Controversial hire-purchase business No Deposit Cars has been ordered to delete the personal information from a video, nine months after it was first published.
The firm, owned by alleged kidnapper Christian Borg, was found guilty of breaching data protection laws when it posted a video online last April giving details of clients who took legal action against it.
In his ruling, dated January 15, the Information and Data Protection Commissioner Ian Deguara let the company off with a reprimand but ordered it to delete the clients’ personal information. Failure to comply will result in an administrative fine, Deguara ruled.
The now-deleted social media video singled out three of its clients who are amongst a group of 26 who were calling for an investigation into the business for tax evasion and fraud.
It named one customer it said had failed to keep up to date with his repayments and included his photo, named another who it said had “wrecked” a Peugeot 208, and published details of traffic fines incurred by a third named customer, along with an ID card number and number plate.
Later that day it was replaced by an amended version that did not include the first client's photo and also obscured the ID card number listed along with the list of fines.
Clients' names were kept in the new video, which has since been removed completely.
The video targeted the customers’ lawyer Jason Azzopardi after he filed a judicial protest against No Deposit Cars Malta, its parent company Princess Holdings and Borg, requesting a police investigation into the company’s activities and for their contracts to be rescinded. He was acting on behalf of 26 of the company's clients.
No Deposit Cars Malta told the data protection office that the video was in response to the judicial protest which “was either leaked to the media or the media was tipped-off” about it.
It said that although these documents are publicly available, the media couldn't get to know about all acts presented in court.
The company also singled out Times of Malta for publishing a story on the judicial protest on the same day as it was filed. It said it became aware of the protest through the published article and before it was formally notified about it on April 6.
It said this led it to conclude that the customers’ data was already made public through the publication of the protest.
No Deposit Cars said that since court documents are easily accessible by any member of the public through the court registry, the information contained in the judicial protest was not confidential and therefore cannot be interpreted as a breach of data protection laws.
But data commissioner Deguara ruled on Monday that the company had breached data protection rules by including the personal details in its video and gave the company 20 days to remove any personal data of the three individuals singled out as well as the details of all those who feature in the judicial protest.
The Commissioner ordered that should this not be possible, the video is to be taken down in its entirety.
Deguara warned that failure to comply with the order would result in the imposition of an administrative fine which can reach €20 million.
Times of Malta previously reported that the hire-purchase company makes customers sign contracts accepting that their car may have a GPS tracking device installed.
That revelation was condemned by the data protection commissioner, who said data tracking clauses in contracts issued by No Deposit Cars were “absolutely abnormal... not acceptable... [and] very invasive”, and a request for the consumer affairs authority to investigate the company.