C-Planet indicated Untours as source of leaked voter database, Data Protection Commissioner testifies

C-Planet, the IT company being sued by hundreds of individuals over the online leak of a database containing the personal information of nearly every individual Maltese voter, has pointed at travel agency Untours as the source of their data, a court has been told.

Information and Data Protection Commissioner Ian Deguara took the stand this afternoon, as Mr Justice Francesco Depasquale continued to hear evidence in the collective court action filed against C-Planet Solutions Ltd, by hundreds of claimants, assisted by the Daphne Caruana Galizia Foundation and Repubblika.

The court is being requested to quantify and award damages to the claimants over breaches of personal data protected under the General Data Protection Regulations (GDPR).

The case’s origins date back to the end of March 2020, when it was reported that a database containing 337,384 records of Maltese voters’ personal information had been freely accessible online for at least a year. This data, which included names, addresses, ID card details, dates of birth, fixed and mobile phone numbers as well as a reference to political orientation or voting preferences, was allegedly left exposed by C-Planet on the internet.

C-Planet is owned by Philip Farrugia, a former manager at One Productions and brother in law to Labour Party MP and former Labour Party president Stefan Zrinzo Azzopardi.

In court today, Deguara stated C-Planet had indicated Untours, a travel agency which is owned by the General Workers Union, to him as the source of the database on every registered voter in Malta. The data includes phone numbers and information on the data subject’s political leanings.

Untours had "categorically" denied to the IDPC that they were the source.

Cross-examined by lawyer Antonio Ghio, representing the plaintiffs together with lawyers Sarah Cannataci, Deo Falzon and Michael Zammit Maempel, in the collective action, Deguara was asked whether the IDPC had investigated the Labour Party, after news articles indicated that the data had originated from a Labour Party system called "Local Area Network." The Commissioner replied that his office had not.

Lawyer Franco Galea, appearing for C-Planet, asked that the data be exhibited in the acts of the case before the next sitting, also requesting the court to ban the publication of any documents filed in the acts of this case. 

The case was adjourned to 10 May for Deguara to continue testifying and further submissions by the applicants.