A photovoltaic panel supplier was right not to give out the names of all its clients, according to the Data Protection Commissioner.
Di Natura was struck off the approval list of the Chamber for Small and Medium Enterprises – GRTU in November after refusing to comply with its request.
Clients of GRTU-approved retailers can take out a Bank of Valletta loan to pay the rest of the capital cost over a three-year period, with the retailers paying all interest and charges.
But the GRTU fell out with Di Natura after saying to get this approval, the firm needed to reveal all its clients, including those who did not use the PV panel subsidy scheme.
Di Natura managing director Godfrey Formosa filed a complaint with the Data Protection Office claiming that supplying this information was in breach of the Data Protection Act.
In his ruling, the Data Protection Commissioner said Di Natura had been justified in not disclosing the information in respect of clients who had not made use of the approved scheme.
To protect customers and EU funds, companies in the scheme must submit a weekly report with a full list of clients
Moreover, it said that the GRTU did not have regulatory powers to require the production of personal data.
In November, Noel Gauci, president of the GRTU’s renewable energy section, had told Times of Malta that only retailers who abided by terms that lead to higher quality, safety and customer care were put on the approval list.
“To ensure customers and the EU funds are protected, companies in the scheme must submit a weekly report with a full list of clients so that their systems may be inspected to ensure fair quoting, invoicing and installation practices. An agreement to this effect was signed,” Mr Gauci said.
The agreement was also among the documents submitted to the Data Protection Commissioner during his investigation of the case but he ruled that this private contract “did not constitute a legal basis in terms of which the company is bound to release personal details on its clients to the GRTU”.
According to the commissioner, the disclosure of personal data on clients who had not applied and benefited from the scheme “shall only be legitimised with their informed and unambiguous consent”.