[co-author: Karl Sammut, Sammut Legal]

Malta

In this chapter:

Q1/ Applicable legislation

(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?

New legislation has been passed.

———

(b) Relevant legislation includes:

• CAP 586 (the “Data Protection Act”)
  • Date in force: 28 May 2018
  • Link: see here
• SL 586.08 Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations
  • Date in force: 28 May 2018
  • Link: see here
• SL 586.09 Restriction of the Data Protection (Obligations and Rights) Regulations
  • Date in force: 1 June 2018
  • Link: see here
• SL 586.10 Processing of Data concerning Health for Insurance Purposes Regulations
  • Date in force: 1 June 2018
  • Link: see here
• SL 586.11 Processing of Child’s Personal Data in Relation to the Offer of Information Society Services Regulations
  • Date in force: 1 June 2018
  • Link: see here

———

(c) What is the status of national pre-GDPR data protection law?

The main pre-GDPR legislation has been repealed in full whilst subsidiary legislation has been revised.

———

Q2/ Personal data of deceased persons

Does national law make specific rules regarding the processing of personal data of deceased persons?

There are no specific rules governing this issue.

———

Q3/ Legal bases for processing

(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?

There are no specific rules governing this issue.

———

(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?

The controller must consult the DPA where they intend to process the following categories of data in the public interest:

• genetic data, biometric data or health data for statistical or research purposes; or
• sensitive personal data in relation to the management of social care services and systems (including for the purposes of quality control, management information and the general national supervision and monitoring of such services and systems).

Where genetic data, biometric data or health data are processed for research purposes, the DPA will consult a research ethics committee or an institution recognised by the DPA.

———

(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?

Educational authorities may process personal data of students as well as, where specifically required in the best interest of the students, the personal data of parents and legal guardians. Certain safeguards, relating to confidentiality and anonymity (varying according to the type of data), must be put in place for such processing. For example, sensitive personal data can be requested only with the explicit consent of a parent or legal guardian.

Processing health data is permitted where:

• such processing is necessary and proportionate in the context of a policy in the business of insurance;
• the controller cannot reasonably be expected to obtain the consent of the data subject; and
• the controller has no reason to believe that the data subject is withholding consent.

Processing for such purposes is subject to suitable and specific measures designed to safeguard the fundamental rights and freedoms of data subjects.

Personal data, including sensitive personal data, may be processed by any person entitled to do so for the purpose of implementing electoral legislation.

National law also makes specific rules in relation to criminal offences (see Q6 below).

———

(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?

There are no specific additional criteria governing this issue.

———

Q4/ Consent of children

At what age can a child give their consent to processing in relation to ISS?

The age for consent will depend on the type of processing activity:

• 13 years of age for processing by or on behalf of information society services; and
• 16 years of age for processing personal data of students.

———

Q5/ Processing of sensitive personal data

(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?

Sensitive personal data may be processed whenever a competent authority is processing personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Such data may only be processed by the relevant competent authority where:

• it is strictly necessary;
• it is subject to appropriate safeguards for the rights and freedoms of the data subject;
• it is authorised by law;
• it is necessary for the protection of the vital interests of the data subject or of another natural person; or
• such processing relates to data which are manifestly made public by the data subject.

———

b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:

(i) Employment, social security and/or social protection law

There are no specific rules on processing this category of data.

(ii) Substantial public interest

Any restrictions to the rights of the data subject, as set out in Art. 23 GDPR, will only apply where such restrictions are necessary for the safeguarding of national security, public security, defence and the international relations of Malta.

(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services

Any restrictions to the rights of the data subject, as referred to in Art. 23 GDPR, will only apply where such restrictions are necessary for the processing of health data and where it would be likely that the application of the rights and obligations referred to in the Data Protection Act would cause serious harm to the vital interests of the patient.

(iv) Public interest in the area of public health

See Q5(b)(iii) above.

(v) Archiving purposes, scientific or historical research purposes or statistical purposes

Where processing is carried out for the purposes of archiving in the public interest, scientific or historical research purposes or official statistical purposes, the rights of data subjects under Arts. 15-6, 18 & 21 GDPR do not apply, to the extent that the exercise of such rights would likely render impossible or seriously impair the achievement of such purposes, and the controller reasonably believes that it is necessary for the fulfilment of such purposes.

