C-Planet – Complaint Upheld (Malta, 2023)

In April 2020, after being notified by the IT company C-Planet (the controller), the Maltese DPA opened an ex officio investigation into the a personal data breach of approximately 335,000 eligible voters on the island. That same year, noyb filed a complaint on behalf of several data subjects affected by the data breach (CDP/DBN/31/2020). Following this complaint, the DPA ruled that C-Planet, in its capacity as controller, infringed several provisions of the GDPR. In particular, the DPA found that: a) the processing of personal data, including special categories, lacked a legal basis, in breach of Articles 6(1) and 9(1) GDPR; b) the controller failed to adequately inform data subjects about the processing of their data, in violation of Article 14 GDPR; c) the controller failed to notify the DPA within 72 hours, in violation of Articles 33; d) the controller failed to implement sufficient technical and organisational measures to ensure a level of security appropriate to the risks involved, violating Article 32 GDPR. In January 2022, noyb, on behalf of a data subject, request access to personal data, asking the controller to inform what personal data it held and what was the source of these data, pursuant to Article 15(1)(g) GDPR. In response, the controller stated that it was no longer in possession of the leaked data, which was now with the Maltese Police and DPA. Furthermore, it invoked Article 23 GDPR to limit the data subject's right to access on the grounds that there was an ongoing criminal investigation and civil action. In April 2022, noyb filed the present complaint (COMP/138/2022), claiming that the controller refused to inform that data subject about the source of the data it processed without having collected it directly from them. According to noyb, the controller violated Article 15 GDPR. In the procedure before the DPA, the controller maintained its position. Initially, the DPA emphasized that it had already been well established in its previous d