ACT No. XX of 2018 AN ACT to repeal and to replace the Data Protection Act, Cap.

I assent.

(L.S.)

MARIE-LOUISE

COLEIRO PRECA

President

28th May, 2018

ACT No. XX of 2018

AN ACT to repeal and to replace the Data Protection Act, Cap.

440. BE IT ENACTED by the President, by and with the advice and

consent of the House of Representatives, in this present Parliament

assembled, and by the authority of the same, as follows:-

The short title of this Act is the Data Protection Act, 2018.

(Article 17)

Oath of Office

I ……………………………………… solemnly swear / affirm

that I will faithfully and conscientiously perform my duties as

(Information and Data Protection Commissioner / Officer of the

Information and Data Protection Commissioner / Employee of the

Information and Data Protection Commissioner) in terms of the Data

Protection Act, the General Data Protection Regulation and in

accordance with the laws of Malta, without fear or favour. (So help

me God).

This Act implements and further specifies the relevant

provisions of Regulation (EU) 2016/679 of the European Parliament

and of the Council of 27 April 2016 on the protection of natural

persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General

Data Protection Regulation).

(Article 27)

FORM A

Summons of Witnesses

INFORMATION AND DATA PROTECTION APPEALS

TRIBUNAL

DATA PROTECTION ACT

In the case

versus

Application of

Respectfully requests the issue of a summons of a witness in the

above-stated cause against the person mentioned hereunder to

attend for the hearing at the time stated hereunder, and at any

other hearing as may be required, and to bring with him/her any

documents referred to hereunder.

Name and address (home or work or e-mail) of the person

summoned to attend as a witness

……………………………………...........................................

…………………………………………………………………

Documents to be brought by him/her

…………………………………………………………………

Date, time and place where he/she is to attend

……………………………………………………………………

The said ……………………………………is hereby being

warned that should he/she fail to attend the sitting without

informing the Tribunal of his/her unavailability beforehand, he/

she may be compelled to attend by a warrant of escort and shall

be liable to all consequences according to the provisions of the

Code of Organization and Civil Procedure.

Given by order of the Information and Data Protection Appeals

Tribunal.

This, .................... day of .............................. 20...............

Passed by the House of Representatives at Sitting No. 117 of the 24

th May, 2018.

ANĠLU FARRUGIA

Speaker

RAYMOND SCICLUNA

Clerk of the House of Representatives

€2.52

(1)

In this Act unless the context otherwise requires -

"Commissioner" means the Information and Data Protection

Commissioner appointed under article 11 and includes any officer or

employee of the Commissioner authorised by him in that behalf;

"identity document" means a legally valid identity document as

provided in the Identity Card and other Identity Documents Act;

"Minister" means the Minister responsible for data protection;

"official statistics" shall mean information collected, analysed

and produced for the benefit of the society to characterize collective

phenomena in a considered population and produced by the National

Statistics Office as provided for by law, or by other national

authorities as designated by Eurostat following recommendation by

the National Statistics Office;

"the Regulation" means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal

data and on the free movement of such data, and repealing Directive

95/46/EC;

"Tribunal" means the Information and Data Protection Appeals

Tribunal established under article 24.

(2) The definitions in Article 4 of the Regulation shall apply to

this Act.

PART II

Applicability

(1) Subject to the provisions of sub-article (2), the

provisions of this Act shall apply to the processing of personal data,

wholly or partly, by automated means and to such processing other

than by automated means where such personal data forms part of a

filing system or is intended to form part of a filing system

Provided that this Act shall not apply to the processing of

personal data

(a)

in the course of an activity which falls outside the

scope of Union law;

(b) by the Government of Malta when carrying out

activities which fall within the scope of Chapter 2 of Title V of

the Treaty on European Union;

(c)

by a natural person in the course of a purely personal

or household activity; or

(d) by competent authorities for the purposes of the

prevention, investigation, detection or prosecution of criminal

offences or the execution of criminal penalties, including the

safeguarding against and the prevention of threats to public

security

Provided further that the Minister may by regulations, after

consultation with the Commissioner and with the concurrence of the

Minister responsible for the Police, make provisions on the

processing of personal data by competent authorities for the purposes

of the prevention, investigation, detection or prosecution of criminal

offences or the execution of criminal penalties, including the

safeguarding against and the prevention of threats to public security.