Where such data processing serves another purpose simultaneously, the derogations will apply only to processing for the aforementioned purposes.

The processing must be subject to appropriate safeguards protecting the rights and freedoms of the data subject, including pseudonymisation and other technical and organisational measures to ensure respect for the principle of data minimisation.

Where such purposes can be achieved by processing which does not permit, or no longer permits, the identification of data subjects, those purposes must be fulfilled in that manner.

———

(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?

See Q3(b) above, and also Q5(a) in relation to the processing of this category of data by competent authorities charged with the prevention, detection and prosecution of crime.

———

Q6/ Data relating to criminal offences or convictions

Under what conditions does national law permit the processing of personal data relating to criminal convictions?

The Data Protection Act does not apply where the processing of personal data is carried out by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. The following safeguards will apply to the processing of such personal data by competent authorities:

• competent authorities must take all reasonable steps to ensure that personal data which are inaccurate, incomplete or no longer up to date are not transmitted or made available;
• competent authorities must, as far as practicable, verify the quality of personal data before they are transmitted or made available;
• where possible, in all transmission of personal data, the competent authorities must ensure that:
  • personal data based on opinions or personal assessments is source-checked prior to its transmission and that its degree of reliability or accuracy is clearly indicated;
  • personal data consisting of judicial decisions or decisions not to prosecute are clearly indicated as such; and
  • necessary information enabling the receiving competent authority to assess the degree of accuracy, completeness and reliability of personal data, and the extent to which they are up to date is included with the personal data; and
• the recipient must be notified without delay if it emerges that incorrect personal data have been transmitted or that personal data have been unlawfully transmitted. In such a case, the personal data must be rectified or erased or processing must be restricted in accordance with Art. 16 GDPR.

———

Q7/ Exemptions

(a) Does national law specify exemptions to a data subject’s right to erasure?

The right to erasure is not applicable where personal data is processed for the purposes of journalistic, academic, artistic or literary expression. See also Q18(a).

———

(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?

There are no specific exemptions to the right to be provided information.

———

(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?

A decision based solely on automated processing, including profiling, which produces an adverse legal effect on the data subject or significantly affects him or her, is prohibited unless authorised by a law to which the controller is subject and which provides appropriate safeguards for the rights and freedoms of the data subject (including the right to obtain human intervention on the part of the controller).

Decisions must not be based on sensitive personal data, unless suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests are in place. Profiling which would result in discrimination against natural persons on the basis of sensitive personal data is prohibited.

———

Q8/ Restrictions on data subjects’ rights

Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?

Personal data, including sensitive personal data, may be processed by any person entitled to do so for the purpose of implementing the General Elections Act and Local Councils Act.

———

Q9/ Joint controllership

Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?

There are no additional rules on apportionment of liability between joint controllers.

———

Q10/ Processor

In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?

There are no additional pieces of legislation.

———

Q11/ Impact Assessments

Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?

Impact Assessments are only required in accordance with the provisions of the GDPR.

———

Q12/ Prior authorisation and public interest

Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?

See Q5(b)(iii).

———

Q13/ DPOs

(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?

DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.

———

(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?

DPOs are not subject to secrecy obligations under national law.

———

Q14/ International data transfers

(a) Does national law make specific rules about transfers of personal data from public registers?

Data transfers from public registers are not subject to specific rules.

———

(b) Does national law restrict the transfer of specific categories of personal data to third countries?

In the absence of an adequacy decision, the minister responsible for data protection may, following a consultation with the DPA, set limits to the transfer of specific categories of personal data to a third country or an international organisation for significant reasons of public interest. No such additional rules or regulations appear to have been issued to date.

———

Q15/ DPAs

(a) Details of the DPA(s).

• Name of DPA: Office of the Information and Data Protection Commissioner
  • Address: Information and Data Protection Commissioner, Level 2, Airways House, High Street, Sliema SLM 1549, Malta
  • Website: idpc.org.mt/en/Pages/Home.aspx

———

(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?

Not applicable as there is only one DPA.

———

(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?

Not applicable.

———

(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?

