ACT No. XXXV of 2016 AN ACT to amend the Electronic Commerce Act and to make provision with respect to matters ancillary thereto or connected therewith.

I assent.

M ARIE- L OUISE

(L.S.)

C OLEIRO P RECA

President

5th July, 2016

ACT No. XXXV of 2016

AN ACT to amend the Electronic Commerce Act and to make

provision with respect to matters ancillary thereto or connected

therewith.

BE IT ENACTED by the President, by and with the advice and

consent of the House of Representatives, in this present Parliament

assembled, and by the authority of the same, as follows:-

(1) The short title of this Act is the Electronic

Commerce (Amendment) Act, 2016, and this Act shall be read and

construed as one with the Electronic Commerce Act, hereinafter

referred to as "the principal Act".

(2) The purpose of this Act is to amend the Electronic

Commerce Act and to provide for such measures under national law

as are necessary to ensure the effective implementation of Regulation

(EU) No. 910/2014 of the European Parliament and of the Council of

23 July 2014 on electronic identification and trust services for

electronic transactions in the internal market and repealing Directive

1999/93/EC.

(3) Unless stated otherwise in this Act, the provisions of this

Act shall come into force as from the 1st July 2016.

Amendment of Laws

First Column

Second Column

Enactment

Extent of Amendments

Utilities and Article 2

1. In the Maltese text of article 2

thereof the definition " " regolatur kompetenti

Services

(Regulation

ta’ infrastruttura" jew "regolaturi kompententi

ta’ infrastruttura " " shall be substituted by the

of

Certain

Works) Act.

following

" " regolatur

kompetenti

ta’

infrastruttura"

jew

"regolaturi

kompetenti ta’ infrastruttura" tfisser dak

il-korp jew korpi tas-settur pubbliku

responsabbli għar-regolament ta’ dik l-

infrastruttura li jistgħu jkunu elenkati fl-

Ewwel Skeda, liema Skeda tista’ minn

żmien għal żmien tiġi emendata mill-

Ministru

responsabbli

għall-

infrastruttura permezz ta’ avviz fil-

Gazzetta;".

Article 4A

2. Article 4A thereof shall be

amended as follows

(a)

in the Maltese text of sub-

article (2) thereof, for the words "li ssirlu

talba

bil-miktub

minn

regulatur

kompetenti tal-infrastruttura", and the

words "jikkonsulta bil-miktub lir-

regolatur jew regolaturi kompetenti hekk

kif jista’ jkun il-każ:" there shall

respectively be substituted the words "li

ssirlu talba bil-miktub minn regulatur

kompetenti ta’ utilitajiet" and the words

"jikkonsulta bil-miktub lir-regolatur jew

regolaturi kompetenti ta’ utilitajiet hekk

kif jista’ jkun il-każ:"; and

(b)

in the Maltese text of sub-

article (4) thereof, for the words

"b’koordinament mar-regolatur jew

regolaturi kompetenti ta’ infrastruttura"

there shall be substituted the words

"b’koordinament mar-regolatur jew

regolaturi kompetenti ta’ utilitajiet".

Article 4C

3. In the Maltese text of article 4C

thereof, for the words "wara konsultazzjoni

bil-miktub mar-regolatur jew regolaturi

kompetenti ta’ infrastruttura," there shall be

substituted the words "wara konsultazzjoni bil-

miktub

mar-regolatur

jew

regolaturi

kompetenti ta’ utilitajiet,".

Article 4E

4. In the Maltese text of article 4E

thereof, for the words "Persuna jew regolatur

kompetenti ta’ infrastruttura", and the words

"Iżda wkoll, meta jkun hekk japplika, ir-

regolatur kompetenti tal-infrastruttura" there

shall respectively be substituted the words

"Persuna jew regolatur kompetenti ta’

utilitajiet", and the words "Iżda wkoll, meta

jkun hekk japplika, ir-regolatur kompetenti ta’

utilitajiet".

Article 6

5. In the Maltese text of article

6(3)(b) thereof, for the words "ma’ kull min ir-

regolatur kompetenti tal-utilitajiet" there shall

be substituted the words "ma’ kull min ir-

regolatur kompetenti tal-infrastruttura".

Article 14

6. In the Maltese text of sub-article

(4) of article 14 thereof, for the words

"għaldaqstant kull parti tista’ tirreġistra

tilwima mal-Bord għas-Soluzzjoni ta’ Tilwim

u dik it-tilwima għandha tiġi ppreżentata bil-

miktub lill-Bord minn meta jiskadi l-perjodu

ta’ xahrejn imsemmi f’dan is-subartikolu."

there shall be substituted the words

"għaldaqstant kull parti tista’ tirreġistra

tilwima mal-Bord għas-Soluzzjoni ta’ Tilwim

meta jiskadi l-perjodu ta’ xahrejn imsemmi

f’dan is-subartikolu.".

Article 36

7. In the Maltese text of article 36(2)

thereof, for the words "impatt ħażin fuq il-

provediment

ta’

servizzi

ta’

komunikazzjonijiet elettroniċi f’Malta." there

shall be substituted the words "impatt ħażin

fuq il-provdiment ta’ servizzi u, jew networks

ta’ komunikazzjonijiet elettroniċi f’Malta.".

Passed by the House of Representatives at Sitting No. 412 of the

4th July, 2016.

