ELECTRONIC COMMERCE ACT

CHAPTER 426

ELECTRONIC COMMERCE ACT

AN ACT to provide in relation to electronic commerce and to provide for

matters connected therewith or ancillary thereto.

10th May, 2002

ACT III of 2001, as amended by Acts XXVII of 2002, VII of 2004 and

XIII of 2005; Legal Notice 426 of 2007; and Acts XXX of 2007, XII of 2010,

XXXV of 2016 and XXXIII of 2021 * , XVII of 2023 and I of 2024.

P ART I

P RELIMINARY

The short title of this Act is the Electronic Commerce Act.

Amended by

VII. 2004.52;

(Article 11)

XXX. 2007.52;

XXXV. 2016.16.

Information Requirements

Relating to Electronic Contracts

(a) the name and address where the service provider is established;

(b) the electronic-mail address where the service provider can be contracted in a

direct manner;

(c) the registration number of the service provider in any trade register or of any

professional body if applicable;

(d) where the activity of the service provider is subject to an authorisation, the

activities covered by the authorisation granted to the service provider and the

particulars of the authority providing such authorisation;

(e) the Value Added Tax (VAT) registration number of the service provider where

the service provider undertakes an activity that is subject to VAT;

(f)

the different steps to follow to conclude the contract;

(g) the technical means for identifying and correcting input errors prior to the

placing of the order;

(h) the language or languages in which the contract may be concluded;

(i)

a statement of whether the concluded contract will be filed by the service

provider and whether it will be accessible;

(j)

in relation to a regulated profession

-

any professional body or similar institution with which the service

provider is registered,

-

the professional title and the Member State where it has been granted,

and

-

a reference to the applicable professional rules in the Member State of

establishment and the means to access them.

In this Act, the definitions contained in Article 3 of the

Regulation shall apply and, unless the context otherwise requires -

"the Act" means the Electronic Commerce Act and includes,

unless the context otherwise requires, any regulations made

thereunder;

"addressee" in relation to an electronic communication means a

person who is intended by the service provider to receive the

electronic communication, but does not include a person acting as a

service provider with respect to the processing, receiving or storing

of that electronic communication or providing other services with

respect to it;

"certificate" means any one of the following

(a) a certificate for electronic signature;

(b) a certificate for electronic seal; or

(c) a certificate for website authentication;

"certificate service provider" means the trust service provider that

issues certificates;

"commercial communication" means any form of communication

designed to promote directly or indirectly, the goods, services or image

of a company, organisation or person pursuing a commercial,

industrial or craft activity or exercising a regulated profession. The

following do not in themselves constitute commercial

communications

(a) information allowing direct access to the activity of

the company, organisation or person, in particular the

domain name of an electronic mail address;

(b) communications relating to the goods, services or

image of the company, organisation or person

compiled in an independent manner, particularly when

this is without financial consideration;

"competent regulator" means any such public body as may be

*See commencement notice LN 296 of 2021.

designated by the Minister according to the Sixth Schedule to act as

the regulatory body tasked with ensuring compliance with this Act

and, or with the Regulation

Provided that the Minister may amend such Schedule by

Order in the Gazette, and in doing so may provide for the exercise

of the regulatory powers of the regulatory body designated to act as

the competent regulator for the purposes of this Act

Provided further that in doing so the Minister may

designate different public bodies to administer and enforce

different provisions of this Act and, or of the Regulation. In doing

so the Minister shall clearly establish the remit of each such public

body ensuring also that there is effective co-ordination between

such bodies;

"consumer" means any natural person who is acting for purposes

which are outside his trade, business or profession;

"coordinated field" means requirements applicable to

information society service providers or information society

services, regardless of whether they are of a general nature or

specifically designed for them, and covers requirements with which

the service provider has to comply in respect of

(a) the taking up of the activity of an information society

service,

such

as

requirements

concerning

qualifications, authorisation or notification;

(b) the pursuit of the activity of an information society

service, such as requirements concerning the

behaviour of the service provider, requirements

regarding the quality or content of the service,

including those applicable to advertising and

contracts, or requirements concerning the liability of

the service provider,

but does not cover requirements such as those applicable to goods

as such, to the delivery of goods or to services not provided by

electronic means;