(2) This Act shall apply to

(a)

the processing of personal data in the context of the

activities of an establishment of a controller or a processor in

Malta or in a Maltese Embassy or High Commission abroad,

regardless of whether the processing takes place in Malta or not;

(b) the processing of personal data of data subjects who

are in Malta by a controller or processor not established in the

European Union, where the processing activities are related to

(i) the offering of goods or services, irrespective

of whether a payment of the data subject is required, to

such data subjects in Malta; or

(ii) the monitoring of their behaviour in so far as

their behaviour takes place within Malta;

(c)

the processing of personal data by a controller not

established in the Union but in a place where the laws of Malta

apply by virtue of public international law.

PART III

Restrictions, Consultation and Prior Authorisation

The Minister may, after consultation with the Commissioner

and with the concurrence of the Minister responsible for justice, by

regulations provide for a restriction to the obligations to which the data

controller or processor is subject pursuant to Article 23 of the

Regulation.

(1) Subject to the provisions of sub-article (4), controllers

and processors may derogate from the provisions of Articles 15, 16, 18

and 21 of the Regulation for the processing of personal data for

scientific or historical research purposes or official statistics in so far as

the exercise of the rights set out in those Articles

(a) is likely to render impossible or seriously impair the

achievement of those purposes; and

(b) the data controller reasonably believes that such

derogations are necessary for the fulfilment of those purposes.

(2) Subject to the provisions of sub-article (4), controllers and

processors may derogate from the provisions of Articles 15, 16, 18,

19, 20 and 21 of the Regulation for the processing of personal data for

archiving purposes in the public interest in so far as the exercise of

the rights set out in those Articles

(a) is likely to render impossible or seriously impair the

achievement of those purposes; and

(b) the controller reasonably believes that such

derogations are necessary for the fulfilment of those purposes.

(3) Where data processing referred to in sub-articles (1) and

(2) serves at the same time another purpose, the derogations shall

apply only to processing for the purposes referred to in those sub-

articles.

(4) Processing for the purposes referred to in sub-articles (1)

and (2) shall be subject to appropriate safeguards for the rights and

freedoms of the data subject, including pseudonymisation and other

technical and organisational measures to ensure respect for the

principle of data minimisation

Provided that, where such purposes can be fulfilled by

processing which does not permit, or no longer permits, the

identification of data subjects, those purposes shall be fulfilled in that

manner.

A controller shall consult with, and obtain prior Consultation

authorisation from, the Commissioner where the controller intends to and

authorisation.

process in the public interest

(a)

genetic data, biometric data or data concerning

health for statistical or research purposes; or

(b) special categories of data in relation to the

management of social care services and systems, including for

the purposes of quality control, management information and

the general national supervision and monitoring of such services

and systems

Provided that, where genetic data, biometric data or data

concerning health are required to be processed for research purposes,

the Commissioner shall consult a research ethics committee or of an

institution recognised by the Commissioner for the purposes of this

article.

An identity document shall only be processed when such Processing of an

processing is clearly justified having regard to the purpose of the identity

document.

processing and -

(a)

the importance of a secure identification; or

(b)

any other valid reason as may be provided by law

Provided that the national identity number or any other

identifier of general application shall be used only under appropriate

safeguards for the rights and freedoms of the data subject pursuant to

the Regulation.

(1) Personal data processed for the purpose of Freedom of

exercising the right to freedom of expression and information, expression

information.

including processing for journalistic purposes or for the purposes of

academic, artistic or literary expression, shall be exempt from

compliance with the provisions of the Regulation specified in sub-

article (2) where, having regard to the importance of the right of

freedom of expression and information in a democratic society,

compliance with any of the provisions as specified in sub-article (2)

would be incompatible with such processing purposes

Provided that when reconciling the right to the protection

of personal data with the right to freedom of expression and

information, the controller shall ensure that the processing is

proportionate, necessary and justified for reasons of substantial

public interest.

(2) For the purposes of the provisions of sub-article (1), the

provisions of the following chapters of the Regulation may be

exempted or derogated therefrom pursuant to Article 85(2) of the said

Regulation

(a)

Chapter II (Principles)

(i) Article 5(1)(a) to (e) (principles relating to

processing);

(ii)

Article 6 (lawfulness);

(iii) Article 7 (conditions for consent);

(iv) Article

(data

relating

to

criminal

convictions, etc);

(v) Article 11(2) (processing

not

requiring

identification);

(b)

Chapter III (rights of the data subject)

(i) Article 13(1) to (3) (personal data collected

from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected

other than from data subject);

(iii) Article 15(1) to (3) (access to data and

safeguards for third country transfers);

(iv) Article 17(1) and (2) (right to erasure);