A NĠLU F ARRUGIA

Speaker

R AYMOND S CICLUNA

Clerk of the House of Representatives

€2.88

Article 2 of the principal Act shall be amended as follows

(a)

for the words "In this Act, unless the context

otherwise requires" there shall be substituted the words "In this

Act, the definitions contained in Article 3 of the Regulation

shall apply and, unless the context otherwise requires";

(b) the definition "advanced electronic signature" shall

be deleted;

(c)

the definition "certificate" shall be substituted by the

following

" "certificate" means any one of the following

(a)

a certificate for electronic signature;

(b)

a certificate for electronic seal; or

(c)

a certificate for website authentication;";

(d) immediately after the definition "certificate” there

shall be added the following new definition

" "certificate service provider" means the trust

service provider that issues certificates;

(e) immediately after the new definition "certificate

service provider” there shall be added the following new

definition

" "commercial communication" means any form of

communication designed to promote directly or indirectly,

the goods, services or image of a company, organisation or

person pursuing a commercial, industrial or craft activity or

exercising a regulated profession. The following do not in

themselves constitute commercial communications

(a) information allowing direct access to the

activity of the company, organisation or person, in

particular the domain name of an electronic mail address;

(b) communications relating to the goods, services

or image of the company, organisation or person compiled

in an independent manner, particularly when this is without

financial consideration;";

(f)

for the definition "competent authority" there shall

be substituted the following

" "competent regulator" means any such public body

as may be designated by the Minister according to the Sixth

Schedule to act as the regulatory body tasked with ensuring

compliance with this Act and, or with the Regulation

Provided that the Minister may amend such

Schedule by Order in the Gazette, and in doing so may

provide for the exercise of the regulatory powers of the

regulatory body designated to act as the competent

regulator for the purposes of this Act

Provided further that in doing so the Minister

may designate different public bodies to administer and

enforce different provisions of this Act and, or of the

Regulation. In doing so the Minister shall clearly establish

the remit of each such public body ensuring also that there

is effective co-ordination between such bodies;";

(g) immediately after the definition "consumer" there

shall be added the following new definition

" "coordinated field" means requirements applicable

to information society service providers or information

society services, regardless of whether they are of a general

nature or specifically designed for them, and covers

requirements with which the service provider has to

comply in respect of

(a) the taking up of the activity of an information

society service, such as requirements concerning

qualifications, authorisation or notification;

(b) the pursuit of the activity of an information

society service, such as requirements concerning the

behaviour of the service provider, requirements regarding

the quality or content of the service, including those

applicable to advertising and contracts, or requirements

concerning the liability of the service provider,

but does not cover requirements such as those

applicable to goods as such, to the delivery of goods or to

services not provided by electronic means;";

(h) immediately after the new definition "coordinated

field" there shall be added the following new definition

" "cross-border infringement" means

(a) an act or omission contrary to this Act and, or to

the Regulation which takes place in Malta and which harms

or is likely to harm the collective interests of consumers

residing in a Member State or in Member States other than

Malta; or

(b) an act or omission contrary to this Act and, or to

the Regulation by a seller or supplier who is established in

Malta and which harms or is likely to harm the collective

interests of consumers residing in a Member State or in

Member States other than Malta; or

(c) an act or omission contrary to this Act and, or to

the Regulation which takes place in Malta and which harms

or is likely to harm the collective interests of consumers

residing in a Member State or in Member States other than

Malta where the evidence or assets pertaining to the act or

omission are to be found in Malta;";

(i)

the definition "electronic signature" shall be deleted;

(j)

immediately after the definition "electronic

contract" there shall be added the following new definition

" "Electronic Commerce Directive" means Directive

2000/31/EC of the European Parliament and of the Council

of 8 June 2000 on certain legal aspects of information

society services, in particular electronic commerce, in the

internal market;";

(k) immediately after the new definition "Electronic

Commerce Directive" there shall be added the following new

definition

" "enforcement action" means any form of

enforcement action, however so described, including the

imposition of any sanctions that an enforcement authority,

including the competent regulator, is empowered to take at

law;";

(l)

immediately after the new definition "enforcement

action" there shall be added the following new definition

" "enforcement authority" means any public entity

which at law is authorised to take enforcement action, but

does not include a court however so described;";

(m) immediately after the new definition "enforcement

authority" there shall be added the following new definition

" "European Commission" or "Commission" means

the European Commission of the European Union;";

(n) immediately after the definition "information

technology requirements" there shall be added the following

new definition

" "Member State" means a Member State of the

European Union;";

(o)

the definition "qualified certificate" shall be deleted;

(p) immediately after the definition "prescribed" there

shall be added the following new definition

" "qualified entity" means

(a)

a

registered

consumer

association within the meaning of Part IV

of the Consumer Affairs Act, and a

voluntary organization recognized by the

competent regulator as having a legitimate

interest in protecting the collective

interests of consumers

Provided

that

before

recognizing

any

such

voluntary

organization as a qualified entity the

competent regulator shall consult with the

Consumer Affairs Council as established

under the Consumer Affairs Act;

(b) in the context of articles 8A,

8B and 8C any enforcement authority to

whom this Act applies;

(c)

one or more independent public

bodies, having a legitimate interest in

ensuring the protection of the collective

interests of consumers of any services

regulated by the Electronic Commerce

Directive or by the Regulation in other

Member States in which such bodies exist;

(d) voluntary organizations in

other Member States whose purpose is to

protect the collective interests of

consumers in accordance with the criteria

laid down by their national law;

(e)

one or more organizations

recognized by the competent regulator as

collectively

representing

information

society service providers; or

(f)

any qualified entity from a

Member State included in the list of

qualified entities as may from time to time

be

published

by

the

European

Commission;";

(q) immediately after the definition "recipient of the

service" there shall be added the following new definition

" "regulated profession" means any profession within

the meaning of either

(a) Article 1(d) of the European Council Directive

89/48/EEC of the 21 December 1988 on a general system

for the recognition of higher education diplomas awarded

on completion of professional education and training for a

duration of at least three years; or

(b) Article 1(f) of the European Council Directive

92/51/EEC of the 18 June 1992 on a second general system

for the recognition of professional education and training to

supplement Directive 89/84/EEC;";

(r)

immediately after the new definition "regulated

profession" there shall be added the following new definition

" "Regulation" means Regulation number 910/2014

of the European Parliament and of the Council of 23 July

2014 on electronic identification and trust services for

electronic communications in the internal market and

repealing Directive 1999/93/EC;";

(s)

immediately after the new definition "Regulation"

there shall be added the following new definition

" "service provider" means any person established in

Malta providing an information society service;";

(t)

the definitions "signature certification service

provider", "secure signature creation device", "signature

verification data", and "signature verification device" shall be

deleted;

(u) immediately after the definition "transaction" there

shall be added the following new definition

" "Tribunal” means the Administrative

Review Tribunal established by article 5 of the

Administrative Justice Act;";

(v) immediately after the new definition "Tribunal"

there shall be added the following new definition

" "Union" means the European Union."; and

(w)

the definition "voluntary accreditation" shall be

deleted.