"cross-border infringement" means

(a) an act or omission contrary to this Act and, or to the

Regulation which takes place in Malta and which

harms or is likely to harm the collective interests of

consumers residing in a Member State or in Member

States other than Malta; or

(b) an act or omission contrary to this Act and, or to the

Regulation by a seller or supplier who is established in

Malta and which harms or is likely to harm the

collective interests of consumers residing in a Member

State or in Member States other than Malta; or

(c) an act or omission contrary to this Act and, or to the

Regulation which takes place in Malta and which

harms or is likely to harm the collective interests of

consumers residing in a Member State or in Member

States other than Malta where the evidence or assets

pertaining to the act or omission are to be found in

Malta;

"data" means a representation of information, knowledge, facts,

concepts or instructions that has been prepared or is being prepared

in any manner and has been processed, is being processed or is

intended to be processed in an information system, a computer

system or a computer network. Data may be in any form or derived

from any device or source, including computer memory, computer

printouts, any storage media, electronic or otherwise and punched

cards;

"data storage device" means any thing, including a disk, from

which data and information is capable of being reproduced with or

without the aid of any thing or device;

"electronic communication" means information generated,

communicated, processed, sent, received, recorded, stored or

displayed by electronic means;

"electronic contract" means a contract concluded wholly or

partly by electronic communications or wholly or partly in an

electronic form;

"Electronic Commerce Directive" means Directive 2000/31/EC

of the European Parliament and of the Council of 8 June 2000 on

certain legal aspects of information society services, in particular

electronic commerce, in the internal market;

"enforcement action" means any form of enforcement action,

however so described, including the imposition of any sanctions

that an enforcement authority, including the competent regulator, is

empowered to take at law;

"enforcement authority" means any public entity which at law is

authorised to take enforcement action, but does not include a court

however so described;

"European Commission" or "Commission" means the European

Commission of the European Union;

"information" includes information in the form of data, text,

images, sound or speech;

"information society service" means any service which is

provided at a distance, by electronic means and at the individual

request of a recipient of the service, whether such service is

provided for consideration or not, and for the purposes of this

definition

(a) "at a distance" means that the service is provided

without the parties being simultaneously present;

(b) "by electronic means" means that the service is sent

initially and received at its destination by means of

electronic equipment for the processing (including

digital compression) and storage of data, and entirely

transmitted, conveyed and received by wire, by radio,

by optical means or by any electromagnetic means;

(c) "at the individual request of a recipient of the service"

means that the service is provided through the

transmission of data on individual request;

"information system" means a system for generating, sending,

receiving, recording, storing or otherwise processing electronic

communications;

"information technology requirements" includes software,

network and data storage requirements;

"Member State" means a Member State of the European Union;

"Minister" means the Minister responsible for communications;

"place of business" in relation to a government, an authority of a

government, a public body, a charitable, philanthropic or similar

institution means a place where any operations or activities are

carried out by that government, authority, body or institution;

"prescribed" means prescribed by regulations made by the

Minister in accordance with the provisions of this Act;

"recipient of the service" means any person w ho uses an

information society service for the purposes of seeking information

or making it accessible;

"regulated profession" means any profession within the meaning

of either

(a) Article 1(d) of the European Council Directive 89/48/

EEC of the 21 December 1988 on a general system for

the recognition of higher education diplomas awarded

on completion of professional education and training

for a duration of at least three years; or

(b) Article 1(f) of the European Council Directive 92/51/

EEC of the 18 June 1992 on a second general system

for the recognition of professional education and

training to supplement Directive 89/84/EEC;

"Regulation" means Regulation number 910/2014 of the

European Parliament and of the Council of 23 July 2014 on

electronic identification and trust services for electronic

communications in the internal market and repealing Directive

1999/93/EC;

"service provider" means any person established in Malta

providing an information society service;

"transaction" includes a transaction of a non-commercial nature;

" Tr i b u n a l ” m e a n s t h e A d m i n i s t r a t i v e R e v i e w Tr i b u n a l

established by article 5 of the Administrative Justice Act;

"Union" means the European Union.

PART II

APPLICATION OF LEGAL REQUIREMENTS TO

ELECTRONIC COMMUNICATIONS AND TRANSACTIONS

(Article 2)

Requirements for Qualified Certificates

(Deleted by Act XXXV. 2016.17.).

ELECTRONIC COMMERCE

For the purposes of any law in Malta and subject to the

other provisions of this Act, a transaction is not deemed to be

invalid merely because it took place wholly or partly by means of

one or more electronic communications.

(Article 2)

Requirements for Signature Certification Service

Providers Issuing Qualified Certificates

(Deleted by Act XXXV. 2016.17.).

