The Court of Appeal has upheld a decision that found HSBC guilty of leaking unauthorised data of one of its employees, after the bank notified the Malta Union of Bank Employees that one of its members had been suspended for disciplinary reasons in 2016.
The aggrieved employee had originally filed a complaint with the Data Protection Commissioner to seek redress, but in September 2016, the commissioner dismissed the complaint saying that no breach of the Data Protection Act had occurred.
The employee, who had since joined the Independent Banker’s Union, challenged the commissioner’s ruling and the decision was eventually revoked by the Data Protection Appeals Tribunal.
The plaintiff had felt aggrieved by an email in which MUBE president William Portelli told 10 recipients that a member of the union had been suspended.
This was further corroborated by a bank official who testified that HSBC had notified MUBE about the suspension, in line with standard practice which had been in place for years.
Although the plaintiff had not been mentioned by name, the tribunal ruled that the correspondence was referring to him and that given the circumstances, the employee was easily identifiable despite not having been named.
Mr Justice Lawrence Mintoff ruled that the bank had passed on personal data when it informed MUBE without the employee’s consent, adding that any processing or disclosure of sensitive information without his consent amounted to illegal processing.
Moreover, the collective agreement signed with MUBE, to which the plaintiff was a signatory of, prohibited the disclosure of such information. This contradicted testimony by bank officials and MUBE, who claimed that it was standard practice for the union to be informed about the suspension of employees.
The court dismissed HSBC’s appeal and ordered that the acts of the case be returned to the Data Protection Commissioner to decide on the kind of sanction that should be imposed on the bank.
Lawyer and IBU President Mark Muscat appeared for the plaintiff.
In a statement IBU welcomed the decision, hailing it a “great victory to safeguard the privacy rights of workers”.
“It is a shame that the president of the MUBE William Portelli and the then HSBC Chief Executive Andrew Beane colluded with each other in blatant breach of the collective agreement and the fiduciary obligations they have towards their employees and members.”