Emendi għal-Liġijiet

L-Ewwel Kolonna

It-Tieni Kolonna

Liġi

Emendi magħmulin

L-Att dwar Artikolu 2

1. Fl-artikolu 2 tiegħu t-tifsira

ir-

" "regolatur kompetenti ta’ infrastruttura"

Regolament

jew

"regolaturi

kompetenti

ta’

infrastruttura " " għandha tiġi sostitwita b’dan

ta’

Ċerti

Xogħlijiet

li ġej

f’Utilitajiet

" " regolatur

kompetenti

ta’

u Servizzi.

infrastruttura"

jew

"regolaturi

kompetenti ta’ infrastruttura" tfisser dak

il-korp jew korpi tas-settur pubbliku

responsabbli għar-regolament ta’ dik l-

infrastruttura li jistgħu jkunu elenkati

fl-Ewwel Skeda, liema Skeda tista’

minn żmien għal żmien tiġi emendata

mill-Ministru

responsabbli

għall-

infrastruttura permezz ta’ avviż fil-

Gazzetta;".

Artikolu 4A

2. L-artikolu 4A tiegħu għandu jiġi

emendat kif ġej

(a)

fis-subartikolu (2) tiegħu,

minflok il-kliem "li ssirlu talba bil-

miktub minn regolatur kompetenti tal-

infrastruttura", u l-kliem "jikkonsulta

bil-miktub lir-regolatur jew regolaturi

kompetenti hekk kif jista’ jkun il-każ:"

għandhom jidħlu rispettivament il-

kliem "li ssirlu talba bil-miktub minn

regolatur kompetenti ta’ utilitajiet" u l-

kliem "jikkonsulta bil-miktub lir-

regolatur jew regolaturi kompetenti ta’

utilitajiet hekk kif jista’ jkun il-każ:"; u

(b)

fis-subartikolu (4) tiegħu,

minflok il-kliem "b’koordinament mar-

regolatur jew regolaturi kompetenti ta’

infrastruttura" għandhom jidħlu l-kliem

"b’koordinament mar-regolatur jew

regolaturi kompetenti ta’ utilitajiet".

Artikolu 4Ċ

3. Fl-artikolu 4Ċ tiegħu, minflok il-

kliem "wara konsultazzjoni bil-miktub mar-

regolatur jew regolaturi kompetenti ta’

infrastruttura," għandhom jidħlu l-kliem

"wara konsultazzjoni bil-miktub mar-

regolatur jew regolaturi kompetenti ta’

utilitajiet,".

Artikolu 4E

4. Fl-artikolu 4E tiegħu, minflok il-

kliem "Persuna jew regolatur kompetenti ta’

infrastruttura", u l-kliem "Iżda wkoll, meta

jkun hekk japplika, ir-regolatur kompetenti

tal-infrastruttura"

għandhom

jidħlu

rispettivament il-kliem "Persuna jew regolatur

kompetenti ta’ utilitajiet", u l-kliem "Iżda

wkoll, meta jkun hekk japplika, ir-regolatur

kompetenti ta’ utilitajiet".

Artikolu 6

5. Fl-artikolu 6(3)(b) tiegħu, minflok

il-kliem "ma’ kull min ir-regolatur kompetenti

tal-utilitajiet" għandhom jidħlu l-kliem "ma’

kull min ir-regolatur kompetenti tal-

infrastruttura".

Artikolu 14

6. Fis-subartikolu (4) tal-artikolu 14

tiegħu, minflok il-kliem "għaldaqstant kull

parti tista’ tirreġistra tilwima mal-Bord għas-

Soluzzjoni ta’ Tilwim u dik it-tilwima

għandha tiġi ppreżentata bil-miktub lill-Bord

minn meta jiskadi l-perjodu ta’ xahrejn

imsemmi f’dan is-subartikolu." għandhom

jidħlu l-kliem "għaldaqstant kull parti tista’

tirreġistra tilwima mal-Bord għas-Soluzzjoni

ta’ Tilwim meta jiskadi l-perjodu ta’ xahrejn

imsemmi f’dan is-subartikolu.".

Artikolu 36

7. Fl-artikolu 36(2) tiegħu, minflok

il-kliem "impatt ħażin fuq il-provediment ta’

servizzi ta’ komunikazzjonijiet elettroniċi

f’Malta." għandhom jidħlu l-kliem "impatt

ħażin fuq il-provdiment ta’ servizzi u, jew

networks ta’ komunikazzjonijiet elettroniċi

f’Malta.".

Mgħoddi mill-Kamra tad-Deputati fis-Seduta Nru 412 tal-4 ta’

Lulju, 2016.

A NĠLU F ARRUGIA

Speaker

R AYMOND S CICLUNA

Skrivan tal-Kamra tad-Deputati

For the words "competent authority", wherever they occur

in the principal Act, there shall be substituted the words "competent

regulator".

Sub-article (1) of article 4 of the principal Act shall be

substituted by the following

"(1) Unless otherwise prescribed, the provisions of this

Act and of the Regulation shall not apply to those activities or

areas as are listed in the Fifth Schedule. The Minister may, after

consultation with the competent regulator, by notice in the

Gazette, amend the Fifth Schedule.".

Article 6 of the principal Act shall be deleted.