The DPA may request the assistance of the police in order to enter and search any premises. In the event of joint operations with the DPA of one or more other EU Member States, the DPA may, where appropriate, in accordance with the provisions of Art. 63 GDPR, confer powers, including investigative powers, on the supporting DPAs members of staff, provided that such powers are exercised under the guidance and in the presence of the DPA.

———

(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?

The decision of the DPA may be appealed to the Information and Data Protection Appeals Tribunal (the “Tribunal”).

Any person to whom a legally binding decision of the DPA is addressed has the right to appeal in writing to the Tribunal. Decisions may be appealed on the following grounds:

• a material error as to the facts has been made;
• there was a material procedural error;
• an error of law has been made; and
• there was some material illegality, including unreasonableness or lack of proportionality.

———

(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?

There are no specific rules on this issue.

———

Q16/ Claims by not-for-profit bodies

Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?

There are no not-for-profit bodies that are specifically mandated to bring such claims.

———

Q17/ Administrative fines, penalties and sanctions

(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?

The DPA may, after considering the circumstances of the case, impose an administrative fine on a public authority or body in the following cases:

• where such a fine does not exceed €25,000 for each violation. The DPA may impose a daily fine payment of €25 for each day that the relevant violation persists (in accordance with Art. 83(4) GDPR); or
• where such a fine does not exceed €50,000 for each violation. The DPA may impose a daily fine payment of €50 for each day that such a violation persists (in accordance with Art. 83(5) & (6) GDPR).

———

(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?

A fine of between €1,250 and €50,000 and/or a six-month imprisonment will be imposed on any convicted person guilty of committing an offence as follows:

• knowingly providing false information to the DPA, in response to a request by the DPA pursuant to its investigative powers, or any other law; or
• failure to comply with any lawful request pursuant to an investigation by the DPA.

———

Q18/ Freedom of expression and information

(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?

Personal data processed for the purpose of exercising the right to freedom of expression and information is exempt from compliance with the provisions of the GDPR (see Q18(b)). Exemptions will apply where, in the context of the importance of the right of freedom of expression and information in a democratic society, compliance with any of the provisions as specified below would be incompatible with such processing purposes. When reconciling the right to the protection of personal data with the right to freedom of expression and information, the controller must ensure that the processing is proportionate, necessary and justified for reasons of substantial public interest.

———

(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?

The provisions set out in Art. 85(2) GDPR may be disapplied in order to reconcile the protection of personal data with the freedom of expression and information.

———

Q19/ National identification numbers

Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?

Personal data contained in identity document can only be processed when such processing is clearly justified and the importance of a secure identification (or any other valid reason set out in law), provided that the national identity number, or any other identifier of general application is used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to the GDPR.

———

Q20/ Processing in the context of employment

(a) For what purposes can employees’ personal data in the employment context be processed under national law?

There are no specific provisions governing the processing of employee data.

———

(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?

There are no specific safeguards of this nature.

———

Q21/ Other material derogations

Are there any other material derogations from, or additions to, the GDPR under national law?

Processing health data is permitted where:

• such processing is necessary and proportionate in the context of a policy in the business of insurance;
• the controller cannot reasonably be expected to obtain the consent of the data subject; and
• the controller has no reason to believe that the data subject is withholding consent.

Processing for such purposes is subject to suitable and specific measures designed to safeguard the fundamental rights and freedoms of data subjects.

———

Q22/ Current legal challenges

Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?

There are no current legal challenges ongoing.

———

Q23/ Enforcement

Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?

Decisions issued by the DPA are announced but not published in full. However, decisions from the Appeals Tribunal are made available online (https://idpc.org.mt/en/Pages/appeals.aspx), illustrating cases in which the DPA has taken enforcement action, as follows:

• the DPA established the general rule that CCTV footage is to be deleted after seven days, which was confirmed by the Court when it annulled the Tribunal’s decision; and
• the DPA issued a fine of €5,000, on the basis of the factors set out in Art. 83(2) GDPR, to the Land Authority for lacking the appropriate security measures on its website for data processing, and therefore breaching Art. 32 GDPR and Art. 21 Data Protection Act.

———

Q24/ Regulatory Guidance

Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?

The DPA has issued the following guidance:

• guidance on GDPR compliance for banks (see here); and
• guidance on GDPR compliance for the Maltese gaming industry (see here).

———

[View source.]