(1) Unless otherwise prescribed, the provisions of this Act

shall not apply to those activities or areas as are listed in the Fifth

Schedule. The Minister may, after consultation with the competent

regulator, by notice in the Gazette, amend the Fifth Schedule.

(2)

Where the Minister is of the opinion that -

(a) technology has advanced to such an extent, and access

to it is so widely available, or

(b) adequate procedures and practices have developed in

public registration or other services, so as to warrant

such action, or

(c) the public interest so requires,

he may, after consultation with that Minister as in his opinion has

sufficient interest or responsibility in relation to the matter, by

Order in the Gazette extend the application of this Act or a

provision of this Act to or in relation to a matter specified in sub-

article (1) above, including the applicability to a particular area or

subject, or for a particular time, for the purposes of a trial of the

technology and procedures, subject to such conditions as he thinks

fit.

(Article 2)

Requirements for Secure Signature-Creation Devices

(Deleted by Act XXXV. 2016.17.).

(1) If under any law in Malta a person is required or

permitted to give information in writing, that requirement shall be

deemed to have been satisfied if the person gives the information

by means of an electronic communication

Provided that -

(a) at the time the information was given, it was

reasonable to expect that the information would be

readily accessible so as to be usable for subsequent

reference; and

(b) if the information is required to be given to a person,

or to another person on his behalf, and the first

mentioned person requires that the information be

given in accordance with particular information

technology requirements, by means of a particular

kind of electronic communication, that person’s

requirement has been met; and

(c) if the information is required to be given to a person who

is neither a public body nor to a person acting on behalf

of a public body, then the person to whom the

information is required or permitted to be given, consents

to the information being given by means of an electronic

communication;

(d) if the information is required to be given to a person,

or to another person on his behalf, and the first

mentioned person requires that a particular action be

taken by way of verifying the receipt of the

information, that person’s requirement has been met.

(2) For the purposes of this article, giving information

includes, but is not limited to, the following

(a) making an application;

(b) making or lodging a claim;

(c) giving, sending or serving a notification;

(d) lodging a return;

(e) making a request;

(f)

making a declaration;

(g) lodging or issuing a certificate;

(h) lodging an objection; and

(i)

making a statement.

(3) For the purposes of this article, a requirement or

permission in relation to a person to give information shall extend

to and shall be equally applicable to the requirement or information

which is stated to be sent, filed, submitted, served or otherwise

transmitted and includes similar or cognate expressions, thereof.

Added by

VII. 2004.53.

(Article 4)

Amended by

XXX. 2007.55;

Activities or areas listed in accordance with article 4 XXXIII. 2021.23.

(a)

the field of taxation;

(b) matters in relation to information society services covered by any laws relating

to data protection and, or privacy;

(c) questions in relation to agreements or practices governed by competition

law; and

(d)

the following activities of information society services

(i)

the representation of a client and defence of his interests before the

courts,

(ii) gambling activities which involve wagering a stake with monetary value

in games of chance, including lotteries and betting transactions.

ELECTRONIC COMMERCE

(Deleted by Act XXXV. 2016.5.).

Added by

XXXV. 2016.18.

(Article 2)

Designation of competent regulator in accordance

with article 2

In accordance with the provisions of article 2 within the context of the definition

"competent regulator", the following public authority is being designated as the

competent regulator for all the purposes of the Act and of the Regulation

The Malta Communications Authority

Provided that unless stated otherwise in the Malta Communications Authority Act

(Cap. 418), the provisions of Part VI entitled "Enforcement and Sanctions" of that

Act shall apply in relation to the exercise by the Malta Communications Authority of

any of its regulatory functions as the competent regulator, in particular where the

Malta Communications Authority as the competent regulator considers that a breach

of the Act or of the Regulation may be liable to the imposition of a sanction as

provided for in article 31 of the Malta Communications Authority Act (Cap. 418).

(1) Unless otherwise provided by or under this Act, if

under any law in Malta, a person is required to produce a document

that is in the form of a paper, or of any other substance or material,

that requirement is deemed to have been satisfied if the person

produces, by means of an electronic communication, an electronic

form of that document

Provided that

(a) having regard to all the relevant circumstances at the

time of the communication, the method of generating

the electronic form of the document provided a

reliable means of assuring the maintenance of the

integrity of the information contained in the document;

(b) at the time the communication was sent, it was

reasonable to expect that the information contained in

the electronic form of the document would be readily

accessible so as to be usable for subsequent reference;

(c) if the document is required to be produced to a person

who is neither a public body nor to a person acting on

behalf of a public body, then the person to whom the

document is required to be produced, consents to the

production by means of an electronic communication of

an electronic form of the document;

(d) if the document is required to be given to a person, or

to another person on his behalf, and the first

mentioned person requires that an electronic form of

the document be given, in accordance with particular

information technology requirements, by means of a

particular kind of electronic communication, the

person’s requirement is satisfied; and

(e) if the document is required to be given to a person, or

to another person on his behalf, and the first

mentioned person requires that a particular action be

taken by way of verifying the receipt of the

information, the person’s requirement is satisfied.