Immediately after article 8 of the principal Act there shall

be added the following new articles

" Internal

(1) Subject to the provisions of

market.

sub-article (4), any requirement that falls within

the coordinated field shall apply to the provision

of an information society service by a service

provider established in Malta, irrespective of

whether that service is provided in Malta or in

another Member State.

(2) Subject to the provisions of sub-

article (4) an enforcement authority with

responsibility in relation to any requirement in

sub-article (1) shall ensure that the provision of

an information service by a service provider

established in Malta complies with that

requirement irrespective of whether the service

is provided in Malta or in another Member State,

and any power, remedy or procedure for taking

enforcement action shall be available to secure

compliance.

(3) Subject to the provisions of sub-

articles (4) and (5), no requirement shall be

applied to the provision of an information

society service by a service provider established

in a Member State other than Malta for reasons

which fall within the coordinated field if the

application of the requirement would restrict the

freedom to provide information society services

to a person in Malta from that Member State.

(4) Subarticles (1), (2) and (3) shall not

apply to the fields set out in the Seventh

Schedule to this Act.

(5) The reference to any requirements the

application of which would restrict the freedom

to provide information society services from

another Member State in sub-article (3) does not

include any requirement maintaining the level of

protection for public health and consumer

interests established by European Union law.

(1) Notwithstanding the provisions

Derogations

from article 8A.

of article 8A(3), an enforcement authority may

take measures, including applying any

requirement which would otherwise not apply

by virtue of article 8A(3), in respect of a given

information society service, where those

measures are necessary for reasons of -

(a)

public policy, in particular the

prevention, investigation, detection and

prosecution of criminal offences, including

the protection of minors and the fight

against any incitement to hatred on

grounds of race, sex, religion or

nationality, and violations of human

dignity concerning individual persons;

(b) the protection of public health;

(c)

public security, including the

safeguarding of national security and

defence; or

(d) the protection of consumers,

including investors,

and are proportionate to those objectives.

(2) Notwithstanding the provisions of

article 8A(3), in any case where an enforcement

authority is not party to the proceedings, a court

may, on the application of any person or of its

own motion, apply any requirement which

would otherwise not apply by virtue of article

8A(3) in respect of a given information society

service, if the application of that law or

requirement is necessary for and proportionate

to any of the objectives set out in sub-article (1).

(3) Subarticles (1) and (2) shall only

apply where the information society service

prejudices or presents a serious and grave risk of

prejudice to an objective as stated in sub-article

(1)(a) to (d).

(4) Subject to the provisions of sub-

articles (5) and (6), an enforcement authority

shall not take the measures in sub-article (1)

unless it

(a)

asks the Member State in

which the service provider is established to

take measures and the aforesaid Member

State does not take such measures or the

measures taken are considered by the

enforcement authority concerned as

inadequate; and

(b) notifies

the

European

Commission and the Member State in

which the service provider is established of

its intention to take such measures.

(5) Nothing in sub-article (4) affects the

commencement of any legal proceedings or the

investigation of any offence or breach, however

so described, by any enforcement authority.

(6) If it appears to the enforcement

authority that the matter is one of urgency, it

may take the measures under sub-article (1)

without first applying the requirements of sub-

article (4).

(7) In a case where a measure is taken

pursuant to sub-article (6), the enforcement

authority shall notify the measures taken, to the

European Commission and to the Member State

concerned in the shortest time possible thereafter

stating in writing the reasons for urgency.

(1) Without prejudice to other

General

information to be

information requirements as may be established

provided.

at law, a service provider shall make available to

the recipient of the service and where

appropriate or requested, to the enforcement

authority responsible at law in ensuring

compliance, including where applicable to the

competent regulator, in a form and manner

which is easily, directly and permanently

accessible, the following information

(a)

the name of the service

provider;

(b) the geographic address where

the service provider is established;

(c)

the details of the service

provider, including his electronic mail

address, which allow him to be contacted

rapidly and communicated with in a direct

and effective manner;

(d) where the service provider is

registered in a trade or similar public

register, the trade or other such register in

which the service provider is entered and

his registration number, or equivalent

means of identification in that register;

(e)

where the activity is subject to

an authorisation scheme, the particulars of

the relevant supervisory authority;

(f)

where the service provider is a

member of a regulated profession -

(i) any professional body or

similar institution with which the

service provider is registered;

(ii) the professional title of the

provider and the Member State where

it has been granted; and

(iii) a

reference

to

the

applicable professional rules in the

Member State of establishment and

the means to access them;

(g) where the service provider

undertakes an activity that is subject to

value added tax, the identification number

referred to in Article 22(1) of the Sixth

Council Directive 77/388/EEC of 17th

May 1977 on the harmonisation of the laws

of the Member States relating to turnover

taxes - Common system of value added

tax: uniform basis of assessment; and

(h) when a service provider sends

unsolicited commercial communications,

details of how users of the service can

register their choice regarding unsolicited

commercial

communications,

which

details must be prominently displayed on

the website of the service provider and at

every point where users of the service are

asked to provide information when

accessing the website of the service

provider.

(2) Where the service provider refers to

prices, such prices shall be indicated clearly and

unambiguously and, in particular, shall indicate

whether they are inclusive of any tax, however

so described, and delivery costs.

In addition to any other information

Provision of

information in

requirements that may be established at law, a

commercial

communications.

service provider shall ensure that any

commercial communication provided by him,

which constitutes or forms part of an

information society service shall -

(a)

be clearly identified as a

commercial communication;

(b) clearly identify the person on

whose

behalf

the

commercial

communication is made;

(c)

clearly identify as such any

promotional offer, including any discount,

premium or gift, and ensure that any

conditions which must be met to qualify

for it are easily accessible, and presented

clearly and unambiguously;

(d) clearly identify as such any

promotional competition or game and

ensure that any conditions for participation

are easily accessible and presented clearly

and unambiguously; and

(e)

without prejudice to the

provisions of the Data Protection Act and

of any other laws regulating data

protection, clearly identify details of how

users of the service can register their

choice regarding unsolicited commercial

communications, which details must be

prominently displayed at every point

where users of the service are asked to

provide information.

