The Court of Appeal has upheld a decision which found that HSBC passed on unauthorised information of one of its employees to the Malta Union of Bank employees.

The person in question had filed a complaint with the Data Protection Commissioner, who found no evidence that some form of illegal divulgence of information, and could not conclude that the data protection law was breached.

The man then filed an appeal before a tribunal. The tribunal overturned the Commissioner’s decision and referred the item back to the commissioner with orders to reconsider the issue from the start taking into consideration what it had considered. While the man had not been mentioned by name, the tribunal found that the correspondence was indeed referring to him and that he was easily identifiable. 

The bank then filed an appeal before the Court of Appeal. The Court, however, agreed with the tribunal’s decision when concluding that there was an exchange of information or personal details between the bank and MUBE, and this exchange led to the person in question being identified, in the circumstances that there was no other bank official who was suspended from employment at the time.

The court dismissed the bank’s appeal and ordered the acts of the case to be returned to the Data Protection Commissioner to take a decision based on the results of the tribunal and the court.