(2) For the purposes of this article, the integrity of information

contained in a document is only maintained if the information

remains complete and unaltered, save for -

(a) the addition of any endorsement; or

(b) any change not being a change to the information,

which is necessary in the normal course of

communication, storage or display.

(3) For the purposes of article 8 (1) and (2), the production by

means of an electronic communication of an electronic form of a

document or the generation of an electronic form of a document

shall not give rise to any liability for infringement of the copyright

in a work or other subject matter embodied in the document.

Added by

XXXV. 2016.18.

(Article 8A)

Fields excluded in accordance with article 8A(4)

1. To the extent that the following national laws implement the Directives

referred to in the Annex to the Electronic Commerce Directive namely

(a) the Copyright Act (Cap. 415), and the Patents and Designs Act (Cap.

417) insofar as these laws relate to copyright, neighbouring rights,

rights referred to in Directive 87/54/EEC and Directive 96/9/EC as well

as industrial property rights;

(b) article 5 of the Banking Act (Cap. 371) insofar as it relates to the

emission of electronic money by institutions in respect of which

Member States applied one of the derogations provided for in article

8(1) of Directive 2000/46/EC;

(c) the Undertakings for Collective Investment in Transferable Securities

and Management Companies Regulations (S.L. 370.11);

(d) the European Passport Rights for Insurance

and

Reinsurance

Undertakings Regulations (S.L. 403.14).

2. The freedom of the parties to a contract to choose the applicable law.

3. Contractual obligations concerning consumer contracts.

4. Formal validity of contracts creating or transferring rights in real estate

where such contracts are subject to mandatory formal requirements of the law of the

Member State where the real estate is situated.

5. The permissibility of unsolicited commercial communications by electronic

mail.

ELECTRONIC COMMERCE

(1) If under any law in Malta, a person is required to

record information in writing, that requirement is deemed to have

been satisfied if the person records the information in electronic

form

Provided that such information in electronic form is readily

accessible so as to be usable for subsequent reference and it

complies with such regulations as may be prescribed.

(2) If under any law in Malta, a person is required to retain, for

a particular period, a document that is in the form of a paper or of

any other substance or material, that requirement is deemed to have

been satisfied if the person retains an electronic form of the

document throughout that period

Provided that if -

(a) having regard to all the relevant circumstances at the

time of the generation of the electronic form of the

document, the method of generating the electronic

form of the document, provided a reliable means of

assuring the maintenance of the integrity of the

information contained in that document; and

(b) at the time of the generation of the electronic form of

the document, it was reasonable to expect that the

information contained in the electronic form of the

document would be readily accessible so as to be

usable for subsequent reference; and

(c) it complies with such regulations as may be

prescribed.

(3) For the purpose of sub-article (2), the integrity of

information contained in a document is only maintained if the

information has remained complete and unaltered, save for-

(a) the addition of any endorsement; or

(b) any change not being a change to the information,

which is necessary in the normal course of

communication, storage or display.

(4) If under any law in Malta, a person is required to retain, for

a pa rticular pe r iod, i nformation tha t w as t he s ubject of an

electronic communication, that requirement is deemed to have been

satisfied if that person retains, or causes another person to retain, in

electronic form, that -

(a) at the time of commencement of the retention of the

information, it was reasonable to expect that the

information would be readily accessible so as to be

usable for subsequent reference; and

(b) having regard to all the relevant circumstances, at the

time of commencement of the retention of the

information, the method of retaining the information in

electronic form provided a reliable means of assuring

the maintenance of the integrity of the information

contained in the electronic communication; and

(c) throughout that period that person also retains, or

causes another person to retain, in electronic form,

such additional information obtained as is sufficient to

enable the identification of the following

(i) the origin of the electronic communication;

(ii) the destination of the electronic communication;

(iii) the time when the electronic communication was

sent;

(iv) the time when the electronic communication was

received; and

(d) at the time of commencement of the retention of the

additional information specified in paragraph (c) it

was reasonable to expect that the additional

information would be readily accessible so as to be

usable for subsequent reference; and

(e) it complies with

such regulations as may be

prescribed.