(1) This article establishes and

Regulated

professions.

regulates the right under the Act to make a

commercial communication which is part of, or

constitutes, a service provided by a member of a

regulated profession.

(2) Without prejudice to any other

provision of the Act permitting a restriction or

limitation of the right to which this article

applies, a body which at law is responsible for a

regulated profession may, in exercise of any

powers vested in it at law to regulate the

activities of its members, make the exercise by a

member of the profession of the right to which

this article applies, subject to compliance with

specified conditions as referred to in sub-article

(3).

(3) The conditions that may be so

specified are those that may reasonably be

regarded as appropriate for the purpose of

maintaining the standing and integrity of the

profession concerned and ensuring adherence by

its members to the requisite standards and, in

particular, for the purpose of ensuring -

(a)

the independence, dignity and

honour of the profession, and

(b) compliance with obligations of

professional secrecy and fairness towards

clients and other members of the

profession.

Subject to the provisions of article

No requirement

for prior

8G, the provision of information society services

authorisations.

by a service provider shall not be subject to any

prior authorisation

Provided that the provision of such

information society services shall be without

prejudice to authorisation schemes which are not

specifically and exclusively targeted at

information society services, or which are

covered by the Electronic Communications

(Regulation) Act or any regulations made

thereunder.

(1) For the purposes of this article

Notification

requirement.

only, "services" means any such information

society services to which the provisions of this

article may apply consequential to any

designation that the competent regulator may

make in accordance with sub-article (2).

(2) Before providing services, a service

provider shall complete and file a notice with the

competent regulator which shall be made in such

form and include any such information as the

competent regulator may require

Provided that such information shall

be limited to what is necessary for the competent

regulator to identify the service provider and the

services he provides

Provided further that the competent

regulator may, with the prior written approval of

the Minister, designate such other categories of

service providers to complete and file a notice in

accordance with this article as the competent

regulator may from time to time consider

necessary.

(3) The service provider shall notify the

competent regulator if such a service provider

ceases to provide the notified service or if there

is any change in the details of the notice

previously filed. Such notification shall be made

within thirty days of cessation of service

provision or of the change to the notified

information.

(4) The competent regulator shall

establish and maintain a register of those service

providers that have notified the competent

regulator in accordance with this article. Such

register shall be accessible to the public and

shall contain such information as the competent

regulator considers appropriate.

Articles 8A to 8F shall not apply to

Non-

applicability of

the activities or areas listed in paragraphs (a),

certain articles to

the activities or

(b), (c) and (d) of the Fifth Schedule to the Act.".

areas listed in the

Fifth Schedule of

the Act.

7. Sub-article (1) of article 13 of the principal Act shall be Amendment of

article 13 of the

substituted by the following

principal Act.

"(1) If the addressee of an electronic communication has

designated an information system for the purpose of receiving

electronic communications, then, save as otherwise agreed

between the originator and the addressee of the electronic

communication or as otherwise required under the Regulation,

the time of receipt of the electronic communication is the time

when the electronic communication enters the information

system.".

8. Immediately after article 15 of the principal Act there shall Addition of new

article to the

be added the following new article

principal Act.

" Communica-

Wherever any legal requirement

tions by

exists to communicate by way of registered

registered mail.

mail, this requirement shall be deemed to be

satisfied by the use of a qualified electronic

registered delivery service by all parties

participating in the communication

Provided that this article shall come

into force on such date as the Minister may

expressly determine by order in the Gazette.".

9. Part V and articles 16 to 18 of the principal Act shall be Deletion of Part

V and articles

deleted.

16 to 18 of the

principal Act.

10. Article 23 of the principal Act shall be amended as Amendment of

article 23 of the

follows

principal Act.

(a) for the words "signature creation device" or

"signature device", wherever they occur, there shall be

substituted the words "electronic signature creation device or an

electronic seal creation device";

(b) for the words "signature certification service

provider", wherever they occur, there shall be substituted the

words "certificate service provider"; and

(c)

for the words "electronic signature", wherever they

occur, there shall be substituted the words "electronic signature

or electronic seal".

11. Immediately after article 23 of the principal Act there shall

Addition of new

articles to the

be added the following new articles

principal Act.

" Supervisory

(1) The competent regulator shall

body for the

be responsible for the supervisory tasks stated in

purposes of the

the Regulation and in doing so shall in

Regulation.

particular

(a)

supervise

qualified

trust

service providers established in Malta

ensuring through ex ante and ex post

supervisory activities, that such qualified

trust service providers and the qualified

trust services that they provide, meet the

requirements laid down in the Regulation;

(b) take action if necessary, in

relation to non-qualified trust service

providers established in Malta through ex

post supervisory activities, when informed

that those non-qualified trust service

providers or the trust services they provide

allegedly do not meet the requirements laid

down in the Regulation.

(2) Without prejudice to the generality of

the tasks onerous on the competent regulator as

stated in sub-article (1), the competent regulator

shall be responsible for the following

(a)

cooperating

with

other

supervisory bodies and provide them with

assistance in accordance with Article 18 of

the Regulation;

(b) analysing

the

conformity

assessment reports referred to in Articles

20(1) and 21(1) of the Regulation;

(c)

informing other supervisory

bodies and the public about breaches of

security or loss of integrity in accordance

with Article 19(2) of the Regulation;

(d) reporting to the European

Commission about its main activities in

accordance with paragraph 6 of Article 17

of the Regulation;

(e)

carrying

out

audits

or

requesting a conformity assessment body

to perform a conformity assessment of the

qualified trust service providers in

accordance with Article 20(2) of the

Regulation;

(f)

cooperating with the Office of

the Information and Data Protection

Commissioner in Malta, in particular, by

informing that Office without undue delay,

about the results of audits of qualified trust

service providers, where personal data

protection rules may in the opinion of the

competent regulator have been breached;