(v) Article 18(1)(a), (b) and (d) (restriction of

processing);

(vi) Article

20(1)

and

(2)

(right

to

data

portability);

(vii) Article 21(1) (objections to processing);

(c)

Chapter IV (controller and processor)

(i)

Article 25 (data protection by design and by

default);

(ii) Article 27 (representatives of controllers or

processors not established in the Union);

(iii) Article 30 (records of processing activities);

(iv) Article 33 (notification of personal data

breach to supervisory authority);

(v) Article 34 (communication of personal data

breach to the data subject);

(vi) Article 42 (certification);

(vii) Article 43 (certification bodies);

(d)

Chapter VII (co-operation and consistency)

(i)

Articles 60 to 62 (co-operation);

(ii) Articles 63 to 67 (consistency).

PART IV

Transborder Data Transfers

In the absence of an adequacy decision pursuant to Article Limits to

45(3) of the Regulation, the Minister may, following consultation transborder

transfers.

with the Commissioner, by regulations set limits to the transfer of

specific categories of personal data to a third country or an

international organisation for important reasons of public interest.

PART V

The Information and Data Protection Commissioner

(1) There shall be an Information and Data Protection Information and

Commissioner, who shall be appointed by the Prime Minister after he Data

Commissioner.

has consulted with the Leader of the Opposition, to perform the duties

of supervisory authority for the purposes of Chapter VI of the

Regulation.

(2) The Commissioner shall be responsible for monitoring and

enforcing the application of the provisions of this Act and the

Regulation, in order to protect the fundamental rights and freedoms of

natural persons in relation to processing of personal data and to

facilitate the free flow of personal data between Malta and any other

Member State.

(3) A person shall not be qualified to hold office as

Commissioner if he

(a)

is a Minister, Parliamentary Secretary, or a Member

of the House of Representatives; or

(b)

is a judge or magistrate of the courts of justice; or

(c)

is an officer in the public service; or

(d)

is a member of a local council; or

(e)

has a financial or other interest in any enterprise or

activity which is likely to affect the discharge of his functions as

a Commissioner.

(4) The Information and Data Protection Commissioner shall

have the qualifications, experience and skills, in particular in the area

of the protection of personal data, required to perform his duties and

exercise his powers in accordance with the provisions of Article 53(2)

of the Regulation.

(1) In the exercise of his tasks and powers in accordance

with this Act and the Regulation, the Commissioner shall act with

complete independence and shall be free from external influence,

whether direct or indirect, and shall neither seek nor take instructions

or direction from any person or entity.

(2) It shall not be lawful for the Commissioner to carry out any

other profession, business or trade or to hold any other office of profit

whatsoever, even though of a temporary nature, with the exception of

any temporary judicial office on any international court or tribunal or

any international adjudicating body, and the office of examiner at a

University and the Malta College of Arts, Science and Technology.

(3) Any officers or employees of the Commissioner shall be

chosen by the Commissioner and shall be subject to his exclusive

direction.

(1) The Commissioner shall have a separate and distinct

legal personality and shall be capable of entering into contracts, of

acquiring, holding and disposing of any kind of property for the

purposes of his tasks and powers, of suing and being sued, and of

doing all such things and entering into all such transactions as are

incidental or conducive to the effective performance of his tasks and

exercise of his powers under this Act and the Regulation.

(2) Any document purporting to be an instrument made or

issued by the Commissioner and signed by him shall be received in

evidence and shall, until the contrary is proved, be deemed to be an

instrument made or issued by the Commissioner.

(1) The Commissioner shall hold office for a term of Tenure of office.

five years and shall be eligible for reappointment on the expiration of

his term of office.

(2) The Commissioner shall not be removed from his office

except by the Prime Minister upon an address of the House of

Representatives supported by the votes of not less than two-thirds of

all the members thereof and praying for such removal on the ground

of proved inability to perform the duties of his office (whether arising

from infirmity of body or mind or any other cause) or proved

misbehaviour.

(3) The Commissioner shall nominate a person from his office

to act as Deputy Commissioner and who shall have the qualifications,

experience and skills, in particular in the area of the protection of

personal data.

(4) If the Commissioner resigns, if his office is otherwise

vacant, if for any reason he is unable to perform the duties of his

office, or for any other temporary purpose where the Commissioner

considers it necessary not to carry out any of his duties that were he a

judge of the superior courts he would abstain, the Deputy

Commissioner shall perform the Commissioner’s duties and exercise

his powers in accordance with the provisions of Article 53(2) of the

Regulation.

