Grech accused the bank of dissembling on Hunkin’s actions, accusing the acting CEO of breaching internal policies, since the practice was that directors’ individual reports are merged into a collective report.

And it was only after Grech’s IDPC complaint, that BOV conceded that this disclosure had occurred outside of its “normal channels of reporting as the report was only available to a limited number of persons within the bank on a strict need-to-know basis.”

Court action against BOV

Grech’s complaint to the IDPC was not upheld, after BOV directors submitted affidavits confirming they were aware that their individual assessments would be shared with the ECB and the Maltese financial regulator, the MFSA.

Grech has now lodged an appeal to the IDPC Appeals Board, and is challenging the bank in a separate court action over Hunkin’s dispatch of his individual assessmenet to the ECB: Grech contends that while the ECB is entitled to ask for his individual assessment, it was only once they had received the collective report which, it turns out, was only finalised years later because the original Promontory assessments were not even taken on board by BOV.

Grech insists that BOV had processed his individual assessment with third parties, despite denying the claims, and that Hunkin’s actions were carried out “for motives that were irrelevant to the exercise underwary, based on a misinterpretation of laws and industry practices.”

Grech was in the process threatened with disciplinary action for pursuing his IDPC complaint.

In June 2023, he filed for damages, asking the law courts to find BOV responsible for breaching its internal policies, and appoint a court expert to examine whether the bank broke its fiduciary duties. In its reply of 9 June, BOV said that Hunkin’s decision to send the individual report to the ECB was “to show that the bank was taking the necessary steps in taking measures” related to directors’ assessments.

Two weeks later, BOV informed Grech that his court action was creating reputational costs for the bank, accusing him of having a conflict of interest and making fellow board directors uncomfortable about holding “a frank and open debate about certain matters”.

The case continues.