(g) granting qualified status to

trust service providers and to the services

they provide and to withdraw this status in

accordance with Articles 20 and 21 of the

Regulation;

(h) informing the body responsible

for the national trusted list referred to in

Article 22(3) of the Regulation about its

decisions to grant or to withdraw qualified

status

Provided

that

such

a

requirement shall not apply if the

competent regulator also performs the

tasks of the body referred to in this

paragraph;

(i)

verifying the existence and

correct application of provisions on

termination plans in cases where the

qualified trust service provider ceases its

activities including how information is

kept accessible in accordance with point

(h) of Article 24(2) of the Regulation;

(j)

requiring that trust service

providers remedy any failure to fulfil the

requirements laid down in the Regulation;

(k) establishing, maintaining and

publishing trusted lists in accordance with

Articles 22(1) and 22(2) of the Regulation,

and notifying the Commission in relation

thereto in accordance with Article 22(3) of

the Regulation; and

(l)

notifying the Commission in

relation to any lists in accordance with

Articles 31(1) and 39(3) of the Regulation.

Unless stated otherwise in this Act,

Non-compliance

with the

where applicable, any non-compliance with the

Regulation.

provisions of this Act or of the Regulation, shall

constitute a breach of this Act, and shall be

treated accordingly by the competent regulator

who shall as it considers appropriate take the

necessary regulatory measures in accordance

with its powers at law.

Unless stated otherwise in the Act, a

Non-compliance

with the Act and

breach of any of the provisions of the Act shall

powers of the

competent

be subject to any such sanctions as the

regulator.

competent regulator is empowered by law to

impose.".

12. Article 24 of the principal Act shall be substituted by the

following

"24. Any person contravening articles 20, 22 and 23 of

the Act, or Articles 19(2), 20(1), 21(1), 21(3), 23 and 24 of the

Regulation, shall be guilty of an offence and shall on conviction

be liable to a fine (multa) of not more than two hundred and

fifty thousand euro (€250,000) or to imprisonment not

exceeding two years or to both such fine (multa) and

imprisonment, and in the case of a continuous offence to a fine

not exceeding two thousand, five hundred euro (€2,500) for

each day during which the offence continues

Provided that where any proceedings are undertaken

by the Commissioner of Police under this sub-article, the

Commissioner of Police shall in writing notify the competent

regulator of the taking of such proceedings and of the final

outcome of the same.".

13. Immediately after article 24 of the principal Act there shall

be added the following new articles

" Disputes

(1) Where a dispute however so

between a

described arises between a service provider and

service provider

a consumer further to a complaint by a consumer

and a consumer.

alleging an infringement of the Act or of the

Regulation as are enforced by the competent

regulator, any party to such a dispute may refer

the dispute to the competent regulator

Provided that in making a complaint

the consumer must prima facie show that he has

been affected by the act or omission of the

service provider giving rise to the complaint.

(2) Upon receipt of any reference as

aforesaid, or upon otherwise becoming aware of

any such dispute that the competent regulator

believes should be investigated, the competent

regulator shall notify all the parties to the

dispute that the matter is being investigated. In

doing so, the competent regulator shall regulate

its own procedure, which procedure shall, as far

as is reasonably possible, be transparent, simple,

inexpensive and conducive to a prompt and fair

settlement of the dispute, and shall afford all

parties to the dispute reasonable opportunity to

make their submissions and to produce any

relevant information

Provided that the competent regulator

may decide not to initiate an investigation in

accordance with this article where it is satisfied

that other means of resolving the dispute in a

timely manner are available to the parties, or if

legal proceedings in relation to the dispute have

been initiated by any party to the dispute, or if

another public authority is already investigating

the same dispute.

(3) The competent regulator in resolving

any disputes referred to it under this article, may

issue directives to the service provider requiring

that service provider to comply with any

measure the competent regulator may specify for

the resolution of the dispute. Such directives

may, having regard to its determination of the

dispute and to all other relevant matters, include

an order to effect the reimbursement of

payments received or to make compensation

payments. Such payments may also include the

whole or part of the costs of any party relating to

the engagement of a lawyer and, or of a

technical adviser in relation to any submissions

relating to the dispute.

(4) The competent regulator shall make

publicly available any administrative procedures

it may from time to time establish in relation to

the handling of any disputes referred to it under

this article.

(5) The provisions of this article shall be

without prejudice to the right of the consumer to

have recourse, in accordance with Maltese law,

to any other body empowered to resolve any

such disputes and, or to any out-of-court dispute

resolution processes, however so described.

(6) In issuing a decision under this article

the competent regulator shall state the reasons

on which it is based, and shall, subject to such

requirements of commercial confidentiality as it

may deem appropriate, notify the parties to the

dispute with a copy of the decision.

(7) The competent regulator shall publish

notice of a decision given under this article and

shall state from where copies of, or information

regarding the decision, may be obtained.

(1) Where the competent regulator

Issue of a

compliance

feels it is reasonably appropriate or necessary

order.

for the protection of consumers, it may, of its

own initiative or on a written application to it by

a qualified entity, issue a compliance order

against a service provider or any other person for

one or more of the following purposes

(a)

requiring any person to take

any measures specified in the compliance

order, within the time specified in the order

to ensure that the provisions of the Act

and, or of the Regulation are complied

with; or

(b) requiring any person to cease

and desist from committing a breach of the

Act and, or of the Regulation.

(2) The competent regulator shall when

issuing a compliance order under this article

(a)

notify a copy of the compliance

order on each person against whom the

order is made;

(b) include with the compliance

order, information about the right to

contest the order before the Tribunal; and

(c) briefly state the reasons for

issuing the compliance order, which

reasons shall be notified to each person

against whom the order is issued and, if

any, to the qualifying body on whose

application the order is issued.

(3) No precautionary warrant or other

similar order under this or any other law shall be

issued by the Tribunal or by any court

restraining or restricting the competent regulator

from issuing a compliance order under this Act.