(1) The Commissioner shall perform the duties assigned Functions and

to him under this Act and the Regulation and shall carry out the duties

Commissioner.

functions assigned to him under the Freedom of Information Act and Cap. 496.

any other law.

(2) The Commissioner shall have the power to institute civil

judicial proceedings in cases where the provisions of this Act or the

Regulation have been or are about to be violated.

(3) The Commissioner may seek the advice of, and may

consult with, any other competent authority in the exercise of his

functions under this Act and the Regulation.

(1) In the exercise of the investigative powers pursuant Commissioner’s

to Article 58 of the Regulation, or any other law, the Commissioner right

to information.

may request the assistance of the executive police in order to enter

and search any premises.

(2) In the event of joint operations with supervisory authorities

of one or more other Member States the Commissioner may, where

appropriate, in accordance with the provisions of Article 63 of the

Regulation, confer powers, including investigative powers, on the

seconding supervisory authority’s members or staff

Provided that such powers are exercised under the

guidance and in the presence of the Commissioner.

(1) The Commissioner and any officer and employee of

the Commissioner shall, before assuming their duties, take the oath of

office set out in the First Schedule, to carry out their duties with

equity and impartiality and in accordance with the provisions of this

Act and the Regulation, and shall be subject to the provisions of the

Official Secrets Act, Professional Secrecy Act and the Code of Ethics

applicable to public officers.

(2) The oath of office shall be taken before the Attorney

General.

(1) The financial resources required by the

Commissioner for the effective performance of his tasks and exercise

of his powers under this Act and the Regulation, under the Freedom

of Information Act and under any other law, as may be fixed by the

House of Representatives in accordance with this article, shall be a

charge on the Consolidated Fund without the need of any further

appropriation other than this Act.

(2) Where during the course of any financial year the sum

fixed by the House of Representatives is, in the opinion of the

Commissioner, insufficient to enable him to efficiently and

effectively fulfil his functions, the Commissioner shall prepare

supplementary estimates for consideration by the House of

Representatives.

(3) The Commissioner shall cause to be prepared in every

financial year, and shall not later than six months after the end of each

such year adopt, estimates of the income and expenditure of the

Commissioner for the next following financial year.

(4) A copy of the estimates shall, upon their adoption by the

Commissioner, be sent forthwith to the Minister and to the Minister

responsible for finance.

(5) The Minister shall at the earliest opportunity, and not later

than six weeks after he has received a copy of the estimates from the

Commissioner, approve the same with or without amendment after

consultation with the Minister responsible for finance.

(1) The Commissioner shall cause to be kept proper Accounts and

accounts and other records in respect of his operations under this Act, audit.

the Regulation and under the Freedom of Information Act and any Cap. 496.

other law, and shall cause to be prepared a statement of accounts in

respect of each financial year.

(2) The accounts of the Commissioner shall be audited by an

auditor or auditors to be appointed by the Commissioner

Provided that the Minister responsible for finance may,

after consultation with the Minister, require the books or the accounts

of the Commissioner to be audited or examined by the Auditor

General who shall for the purpose have the power to carry out such

physical checking and other certifications as he may deem necessary.

(3) After the end of each financial year, and not later than the

date on which the estimates of the Commissioner are forwarded to the

Minister under article 18(4), the Commissioner shall cause a copy of

the statement of account duly audited to be transmitted to the Minister

and to the Minister responsible for finance together with a copy of

any report made by the auditors on that statement or on the accounts

of the Commissioner.

(4) The Minister shall, at the earliest opportunity and not later

than eight weeks after he has received a copy of every such statement

and report, or if at any time during that period the House of

Representatives is not in session, within eight weeks from the

beginning of the next following session, cause every such statement

and report to be laid on the Table of the House of Representatives.

(5) The Commissioner shall, by not later than six months after

the end of each financial year, make and transmit to the Minister and

to the Minister responsible for finance a report dealing generally with

the activities of the Commissioner during the financial year and

containing such information relating to the proceedings and policy of

the Commissioner as either of the said Ministers may from time to

time require. The Minister shall, at the earliest opportunity and not

later than eight weeks after he has received a copy of every such

report, or if at any time during that period the House of

Representatives is not in session, within eight weeks from the

beginning of the next following session, cause a copy of every such

report to be laid on the Table of the House of Representatives.

PART VI

Administrative Fines and Penalties

(1) Where the Commissioner imposes an administrative

fine, he shall by order in writing require the controller or processor, as

the case may be, to pay such administrative fine, which shall be due

to the Commissioner as a civil debt

Provided that such order shall be subject to the appeal

procedure as established under article 26.