(5) For the purposes of sub-article (4), the integrity of the

information which is the subject of an electronic communication is

only maintained if the information remains complete and unaltered,

save for -

(a) the addition of any endorsement; or

(b) any change not being a change to the information,

which arises in the normal course of communication,

storage or display.

(1) Subject to the provisions of sub-article (4), any

requirement that falls within the coordinated field shall apply to the

provision of an information society service by a service provider

established in Malta, irrespective of whether that service is

provided in Malta or in another Member State.

(2) Subject to the provisions of sub-article (4) an enforcement

authority with responsibility in relation to any requirement in sub-

article (1) shall ensure that the provision of an information service

by a service provider established in Malta complies with that

requirement irrespective of whether the service is provided in

Malta or in another Member State, and any power, remedy or

procedure for taking enforcement action shall be available to secure

compliance.

(3) Subject to the provisions of sub-articles (4) and (5), no

requirement shall be applied to the provision of an information

society service by a service provider established in a Member State

other than Malta for reasons which fall within the coordinated field

if the application of the requirement would restrict the freedom to

provide information society services to a person in Malta from that

Member State.

(4) Sub-articles (1), (2) and (3) shall not apply to the fields set

out in the Seventh Schedule to this Act.

(5) The reference to any requirements the application of which

would restrict the freedom to provide information society services

from another Member State in sub-article (3) does not include any

requirement maintaining the level of protection for public health

and consumer interests established by European Union law.

(1) Notwithstanding the provisions of article 8A(3), an

enforcement authority may take measures, including applying any

requirement which would otherwise not apply by virtue of article

8A(3), in respect of a given information society service, where

those measures are necessary for reasons of -

(a) public policy, in particular the prevention,

investigation, detection and prosecution of criminal

offences, including the protection of minors and the

fight against any incitement to hatred on grounds of

race, sex, religion or nationality, and violations of

human dignity concerning individual persons;

(b) the protection of public health;

(c) public security, including the safeguarding of national

security and defence; or

(d) the protection of consumers, including investors,

and are proportionate to those objectives.

(2) Notwithstanding the provisions of article 8A(3), in any case

where an enforcement authority is not party to the proceedings, a

court may, on the application of any person or of its own motion,

apply any requirement which would otherwise not apply by virtue

of article 8A(3) in respect of a given information society service, if

the application of that law or requirement is necessary for and

proportionate to any of the objectives set out in sub-article (1).

(3) Sub-articles (1) and (2) shall only apply where the

information society service prejudices or presents a serious and

grave risk of prejudice to an objective as stated in sub-article (1)(a)

to (d).

(4) Subject to the provisions of sub-articles (5) and (6), an

enforcement authority shall not take the measures in sub-article (1)

unless it

(a) asks the Member State in which the service provider is

established to take measures and the aforesaid Member

State does not take such measures or the measures

taken are considered by the enforcement authority

concerned as inadequate; and

(b) notifies the European Commission and the Member

State in which the service provider is established of its

intention to take such measures.

(5) Nothing in sub-article (4) affects the commencement of any

legal proceedings or the investigation of any offence or breach,

however so described, by any enforcement authority.

(6) If it appears to the enforcement authority that the matter is

one of urgency, it may take the measures under sub-article (1)

without first applying the requirements of sub-article (4).

(7) In a case where a measure is taken pursuant to sub-article

(6), the enforcement authority shall notify the measures taken, to

the European Commission and to the Member State concerned in

the shortest time possible thereafter stating in writing the reasons

for urgency.

(1) Without prejudice to other information requirements as

may be established at law, a service provider shall make available

to the recipient of the service and where appropriate or requested,

to the enforcement authority responsible at law in ensuring

compliance, including where applicable to the competent regulator,

in a form and manner which is easily, directly and permanently

accessible, the following information

(a) the name of the service provider;

(b) the geographic address where the service provider is

established;

(c) the details of the service provider, including his

electronic mail address, which allow him to be

contacted rapidly and communicated with in a direct

and effective manner;

(d) where the service provider is registered in a trade or

similar public register, the trade or other such register

in which the service provider is entered and his

registration number, or equivalent means of

identification in that register;

(e) where the activity is subject to an authorisation

scheme, the particulars of the relevant supervisory

authority;

