A tribunal has ruled that HSBC Bank breached the data protection rights of one of its employees by sharing sensitive information without the worker’s consent.
The incident happened in April 2016 when the bank notified the Malta Union of Bank Employees that one of its members had been suspended for disciplinary reasons.
Tthe aggrieved employee, who since then has joined another union – the Independent Bankers Union which was set up in 2017 – had sought redress before the Data Protection Commissioner. However, in September 2016, the commissioner dismissed his complaint saying no violation of the Data Protection Act had been committed.
Nonetheless, the employee challenged the ruling and the commissioner’s decision was eventually revoked by the Data Protection Appeals Tribunal.
It transpired that the plaintiff was covered by the bank’s collective agreement under the clerical and managerial category.
He had felt aggrieved by an e-mail sent by MUBE president William Portelli on April 11, 2016, to 10 recipients.
A big win for HSBC employees
In the correspondence, Mr Portelli remarked that the human resources department had “confirmed that a member of the union had been suspended”. This was further corroborated by a bank official who testified that HSBC had notified MUBE about the suspension, in line with standard practice which had been in place for years.
Though Mr Portelli had not been mentioned by name in this e-mail, the tribunal ruled that it was convinced that the correspondence was referring to the employee in question.
Citing European case law, it remarked that the subject was easily identifiable under the circumstances and that the fact that the plaintiff was not named did not protect his anonymity.
The tribunal also ruled that the nature of the information at the heart of the case was of a sensitive nature in line with the parameters established by the Data Protection Act.
Moreover, from the proceedings it transpired that the bank had shared such information without his consent.
In view of this, the tribunal, presided by Dr Anna Mallia and Charles Cassar, upheld the appeal and revoked the decision of the Data Protection Commissioner.
Consequently, the tribunal referred the matter back to the commissioner to be reconsidered again in light of this decision.
Legal procurator and IBU president Mark Muscat appeared for the employee.
In a statement, IBU described this development as a big win for HSBC employees, saying it elevated the status of workers’ data protections rights above partisan interests and organisational practices.
The union said it expected the bank to take action against the bank’s CEO Andrew Beane who “admitted partaking in such illegal disclosure which brought disrepute to the bank”.