Testifying in court today, Philip Farrugia, Managing Director of IT company C-Planet, said it had been Ivan Buttigieg who had given his company a pen drive that included the electoral register and data of how every individual was expected to vote in the general election.
Farrugia said that at the time when the data was handed over to them, Ivan Buttigieg was “an employee” of the General Workers’ Union’s insurance subsidiary Untours.
Philip Farrugia was testifying today in the case brought against C-Planet by the Daphne Caruana Galizia Foundation and Repubblika after a security breach in their servers leaked a database of voters in Malta, each one tagged with how they are expected to vote in the general election.
In the database Ivan Buttigieg is marked as likely to vote for the Labour Party.
The C-Planet director, himself a former employee of the Labour Party, was answering questions by lawyer Antonio Ghio appearing for the two NGOs who asked Philip Farrugia to comment on findings by the Information and Data Protection Commission which reported last February that C-Planet management and staff had insisted the database of expected voting intentions originated from outside their company.
C-Planet said it was given the data by one of its clients, GWU-owned Untours.
Philip Farrugia said that he had done IT work for Untours since the early 2000s but it was in 2012 that the GWU company hired him to design an insurance management software that would harmonise addresses of their clients. Farrugia said that Ivan Buttigieg had given C-Planet the database he believed to be the electoral register for this purpose.
Philip Farrugia also acknowledged another finding by the Commissioner that the database from Untours was subsequently used for other C-Planet clients, though Farrugia insisted that had only happened with one client while the IDPC report referred to “several” cases.
C-Planet has already been fined €65,000 by the Commissioner for failing to prevent the data leak. That decision has been appealed and the appeal is ongoing.
The court today, presided by Judge Francesco Depasquale, also heard from Data Protection Commissioner Ian Deguara who clarified he never asked Untours who the employee in their office had been who had given the data to C-Planet. Indeed, Untours denied the data had ever been theirs at all.
Commissioner Deguara explained that it was not his office’s competence to investigate crimes but merely to take action when people or organisations that control data do not take the precautions required by the law to protect data from leaking. Commissioner Deguara confirmed, however, that a police investigation and a magisterial inquiry into the case are ongoing.
Philip Farrugia’s evidence today was the first time a name was openly identified as a possible source of the database of voter intentions.
When the case was first filed in 2020, the Labour Party distanced itself from the data breach. However, evidence given in court now points to a Labour Party official as the source of the data.
At the conclusion of today’s sitting, C-Planet’s lawyer Franco Galea, asked the court to ban the publication of the name of Ivan Buttigieg in view of the ongoing police criminal investigation. Judge Depasquale denied the request commenting that the ongoing court case was a separate matter. In any case, Judge Depasquale commented, it would be surprising if the police hadn’t yet spoken to Ivan Buttigieg in view of the evidence. He then went on to say that nothing surprises him anymore.
The case continues.