ACT No. XXV of 2012 AN ACT to amend the Data Protection Act, Cap. 440.

I assent.

G EORGE A BELA

(L.S.)

President

7th December, 2012

ACT No. XXV of 2012

AN ACT to amend the Data Protection Act, Cap. 440.

BE IT ENACTED by the President, by and with the advice and

consent of the House of Representatives, in this present Parliament

assembled, and by the authority of the same as follows:-

The short title of this Act is the Data Protection

(Amendment) Act, 2012, and this Act shall be read and construed as

one with the Data Protection Act, hereinafter referred to as "the

principal Act".

Article 2 of the principal Act shall be amended as

(Regulation 4)

Administrative fines which may be imposed by the Commissioner

without recourse to a court hearing

Second Column

Third Column

Fine

Daily fine

Not less than €120

Not less than €20 but not

but not more than

more than €60

€600

Not less than €250

Not less than €25 but not

but not more than

more than €250

€2,500

Not

less

than

Not less than €250 but not

€2,500 but not

more than €2,500

more than €23,300

follows

(a)

immediately before the definition "blocking", there

shall be added the following new definition

" "administrative fine" means a fine which may be

determined and imposed by the Commissioner, as

prescribed in the Third Schedule";

(b) immediately after the definition "controller of

personal data", there shall be added the following new

definition

" "court penalty" means a penalty which is

enforceable by prosecution in the Courts of Malta, as

prescribed in the Second Schedule"; and

(c) immediately after the definition "third country",

there shall be added the following new definition

" "Tribunal" means the Information and Data

Protection Appeals Tribunal, established under article 48.".

Sub-article (1) of article 17 of the principal Act shall be Amendment of

(Regulation 5)

Court Penalties

First Column

Second Column

Third Column

Article

Offence

Penalty Level

47(1)(a)

Providing untrue information

to data subjects

47(1)(a)

Providing untrue information

in the notification to the

Commissioner, made in

accordance with article 29

47(1)(a)

Providing untrue information

to the Commissioner upon

his request for information,

made in accordance with

article 41

47(1)(b)

Processing of personal data,

in contravention of articles

12 to 17

article 17 of the

substituted by the following

principal Act.

"(1) Data relating to offences, criminal convictions or

security measures may only be processed under the control of a

public authority, unless specifically provided for under any

other law.".

In sub-article (1) of article 29 of the principal Act, Amendment of

(Regulation 5)

Administrative Fines

First Column

Second Column

Third Column

Article

Infringement

Fine Level

42(2)(a)

Failure

to

implement

appropriate technical and

organisational

security

measures to protect personal

data that is processed against

accidental destruction, loss

or unlawful forms of

processing, in contravention

of article 26

42(2)(b)

Transfer of personal data to a

third country which does not

ensure an adequate level of

protection, in contravention

of article 27, and which does

not satisfy any of the

requirements mentioned in

article 28

42(2)(c)

Failure

to

notify

the

Commissioner

of

any

processing operation prior to

its

commencement,

in

contravention of article 29(1)

42(2)(c)

Failure

to

notify

the

Commissioner

of

any

processing operation that

involves risks of improper

interference with the rights

and freedoms of the data

subject for prior checking, in

contravention

of

article

34(1)(a)

42(3)

Failure to comply with any

lawful request relevant to an

investigation

by

the

Commissioner,

in

contravention of article 41(2)

42(3)

Unlawful processing of

personal

data,

in

contravention of article 42(1)

42(3)

Where personal data may be

processed in an unlawful

manner, in contravention of

article 42(1)

42(3)

Failure to rectify unlawful

processing of personal data,

as

ordered

by

the

Commissioner,

in

contravention of article 42(1)

42(3)

Failure to rectify the

processing of personal data

which may be unlawful, as

ordered

by

the

Commissioner,

in

contravention of article 42(1)

2".

Passed by the House of Representatives at Sitting No. 531 of the

3rd December, 2012.

M ICHAEL F RENDO

Speaker

R AYMOND S CICLUNA

Clerk to the House of Representatives

immediately after the words "wholly or partially automated", there article

principal Act.

shall be added the words "or manual".

Paragraph (b) of sub-article (1) of article 34 of the Amendment of

article 34 of the

principal Act shall be substituted by the following

principal Act.

"(b) The Commissioner may, from time to time as he

may deem necessary, issue guidelines in order to define the

processing operations involving particular risks as referred to in

paragraph (a) and may, in such guidelines, prescribe rules in

relation to such processing operations.".

Immediately after article 41 of the principal Act, there Addition of new

articles to the

shall be added the following new articles

principal Act.

41A. (1) With respect to a penalty of any

level specified in the first column of the Second

Schedule which is a court penalty, the penalty shall

be either the corresponding fine (multa) specified

in the second column thereof or the corresponding

period of imprisonment specified in the third

column thereof, or both such fine and

imprisonment.

(2)

With respect to an administrative fine

of any level specified in the first column of the

Third Schedule, the fine shall be the corresponding

amount specified in the second column thereof and

the corresponding amount for each day during

which the infringement continues shall be that

specified in the third column thereof.