(2) In the absence of an appeal, the decision of the

Commissioner shall become final and shall constitute an executive

title for the purposes of Title VII of the Code of Organization and

Civil Procedure as if the decision had been ordered by a judgement of

a court of civil jurisdiction.

(3) Where a notice imposing an administrative fine is served

on a person and -

(a)

such person fails to appeal within such time as an

appeal may be entered under article 26, and fails to pay the fine

so imposed; or

(b) such person appeals within such time to the Tribunal

and the appeal is withdrawn or the Tribunal confirms the fine in

the amount fixed by the Commissioner or in an amount reduced

by it and no further appeal is filed with the Court of Appeal, or

if an appeal is filed with the Court of Appeal and such Court

either confirms the decision taken or decides that a penalty is

due in another amount, or the imposed penalty is not paid within

fifteen days from the date of the decision or the withdrawal of

the appeal, or the date when the Tribunal or the Court of Appeal

confirms or varies the penalty as aforesaid,

the Commissioner shall be entitled to take civil action to recover the

amount due.

The Commissioner may, after giving due regard to the

circumstances of the case pursuant to Article 83(2) of the Regulation,

impose an administrative fine on a public authority or body

Provided that such a fine shall not exceed twenty-five

thousand euro (€25,000) for each violation and, additionally, the

Commissioner may impose a daily fine payment of twenty-five euro

(€25) for each day during which such violation persists, which fine

shall be determined and imposed by the Commissioner in accordance

with the procedure under article 26 for an infringement of Article

83(4) of the Regulation

Provided further that such a fine shall not exceed fifty

thousand euro (€50,000) for each violation and, additionally, the

Commissioner may impose a daily fine payment of fifty euro (€50)

for each day during which such violation persists, which fine shall be

determined and imposed by the Commissioner, in accordance with

the procedure stipulated under article 26 for an infringement of

Articles 83(5) or 83(6) of the Regulation.

Without prejudice to the provisions of article 21 and Offences.

Article 83 of the Regulation, any person who -

(a)

knowingly provides false information to the

Commissioner when so requested by the Commissioner

pursuant to his investigative powers under Article 58 of the

Regulation, or any other law; or

(b) does not comply with any lawful request pursuant to

an investigation by the Commissioner,

shall be guilty of an offence against this article and shall, upon

conviction, be liable to a fine (multa) of not less than one thousand,

two hundred and fifty euro (€1,250) and not more than fifty thousand

euro (€50,000) or to imprisonment for six months or to both such fine

(multa) and imprisonment

Provided that no proceedings shall be instituted in respect

of any offence under this article except where the Commissioner

provides information to any officer of the Executive Police.

(1) Where the Commissioner exercises his powers Methods of

pursuant to the Regulation, or any other law, the decision of the service.

Commissioner shall forthwith be served on the person to whom the

decision is addressed, which decision shall be served either

personally, by registered post to the person’s last known business or

private address, or by electronic means that provide a reliable record

of when service took place.

(2) In the case of service by electronic means, the decision

shall be deemed to have been served upon each person to whom the

decision is addressed when the Commissioner has received

(a)

an electronic receipt automatically generated by the

e-mail server when the communication is read;

(b)

a written confirmation by return electronic mail

from the person to whom the decision is addressed; or

(c)

a verbal confirmation from the person to whom the

decision is addressed that the electronic mail was received.

(3) If service is not effected within a week of issuing the

decision, because the person to whom the decision refers could not be

found or for any other reason attributable to the person to whom the

decision is addressed, the Commissioner shall publish a notice in the

Gazette and in one or more daily newspapers, stating that a decision

has been taken in respect of the person to whom the decision is

addressed and inviting him to collect the decision from the

Commissioner’s office. In any such case, service shall be deemed to

have been effected on the third day after the date of publication of the

last notice.

PART VII

Appeals

(1) There shall be a tribunal to be known as the

Information and Data Protection Appeals Tribunal, referred to in this

Act as ''the Tribunal'', having the functions and powers assigned to it

by this Act or by any other law.

(2) The Tribunal shall consist of a chairperson and two other

members appointed by the Minister.

(3) The chairperson shall be an advocate with a minimum of

twelve years legal experience and shall have the qualifications,

experience and skills, in particular in the area of the protection of

personal data, required to fulfil his role.

(4) The two other members mentioned in sub-article (2) shall

be persons who, in the opinion of the Minister, equally represent the

interests of data subjects on the one hand, and of data controllers and

data processors on the other, and who have the qualifications,

experience and skills, in particular in the area of the protection of

personal data, required to fulfil their roles.

