Court of Appeal reaffirms MFSA liability in data leak case, orders regulator to shoulder costs

The Court of Appeal has affirmed that the Malta Financial Services Authority (MFSA) bears liability for an unauthorised disclosure of confidential data to the investigative website OffshoreAlert, according to Malta Today. The judgment, delivered on 12 November 2025, builds on an earlier May 2024 ruling that the MFSA was responsible for leaking information about the licence cancellation of E&S Consultancy Ltd before notifying the company and its directors, Christian Ellul and Karl Schranz.

In the renewed appeal, the MFSA argued that the Information and Data Protection Appeals Tribunal had acted ultra vires and relied on a forensic expert who exceeded his remit, and that the alleged disclosure did not amount to a “personal data breach” within the meaning of EU Regulation. The article notes that the reporting does not indicate what costs or penalties the regulator must pay.

The decision marks another development in Malta’s ongoing debate over accountability and data protection standards within its financial regulator, as reported on DataBreaches[.]Net on 12 November 2025.