41B. (1) Any person found guilty of an

offence for having contravened a provision of this

Act mentioned in the first column of the Fourth

Schedule, with a corresponding general description

of the offence set out in the second column thereof,

shall be liable to the corresponding penalty of the

level specified in the third column thereof.

(2)

For any infringement by any person of

any provision of this Act mentioned in the first

column of the Fifth Schedule, consisting in the

corresponding act or omission described in the

second column thereof, the Commissioner may, by

notice in writing, impose by way of an

administrative fine on the person concerned the

corresponding fine specified in the third column

thereof.

(3)

Any description in the second column

of the Fourth and Fifth Schedules related to any

offence and infringement as referred to in sub-

articles (1) and (2) respectively shall not prejudice

the interpretation of the provisions of this Act to

which the offence or infringement corresponds.

(4)

Any person who is found guilty of an

offence under any provision of this Act, which is

not specifically provided for in the Fourth

Schedule, shall be liable to a fine (multa) of not

less than one hundred and twenty euro (€120) and

not more than twenty-three thousand and three

hundred euro (€23,300) or to imprisonment for six

months or to both such fine and imprisonment.

(5)

Any person who fails to comply with

any other provision of this Act which may give rise

to the imposition of an administrative fine not

otherwise specifically provided for in the Fifth

Schedule, shall be liable to an administrative fine

of not less than one hundred and twenty euro

(€120) and not more than twenty-three thousand

and three hundred euro (€23,300) for each

violation and fifty euro (€50) for each day during

which such violation persists, which fine shall be

determined and imposed by the Commissioner, in

accordance with the procedure stipulated under

article 42 of this Act.".

Article 42 of the principal Act shall be substituted by the

42. (1) If the Commissioner concludes

that personal data is processed or may be processed

in an unlawful manner, the Commissioner shall

order rectification, and if rectification is not

effected or if the matter is urgent, the

Commissioner may prohibit the controller of

personal data to continue processing the personal

data in any manner other than to store that data.

(2)

Without prejudice to his other powers

under this Act, the Commissioner may impose an

administrative fine as stipulated in sub-article (3)

in the following cases

(a)

if the controller does not

implement security measures in terms of

article 26;

(b) if the controller transfers personal

data to a third country in contravention of

articles 27 and 28;

(c)

if the controller fails to notify the

Commissioner in terms of article 29(1) or

article 34(1)(a).

(3)

In any of the cases mentioned in the

preceding sub-article or in article 41(2), the

Commissioner may, by order in writing, require the

controller of personal data to pay such

administrative fine as provided in the Schedules or

as may be prescribed.

(4)

Any administrative fine imposed

under this Act shall be due to the Commissioner as

a civil debt

Provided that such order shall be subject to the

appeal procedure as established under article 51.

(5)

In the absence of such an appeal, the

decision of the Commissioner shall become final

and shall constitute an executive title for the

purposes of Title VII of the Code of Organisation

and Civil Procedure as if the decision had been

ordered by a judgement of a court of civil

jurisdiction.

(6)

Where a notice imposing an

administrative fine is served on a person and -

(a)

such person fails to appeal within

such time as an appeal may be entered, and

fails to pay the fine so imposed; or

(b) such person appeals within such

time to the Tribunal and the appeal is

withdrawn or the Tribunal confirms the

penalty in the amount fixed by the

Commissioner or in an amount reduced by it,

and no further appeal is filed with the Court

of Appeal or if an appeal is filed with the

Court of Appeal and such Court either

confirms the decision taken, or decides that a

penalty is due in another amount, or the

imposed penalty is not paid within fifteen

days from the date of the decision or the

withdrawal of the appeal or the date when the

Tribunal or the Court of Appeal confirms or

varies the penalty as aforesaid,

the Commissioner shall be entitled to take civil

action to recover the amount due.".

In article 45 of the principal Act, for the words "in the

Schedule to this Act", there shall be substituted the words "in the First

Schedule".

Article 47 of the principal Act, as renumbered, shall be

substituted by the following

" Penalties.

47. Any person who

(a)

provides untrue information to

data subjects as is prescribed by this Act, or

in the notification to the Commissioner under

article 29 or to the Commissioner when the

Commissioner requests information in

accordance with article 41; or

(b) processes personal data in

contravention of the provisions of articles 12

to 17,

shall be guilty of an offence and shall on

conviction be liable to a fine (multa) of not less

than one hundred and twenty euro (€120) and not

more than twenty-three thousand and three hundred

euro (€23,300) or to imprisonment for six months

or to both such fine and imprisonment, as provided

in the Second Schedule, or as may be prescribed.".

The Schedule to the principal Act shall be renumbered Addition of new

as the First Schedule thereof; and immediately thereafter there shall Schedules

principal Act.

be added the following new Schedules

"SECOND SCHEDULE

(Regulation 4)

Penalties which are enforceable by prosecution in the Courts of Malta

Second Column

Third Column

Fine (multa)

Imprisonment

Not less than €120

Not more than one month

but not more than

€600

Not less than €250

Not less than one month but

but not more than

not more than three months

€2,500

Not

less

than

Not less than three months

€2,500 but not

but not more than six

more than €23,300

months