DPA case CDP/54/2023 (organisation) – Order (Malta, 2024)

On 15 January 2024 Malta’s Information and Data Protection Commissioner issued CDP/54/2023 against an anonymised organisation that had posted a public Facebook video containing the names and identity-card numbers of 26 people from a judicial protest and additional information singling out three of them. The controller argued that the judicial protest and news reporting were already public. The Commissioner rejected public availability as a blanket permission for further disclosure and found an Article 6(1) GDPR infringement because no lawful basis for this processing had been demonstrated. The decision issued a reprimand under Article 58(2)(b) and ordered removal of all the personal information about the three singled-out people and the names and identity-card numbers from the protest. If that editing was impossible, the video had to be removed in full. The order applied to every platform on which the controller had published or shared it, with compliance and evidence required within 20 days of receipt. The reasoning also discusses accountability, Article 14(2)(f) information about data sources and national identity-number safeguards under Article 8 of Malta’s Data Protection Act; the operative infringement finding is Article 6(1). No administrative fine was imposed by this decision: a fine for future non-compliance is conditional. The exact date appears on page 1 of the original letter; neither the case-number year nor the PDF creation date is substituted. No later appeal or finality is established.