C-Planet fined €65,000 for voter data breach

C-Planet IT Solutions Ltd, the company that infamously hit the headlines in April 2020 after a massive leak of personal information – including voting preferences – of over 330,000 Maltese citizens, has been fined €65,000, The Daphne Caruana Galizia Foundation announced on Monday.

The Foundation said it was notified by the Information and Data Protection Commissioner (IDPC) about the €65,000 fine for the data breach they had reported in April 2020 and noted how, prior to this, the highest fine handed out was €5,000 to the Lands Authority. 

“Considering the gravity of the breach, the fine might seem low in absolute terms, but according to the IDPC it is proportionate to the company’s annual turnover and small number of employees,” the Foundation said in a statement on Facebook.

The leak held a voter database that contained personal information such as names, addresses and ID card details of more than 337,000 Maltese citizens – some 75% of Malta’s population. The data also included indicators as to whether individuals were more inclined to vote for the Labour or the Nationalist Party. Moreover, the monitoring service that revealed the leak had said the data was available for everyone to access without the need for a password or identification.

The company in question is owned by Philip Farrugia, a former production director at the Labour Party media, One Productions. He is also the brother-in-law of Parliamentary Secretary for EU funds Stefan Zrinzo Azzopardi.

Following the leak, the Foundation, together with Repubblika, launched a joint legal initiative for those whose personal data was revealed through the data leak from the servers of the company C-Planet Solutions Ltd. Over 620 claimants had applied to participate in the collective action.

The Shift had revealed that, ARMS Ltd had also awarded a direct order to C-Planet for “professional services” but refused to divulge information on the nature and level of security of services when questioned.