Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698143105941.pdf (Mauritius)
This is a summary of the decision of the Commissioner.
IN THE MATTER OF:- Complainant {Ex-employee of Respondent No.1} VERSUS Respondent No.1 {A company represented by its Human Resource Manager) Respondent No.2 {Employee of Respondent No.1} Respondent No.3 {Employee of Respondent No.1} Respondent No.4 {Employee of Respondent No.1} Respondent No.5 {Ex-Employee of Respondent No.1} Respondent No.6 {Employee of Respondent No.1} Respondent No.7 {Ex-Employee of Respondent No.1} Respondent No.8 {Employee of Respondent No.1} Respondent No.9 {Employee of Respondent No.1} The Data Protection Office received a complaint from Complainant for alleged unauthorised access and disclosure of personal data (retirement information) against Respondents Nos.
1 and 2.

This office opened an enquiry and contacted Respondent No.

1 for further clarifications on the allegations made by Complainant.

The Data Protection Office received the statement of rebuttal from Respondent No.

1 stating that: 1.

The complaint made by Complainant is believed to have been made with the sole objective of bringing the company into disrepute.

2.

Complainant might have provided information to Respondent No.

2 since both Complainant and Respondent No.


2 were friends and work colleagues.

3.

All personal data are kept securely at the company.

4.

The company is not in breach of any contractual agreement with Complainant.

5.

The company requests Complainant to provide proofs of the allegations made.

This Office contacted Respondent No.

2 and the latter stated that: 1.

He did not meet Complainant on the said date and time.

1 2.

Respondent No.1 has never disclosed Complainant’s information to him.
He is only aware that Complainant was fired from the company.

The Data Protection Office informed Complainant on the versions provided by Respondents Nos.

1 and 2.

Complainant was requested to provide this office with concrete evidence to enable this office to take a further stand on the enquiry.

Complainant replied to the above, however, no concrete evidence was provided.

Complainant also made mention of Respondents No.

3-9 in the reply.
3-9 in the reply.

The Data Protection Office wrote to Complainant to clarify the allegations under the Data Protection Act against Respondents No.

3-9.

This office also sought the contact details of Respondents No.

3-9 from Respondent No 1.

By way of letter, Complainant replied to this office on two occasions and after an analysis of the letters submitted by Complainant, it was observed that Complainant had stated how Respondents No.

3-9 were aware of the data.


This office, therefore, contacted Respondent No.

1 to confirm whether Respondents Nos.

3-9 were acting within their mandate regarding Complainant’s data.

Respondent No.

1 replied this office and informed that Respondents Nos.

3-9 were employees of the company and if any of them had handled the personal file of Complainant, it was in the course of their duties.

With the help of police, this office tried to get the contact details of Respondent No.
5, however, no information was retrieved.

Statements from Respondents Nos.

3, 4, 6, 7, 8 and 9 were collected where all Respondents informed that they had not disclosed Complainant’s personal data to Respondent No.

2.
2.

The Data Protection Commissioner decided as follows:- There is no evidence on record to suggest that the personal information belonging to Complainant, namely the retirement pension documents, have been unlawfully disclosed to parties not entitled to receive the information by management in contravention of section 29 of the Data Protection Act.
This office has carefully examined the various statements recorded from the parties concerned to this case and has found no evidence of bad faith regarding the unlawful handling of the information related to Complainant’s pension rights.

Thus, the enquiry is closed.

2