Unsolicited emails sent by the Labour Party were in breach of the data protection law but no fine has been imposed, the Data Protection Commissioner ruled.

The Commissioner, Joseph Ebejer, received three complaints from individuals who claimed that their data protection rights had been violated.

The individuals – Prof. Arnold Cassola, Alfred Mangion and a third unknown individual - alleged that they had neither subscribed to receive similar communications from PL, nor they had any contact with that political party. The email communication was sent from the address [email protected] and contained a newsletter of a political nature. The complainants claimed that PL had acquired and used their respective email address to send unsolicited communication, in breach of the Data Protection Act (Cap 440).

In one of the complaints, the data subject alleged that PL had acquired the whole database of University's email addresses and was sending out political propaganda at regular intervals.

By means of three separate letters addressed to PL President Stefan Zrinzo Azzopardi, the Data Protection Office notified PL about the receipt of such complaints and requested its reply.

In view of the fact that a decision against the PL on a similar complaint was still under appeal, proceedings on these three complaints were put on hold until the Information and Data Protection Appeals Tribunal ruled in favour of the Commissioner's decision on 23 November 2012.

Following the Tribunal's decision, the Commissioner proceeded with the evaluation of these cases and invited PL to make their submissions. A meeting was also held with PL on 31 January 2013. After various reminders, the Commissioner established the 22 February as the final deadline for submissions by the PL.

PL made official submissions by means of a letter dated 21 February. In this letter, PL specified that following the recent judgement of the Appeals Tribunal, they had embarked on an extensive project in order to ensure, as much as possible, compliance with the provisions of the law. It was further submitted that better systems were introduced in order to record consent of data subjects for future reference. In addition, the email addresses of these three complainants have been deleted from the PL's database.

On the specific allegation made by one complainant that PL had acquired the whole database of University email addresses, PL categorically denied said allegation.

The commissioner ruled that the PL did not provide any documented evidence proving that the email addresses pertaining to the complainants were obtained with their consent or as part of their involvement with the political party, any of it officials or staff;

The PL was also unable to provide specific indications on how such email addresses were obtained;

From the complaints received and the subsequent investigation, this Office could not delineate a specific pattern to demonstrate that the University's database had been acquired and used to send unsolicited communications.

The law lays down that the sending of electronic communications advancing political ideas is only allowed subject to the prior consent of the individual or if the political party had obtained the contact details in a previous political or similar activity.

The interpretation that the above legal provisions also apply to electronic communications advancing political propaganda was confirmed by the Information and Data Protection Appeals Tribunal, in its decision of 23 November 2012.

PL failed to demonstrate that such email communications were in compliance with the aforementioned provisions, the commissioner ruled.

In his decision, the commissioner said that the sending of such email communication was in breach of S.L. 440.01 established under the Data Protection Act (Chapter 440 of the Laws of Malta).

Since the unsolicited messages concerning these complaints were sent before the Commissioner's decision, intimating the imposition of an administrative fine, could not have been received by the PL, the Commissioner did not impose an administrative fine in these three cases. This notwithstanding, in terms of Article 40(i) of the Act, the Commissioner admonishes PL and advises that any similar violation, will attract an administrative fine in exercise of his powers under the Regulation 13 of S.L.440.01 which apply in this case.

Additionally, in terms of Article 40(c) of the Act, the Commissioner re-iterates that PL should take the necessary measures to ensure that all email addresses in their database comply with the requirements of Regulation 9 of S.L.440.01. In particular, PL should eventually be in a position to confirm that such contacts for electronic communications are supported by documented evidence proving that they have been obtained either with the informed consent of individuals or as part of a previous activity organised by the party.

The Commissioner intends to carry out onsite inspections in future, in order to ascertain that similar practices are in place.