(5) The chairperson and other members of the Tribunal shall

hold office for a period of three years and cannot be removed during

their term of office except on grounds of proved inability to perform

the functions of their office, whether arising from infirmity of body or

mind or any other cause, or proved misbehaviour.

(6) A member of the Tribunal may be challenged or abstain for

any of the reasons for which a judge may be challenged or abstain in

accordance with article 734 of the Code of Organization and Civil Cap. 12.

Procedure. In any such case the Minister shall appoint a person,

having the qualifications of the member challenged or abstaining, to

sit as a member of the Tribunal in substitution of the said member.

(7) A member of the House of Representatives or of a local

council, a judge or a magistrate, or an officer in the public service

shall be disqualified from being appointed or continuing to be a

member of the Tribunal for so long as he holds that office.

(8) The Minister shall also designate a person to serve as

secretary to the Tribunal.

(1) There shall be a Registry of the Tribunal and all Registry of the

Information and

records shall be filed therein and made accessible to the public.

Data Protection

Appeals

Tribunal.

(2) The Secretary to the Tribunal shall be responsible for

managing the Registry. The Secretary shall also perform any other

duty which may be incumbent upon him under this Act or any rules

made thereunder.

(1) Any person to whom a legally binding decision of Procedure.

the Commissioner is addressed, shall have the right to appeal in

writing to the Tribunal within twenty days from the service of the said

decision as provided in article 23.

(2) An appeal to the Tribunal may be made on any of the

following grounds

(a)

that a material error as to the facts has been made;

(b)

that there was a material procedural error;

(c)

that an error of law has been made;

(d) that there was some material illegality, including

unreasonableness or lack of proportionality.

(3) An appeal from a decision of the Commissioner shall be

filed in the Registry of the Tribunal and shall contain

(a)

the grounds on which such appeal is based;

(b) the names of the witnesses the appellant intends to

produce in evidence, together with their full address, stating in

respect of each of them the facts and proof he intends to

establish by their evidence; and

(c)

any other documents as may be necessary in support

of the appeal.

(4) The Registry of the Tribunal shall, no later than ten days

from the date of filing of the appeal

(a)

serve a copy of the appeal on the Commissioner, and

request him to file a statement on his decision together with any

other information on which such decision was based, within

twenty days from the date when the appeal was served; and

(b) serve a copy of the appeal on the respondent or

respondents to the appealed decision, and request the

respondent or respondents to file a reply within twenty days of

service of the appeal.

(5) The respondent or respondents shall file their reply to the

appeal in the Registry of the Tribunal within twenty days of service of

the appeal. Such reply shall contain

(a)

a statement of the facts upon which the respondent

bases his rebuttal of the appellant’s claim;

(b) the names of the witnesses the respondent intends to

produce in evidence, together with their full address, stating, in

respect of each of them, the facts and proof he intends to

establish by their evidence; and

(c)

any other documents as may be necessary in support

of the defence.

(6) The reply, together with any documents in support thereof,

shall be served without delay on the appellant and on the

Commissioner by the Tribunal.

(7) Upon the expiry of the time-limits for filing the

Commissioner’s statement and the reply, the Tribunal shall fix a date

and time for the hearing. The Tribunal shall notify such date and time

to the appellant, the respondent or respondents to the appealed

decision and to the Commissioner.

(8) The parties to an appeal may be represented or assisted by

their advocates or legal procurators, or by any other person who

enjoys their trust

Provided that no person shall claim fees for representing or

assisting a party before the Tribunal unless such assistance is

provided by an advocate or legal procurator.

(1) The Tribunal shall be competent to hear and decide Competence of

any appeal made to it in accordance with the provisions of this Act the Tribunal.

and, subject to the provisions of article 29, the decisions of the

Tribunal shall be final and binding.

(2) The Tribunal may summon any person to appear before it

to give evidence and produce documents. The Tribunal may also

appoint experts to advise it on any technical issue that may be

relevant to its decision. On the day appointed by the Tribunal for the

hearing of the appeal, it shall hear, under oath, the evidence of the

appellant and of the respondent, as well as of other witnesses. The

secretary shall issue the necessary summons by the method of service

referred to in article 23 for any person involved in the hearing of the

appeal.

(3) The Tribunal shall hold its sittings in public unless, having

regard to the nature of the appeal or any other matter before it, it

deems it proper to conduct the proceedings or part thereof in private.