(4) A compliance order issued by the

competent regulator shall come into force with

immediate effect, unless the order provides

otherwise.

(1) Where a qualified entity wishes

Application for

the issue of a

to seek a compliance order, it shall submit a

compliance

order.

written application to the competent regulator

whereby it must satisfy the competent regulator

that it tried to achieve the cessation of the

infringement in consultation with either the

party against whom the order is being sought or

with both such a party and another qualified

entity of the Member State in which the order or

a similar injunction is being sought

Provided that the competent regulator

shall only consider a written application if the

qualified entity shows to the satisfaction of the

competent regulator that the cessation of the

infringement was not achieved within twenty

days after the request for consultation was

received.

(2) Where the qualified entity is from

another Member State, the competent regulator

shall treat the list of qualified entities published

by the Commission as conclusive proof of the

legal capacity of the legal entity to present such

written application in Malta.

(3) The competent regulator shall, at the

request of a qualified entity from Malta,

communicate to the Commission the name and

objects of such an entity and that such qualified

entity should be added to the list of qualified

entities so as to facilitate the redress of

infringements which occur in other Member

States.

(4) Before proceeding with the issue of a

compliance order under article 24B, the

competent regulator shall, if it considers it to be

possible and reasonable to do so, seek first to

achieve voluntary compliance by the service

provider and other persons involved, in

accordance with the Act and, or the Regulation

or any other law dealing with consumer

protection.

(1) It shall be at the discretion of

Discretion of

the competent

the competent regulator whether or not to issue a

regulator to

issue a

compliance order after a written request by a

compliance

qualified entity has been made to it in terms of

order.

article 24B.

(2) If the competent regulator decides not

to issue a compliance order after an application

has been made to it by a qualified entity, the

competent regulator shall, within two days from

the date of its decision not to issue an order as

sought, notify in writing the qualified entity and

the persons against whom the compliance order

is sought, with its decision stating the reasons

thereof.

(3) A qualified entity may within twenty

days from when it notifies the competent

regulator in writing with a request for the issue

of a compliance order, apply to the Tribunal

requesting the Tribunal to order the competent

regulator to issue a compliance order under

article 24B. The person against whom the order

is requested and the competent regulator shall be

parties to the proceedings before the Tribunal,

and it shall be the duty of the qualified entity to

notify such other parties accordingly.

(1) A person against whom a

Appeals from a

compliance

compliance order has been made, may, within

order.

twenty days from receipt of notification of the

compliance order, appeal in writing to the

Tribunal for the revocation or amendment of the

compliance order, giving detailed grounds for

the request. The competent regulator and where

appropriate any qualifying entity that may have

requested the issue of the compliance order,

shall be notified with the appeal and shall have

twenty days from the date when they are notified

with the appeal in which to reply.

(2) The Tribunal may confirm, change or

cancel the compliance order as it considers

appropriate, provided that in doing so the

Tribunal shall in all instances state its reasons.

(3) Where an appeal is instituted under

this article the compliance order shall remain in

force unless the Tribunal, at the request of the

party contesting the order, specifically orders

that the compliance order shall be suspended

pending the outcome of the appeal, subject to

such conditions and amendments to the order as

the Tribunal may determine

Provided that in deciding any such

request for a suspension of the compliance order,

the Tribunal shall give its reason in writing for

its decision.

(1) Appeals

instituted

under

Cases to be

heard and

articles 24D and 24E shall be heard and

determined with

urgency.

determined by the Tribunal with urgency and as

expeditiously as possible.

(2) The Tribunal, at the request of any of

the parties to the proceedings before it, may

abridge any time limits established under this

Act in relation to the conduct of the appeal

before it

Provided that in doing so the Tribunal

shall state its reasons in writing.

The competent regulator when

No need to

prove actual

issuing a compliance order under the Act shall

loss.

not be required to prove

(a)

actual loss or damage; or

(b) actual recklessness, negligence

or fault on the part of the service provider

or person against whom the order is made.

(1) Without prejudice to any other

Taking of other

measures to

powers it has at law, the competent regulator

ensure

compliance.

may, in writing, order any person to cease and

desist from committing any cross-border

infringement and, or from acting in breach of

any of the provisions of the Act, and, or of the

Regulation.

(2) The competent regulator may, in

issuing an order under sub-article (1) require the

person concerned to provide it with a written

undertaking whereby that person agrees to cease

and desist from any such breach and which

undertaking shall include any conditions as the

competent regulator may consider necessary in

the circumstances.

(3) A person who makes an undertaking

in accordance with this article and who

subsequently acts in breach of any conditions

stated in the undertaking, shall be liable to the

imposition of an administrative fine by the

competent regulator not exceeding the sum of

twenty-five thousand euro (€25,000) and, or five

hundred euro (€500) for each day during which

the failure to comply with the undertaking

persists

Provided that the imposition of a fine

under this sub-article shall be without prejudice

to any other sanctions however so described that

the competent regulator may impose at law.

(1) The competent regulator may,

Competent

regulator may

for the better information of the public, require

require

publication.

the service provider or person against whom the

compliance order has been issued, at the expense

of the latter to communicate in any manner the

competent regulator considers appropriate,

including publication in at least two daily

newspapers

(a)

a copy in full or in part -

(i) of a compliance order

made under article 24B; and, or

(ii) a copy of an undertaking

given under article 24H or an abstract

of any such order and, or of any such

undertaking; and, or

(b) a corrective statement in

relation to any contravention of the Act

and, or of the Regulation.

(2) Any communications required in

terms of sub-article (1) must be made within

seven days from receipt of a notice issued by the

competent regulator requiring the service

provider or person concerned to make any such

communications.

Where

the

said

communications are not effected as aforesaid,

the competent regulator may proceed to issue the

communications itself and any expenses

incurred by the competent regulator in issuing

any communications made by it in accordance

with the provisions of this article shall be

recoverable as a civil debt from the person

against whom the compliance order was issued.