(4) The Tribunal shall have the same powers as are competent

to the First Hall, Civil Court according to law.

(5) Without prejudice to the provisions of this Act or any other

law, the Tribunal shall regulate its own procedure.

(6) If any party requires the attendance of witnesses, that party

shall complete Form A in the Second Schedule, which shall be signed

by the Chairman of the Tribunal and served on each witness in

accordance with sub-article (2).

(1)

In determining an appeal the Tribunal may

Decisions of the

Tribunal.

(a)

dismiss the appeal and confirm the decision in its

entirety;

(b)

substitute the decision;

(c)

modify or vary the decision; or

(d)

annul the decision.

(2) The Tribunal shall give reasons for its decision and shall

cause such decision to be made public omitting, if it deems it

appropriate for reasons of confidentiality, the identity of the persons

involved.

(3) The effects of a decision of the Commissioner which is

appealed from shall not, except where the Tribunal or the Court of

Appeal, as the case may be, so orders, be suspended by virtue of the

appeal

Provided that any administrative fine imposed by the

Commissioner shall not apply until the person on whom the

administrative fine is imposed has exhausted all legal remedies

provided pursuant to articles 26 and 29, or if the person to whom the

decision is addressed has permitted the relevant time-limits to expire

without availing himself of the said legal remedies.

(4) The decisions of the Tribunal shall be notified to all parties

to the appeal and to the Commissioner, by any of the methods of

service referred to in article 23.

Any party to an appeal before the Tribunal who feels

aggrieved by a decision of the Tribunal, or the Commissioner if he

feels aggrieved by any such decision, may appeal to the Court of

Appeal as constituted in accordance with article 41(6) of the Code of

Organization and Civil Procedure by means of an application filed in

the registry of that court within twenty days from the date on which

the decision of the Tribunal was notified pursuant to article 26.

(1) Without prejudice to any other remedy available to

him, including the right to lodge a complaint with the Commissioner,

a data subject may, where he believes that his rights under the

Regulation or this Act have been infringed as a result of the

processing of his personal data in contravention of the provisions of

the Regulation or this Act, by sworn application filed before the First

Hall of the Civil Court, institute an action for an effective judicial

remedy against the controller or processor concerned.

(2) A data subject may also, by sworn application filed before

the First Hall of the Civil Court, institute an action for damages

against the controller or processor who processes personal data in

contravention of the provisions of the Regulation or this Act.

(3) If in determining an action under sub-article (2) the court

finds that the controller or processor is liable for the damage caused

pursuant to Article 82 of the Regulation, the court shall determine the

amount of damages, including, but not limited to, moral damages as

the court may determine, due to the data subject.

(4) Any action under this article shall be instituted within a

period of twelve months from the date when the data subject became

aware, or ought to have reasonably become aware, of such a

contravention, whichever is the earlier.

(1) Where the Commissioner fails to act in accordance Actions against

with Article 78(2) of the Regulation, the data subject may appeal to the

Commissioner.

the Tribunal in accordance with the procedures established in article

26. (2) Where the Tribunal finds that such an appeal is justified it

shall, where appropriate, order the Commissioner to update the data

subject on the progress or outcome of the complaint lodged or order

the Commissioner to handle the complaint lodged in accordance with

Article 77(1) of the Regulation.

PART VIII

General Provisions

(1) The certification bodies referred to in Article 43 of Accreditation of

the Regulation shall be accredited by the National Accreditation certification

bodies.

Board (Malta) as established by regulation 3 of the National S.L. 419.07

Accreditation Board (Malta) (Establishment) Regulations.

(2) The Board referred to in sub-article (1) shall accredit

certification bodies in accordance with EN-ISO/IEC 17065/2012 and

with the additional criteria and requirements established by the

Commissioner.

(3) For the purposes of this article, the National Accreditation

Board (Malta) may consult the Commissioner in the process of

accrediting certification bodies.

(4) Where the Commissioner concludes that the conditions for

accreditation are not, or are no longer met, or where action taken by a

certification body infringes the Regulation, the Commissioner shall

advise the National Accreditation Board (Malta) not to issue such

accreditation, or to revoke such accreditation, as the case may be.

The Minister may, after consultation with the Power to make

Commissioner, prescribe regulations for the better carrying out of the regulations.

provisions of this Act and the Regulation, and without prejudice to

the generality of the foregoing and the provisions of the Regulation,

may in particular prescribe regulations concerning

(a)

any fees that may be levied by the Commissioner;

(b)

the criminal penalties that may be imposed under

this Act;

(c)

for establishing rules, procedures, formalities and

time limits in respect of any matter provided for under this Act;

(d) the extension of the application of this Act to any

particular activity or sector and to provide for the manner in

which data protection is to be implemented in specific sectors or

in respect of specific activities;

(e)

for anything that may be prescribed under any of the

provisions of this Act or the Regulation;

(f)

the cases, other than those referred to in Article

37(1) of the Regulation, where the controller or processor or

associations and other bodies representing categories of

controllers or processors shall designate a data protection

officer;

(g) the establishment of a lower age than sixteen years

where the processing of the personal data of a child shall be

deemed to be lawful in the absence of consent by the holder of

parental responsibility over the child, provided that such lower

age is not below thirteen years pursuant the provisions of

Article 8(1) of the Regulation;

(h)

to amend the Schedules to this Act; and

(i)

on any other matter relating to data protection.

(1) The Data Protection Act, hereinafter referred to as

"the repealed Act", is hereby repealed, and any references in any law

to the repealed Act shall be construed as references to this Act.

(2) Notwithstanding the provisions of sub-article (1)

(a)

the repealed Act shall remain in force for the

purpose of any act, decision, action or proceedings taken in

respect of any breach of the repealed Act that occurred or were

instituted prior to the coming into force of this Act; and

(b) any subsidiary legislation made under the provisions

of the repealed Act shall, until other provision is made under or

by virtue of this Act, continue in force and have effect as if it

was made under this Act.

(1) This article amends the Passenger Name Record

(Data) Act, and it shall be read and construed as one with the

Passenger Name Record (Data) Act, hereinafter in this article referred

to as "the principal Act".

(2) In the proviso to paragraph (b) of sub-article (3) of article 5

of the principal Act, for the words "Data Protection (Processing of

Personal Data in the Police Sector) Regulations" there shall be

substituted the words "Data Protection (Processing of Personal Data

by Competent Authorities for the Purposes of the Prevention,

Investigation, Detection or Prosecution of Criminal Offences or the

Execution of Criminal Penalties) Regulations, 2018".

(3) In sub-article (2) of article 6 of the principal Act, for the

words "Data Protection (Processing of Personal Data in the Police S.L. 440.05.

Sector) Regulations" there shall be substituted the words "Data

Protection (Processing of Personal Data by Competent Authorities for

the Purposes of the Prevention, Investigation, Detection or

Prosecution of Criminal Offences or the Execution of Criminal

Penalties) Regulations, 2018".

(4) In paragraph (a) of sub-article (1) of article 12 of the

principal Act, for the words "Data Protection (Processing of Personal S.L. 440.05.

Data in the Police Sector) Regulations" there shall be substituted the

words "Data Protection (Processing of Personal Data by Competent

Authorities for the Purposes of the Prevention, Investigation,

Detection or Prosecution of Criminal Offences or the Execution of

Criminal Penalties) Regulations, 2018".

(5) In sub-article (2) of article 12 of the principal Act, for the

words "Data Protection (Processing of Personal Data in the Police S.L. 440.05.

Sector) Regulations" there shall be substituted the words "Data

Protection (Processing of Personal Data by Competent Authorities for

the Purposes of the Prevention, Investigation, Detection or

Prosecution of Criminal Offences or the Execution of Criminal

Penalties) Regulations, 2018".

(6) In sub-article (1) of article 14 of the principal Act, for the

words "Data Protection (Processing of Personal Data in the Police S.L. 440.05.

Sector) Regulations" there shall be substituted the words "Data

Protection (Processing of Personal Data by Competent Authorities for

the Purposes of the Prevention, Investigation, Detection or

Prosecution of Criminal Offences or the Execution of Criminal

Penalties) Regulations, 2018".

(7) In sub-article (2) of article 14 of the principal Act, for the

words "Data Protection (Processing of Personal Data in the Police S.L. 440.05.

Sector) Regulations" there shall be substituted the words "Data

Protection (Processing of Personal Data by Competent Authorities for

the Purposes of the Prevention, Investigation, Detection or

Prosecution of Criminal Offences or the Execution of Criminal

Penalties) Regulations, 2018".

(8) In sub-article (1) of article 16 of the principal Act, for the

words "Data Protection (Processing of Personal Data in the Police S.L. 440.05.

Sector) Regulations" there shall be substituted the words "Data

Protection (Processing of Personal Data by Competent Authorities for

the Purposes of the Prevention, Investigation, Detection or

Prosecution of Criminal Offences or the Execution of Criminal

Penalties) Regulations, 2018".