Any person aggrieved by a decision

Right of appeal.

however so described taken by the competent

regulator in accordance with the Act and having

a legal interest to contest such a decision, may

appeal to the Tribunal

Provided that in the case of a

contestation of any matter relating to the issue of

a compliance order as provided for in this Act,

the procedures as stated in articles 24D and 24E

shall apply.

(1) The competent regulator may

Consultation

with and by

request the advice of and where appropriate shall

other

enforcement

consult with any other enforcement authority in

authorities.

the exercise of any of its functions under the Act

and, or the Regulation.

(2) In acting in accordance with any of

the provisions of this Act, an enforcement

authority shall, in all instances, first consult and

act in co-ordination with the competent

regulator.".

14. Article 25 of the principal Act shall be amended as Amendment of

article 25 of the

follows

principal Act.

(a)

sub-article (1) thereof shall be amended as follows

(i) for the words "for any matter related to

electronic commerce" there shall be substituted the words

"for any matter related to electronic commerce however so

described, electronic identification, trust services,

electronic transactions, and any such other matters as may

be complementary or related thereto,";

(ii) in sub-paragraph (v) of paragraph (b) thereof,

for the word "signatures" there shall be substituted the

words "trust services";

(iii) paragraphs (c) and (d) thereof shall be deleted;

(iv) in sub-paragraph (i) of the proviso to paragraph

(f) thereof, for the words "the amount of twenty-three

thousand and two hundred and ninety euro (23,290) for

each offence and two thousand and three hundred and

twenty-five euro (2,325)" there shall be substituted the

words "the amount of twenty-five thousand euro (€25,000)

for each offence and two thousand and five hundred euro

(€2,500)";

(v) in sub-paragraph (ii) of the proviso to paragraph

(f) thereof, for the words “a maximum of one hundred and

sixteen thousand and four hundred and sixty-five euro

(116,465) and eleven thousand and six hundred and forty-

five euro (11,645)" there shall be substituted the words "a

maximum of one hundred and twenty-five thousand euro

(€125,000) and twelve thousand and five hundred euro

(€12,500)";

(vi) in paragraph (h) thereof, for the words

"regulated by or under this Act." there shall be substituted

the words "regulated by or under this Act;"; and

(vii) immediately after paragraph (h) thereof there

shall be added the following new paragraphs

"(i) the definition of requirements and

procedures for the designation of appropriate public

or private bodies authorised to assess the conformity

of qualified electronic signature creation devices and

qualified electronic seal creation devices with the

requirements of the Regulation, as well as the

designation itself of such bodies; and

(j) any fees and, or charges, however so

described, that may be payable in relation to any

matters regulated by or under this Act or by or under

the Regulation."; and

(b)

sub-article (3) thereof shall be deleted.

15. On the coming into force of articles 2, 3, 6, 13 and 17 of Revocation of

this Act, the Electronic Commerce (General) Regulations shall be the

Commerce

revoked.

(General)

Regulations.

16. Immediately after paragraph (i) of the First Schedule to the Amendment of

the First

principal Act there shall be added the following new paragraph

Schedule to the

principal Act.

"(j)

in relation to a regulated profession

-

any professional body or similar institution with

which the service provider is registered,

-

the professional title and the Member State

where it has been granted, and

-

a reference to the applicable professional rules

in the Member State of establishment and the means to

access them.".

17. The Second, Third and Fourth Schedules of the principal Deletion of the

Second, Third

Act shall be deleted.

and Fourth

Schedules to the

principal Act.

18. Immediately after the Fifth Schedule to the principal Act Addition of a

new Schedule to

there shall be added the following new Schedules

the principal

Act.

"Sixth Schedule

(Article 2)

Designation of competent regulator in accordance with article 2

In accordance with the provisions of article 2 within the

context of the definition "competent regulator", the following

public authority is being designated as the competent regulator

for all the purposes of the Act and of the Regulation

The Malta Communications Authority

Provided that unless stated otherwise in the Malta

Communications Authority Act (Cap. 418), the provisions of

Part VI entitled "Enforcement and Sanctions" of that Act shall

apply in relation to the exercise by the Malta Communications

Authority of any of its regulatory functions as the competent

regulator, in particular where the Malta Communications

Authority as the competent regulator considers that a breach of

the Act or of the Regulation may be liable to the imposition of a

sanction as provided for in article 31 of the Malta

Communications Authority Act (Cap. 418).

Seventh Schedule

(Article 8A)

Fields excluded in accordance with article 8A(4)

1. To the extent that the following national laws

implement the Directives referred to in the Annex to the

Electronic Commerce Directive namely

(a) the Copyright Act (Cap. 415), and the Patents

and Designs Act (Cap. 417) insofar as these laws relate to

copyright, neighbouring rights, rights referred to in

Directive 87/54/EEC and Directive 96/9/EC as well as

industrial property rights;

(b) article 5 of the Banking Act (Cap. 371) insofar

as it relates to the emission of electronic money by

institutions in respect of which Member States applied one

of the derogations provided for in article 8(1) of Directive

2000/46/EC;

(c) the Undertakings for Collective Investment in

Transferable Securities and Management Companies

Regulations (S.L. 370.11);

(d) the European Passport Rights for Insurance and

Reinsurance Undertakings Regulations (S.L. 403.14).

2. The freedom of the parties to a contract to choose

the applicable law.

3. Contractual

obligations

concerning

consumer

contracts.

4. Formal validity of contracts creating or transferring

rights in real estate where such contracts are subject to

mandatory formal requirements of the law of the Member State

where the real estate is situated.

5. The

permissibility

of

unsolicited

commercial

communications by electronic mail.".

19. The Maltese texts of the enactments in the First Column of Consequential

the Schedule to this Act shall have effect subject to the amendments amendment

of

other

appearing relative thereto in the Second Schedule of the said enactments.

Schedule.