(f)

where the service provider is a member of a regulated

profession -

(i)

any professional body or similar institution with

which the service provider is registered;

(ii) the professional title of the provider and the

Member State where it has been granted; and

(iii) a reference to the applicable professional rules

in the Member State of establishment and the

means to access them;

(g) where the service provider undertakes an activity that

is subject to value added tax, the identification number

referred to in Article 22(1) of the Sixth Council

Directive 77/388/EEC of 17th May 1977 on the

harmonisation of the laws of the Member States

relating to turnover taxes - Common system of value

added tax: uniform basis of assessment; and

(h) when a service provider sends unsolicited commercial

communications, details of how users of the service

can register their choice regarding unsolicited

commercial communications, which details must be

prominently displayed on the website of the service

provider and at every point where users of the service

are asked to provide information when accessing the

website of the service provider.

(2) Where the service provider refers to prices, such prices

shall be indicated clearly and unambiguously and, in particular,

shall indicate whether they are inclusive of any tax, however so

described, and delivery costs.

In addition to any other information requirements that may

be established at law, a service provider shall ensure that any

commercial communication provided by him, which constitutes or

forms part of an information society service shall -

(a) be clearly identified as a commercial communication;

(b) clearly identify the person on whose behalf the

commercial communication is made;

(c) clearly identify as such any promotional offer,

including any discount, premium or gift, and ensure

that any conditions which must be met to qualify for it

are easily accessible, and presented clearly and

unambiguously;

(d) clearly identify as such any promotional competition

or game and ensure that any conditions for

participation are easily accessible and presented

clearly and unambiguously; and

(e) without prejudice to the provisions of the Data

Protection Act and of any other laws regulating data

protection, clearly identify details of how users of the

service can register their choice regarding unsolicited

commercial communications, which details must be

prominently displayed at every point where users of

the service are asked to provide information.

(1) This article establishes and regulates the right under

the Act to make a commercial communication which is part of, or

constitutes, a service provided by a m ember of a regulated

profession.

(2) Without prejudice to any other provision of the Act

permitting a restriction or limitation of the right to which this

article applies, a body which at law is responsible for a regulated

profession may, in exercise of any powers vested in it at law to

regulate the activities of its members, make the exercise by a

member of the profession of the right to which this article applies,

subject to compliance with specified conditions as referred to in

sub-article (3).

(3) The conditions that may be so specified are those that may

reasonably be regarded as appropriate for the purpose of

maintaining the standing and integrity of the profession concerned

and ensuring adherence by its members to the requisite standards

and, in particular, for the purpose of ensuring -

(a) the independence,

dignity

and

honour

of

the

profession, and

(b) compliance with obligations of professional secrecy

and fairness towards clients and other members of the

profession.

The provision of information society services by a service

provider shall not be subject to any prior authorisation

Provided that the provision of such information society

services shall be without prejudice to authorisation schemes which

are not specifically and exclusively targeted at information society

services, or which are covered by the Electronic Communications

(Regulation) Act or any regulations made thereunder.

(Deleted by Act XXXIII. 2021.18).

(Deleted by Act XXXIII. 2021.18).

PART III

ELECTRONIC CONTRACTS

(Article 9)

Contracts or laws to which article 9 does not apply

(a)

contracts that create or transfer rights over immovable property

other than leasing rights;

(b)

contracts of suretyship granted and on collateral security furnished

by persons acting for purposes outside their trade, business or profession;

(c)

the law governing the creation, execution, amendment, variation or

revocation of a will or any other testamentary instrument or a trust;

(d)

any law governing the making of an affidavit or a solemn

declaration, or requiring or permitting the use of one for any purpose;

(e)

the rules, practices or procedures of a court or tribunal however so

(f)

any law relating to the giving of evidence in criminal proceedings;

(g)

any contracts governed by family law.

An electronic contract shall not be denied legal effect,

validity or enforceability solely on the grounds that it is wholly or

partly in electronic form, or has been entered into wholly or partly

by way of electronic communications or otherwise

Provided that the provisions of this article shall not apply

in relation to the contracts or laws, however so described, listed in

the Eighth Schedule to this Act

Provided further that the Minister may, after consulting the

competent regulator, by notice in the Gazette amend the Eighth

Schedule.

(2) For the purposes of any law relating to contracts, an offer,

an acceptance of an offer and any related communication, including

any subsequent amendment, cancellation or revocation of the offer,

the acceptance of the contract may, unless otherwise agreed by the

contracting parties, be communicated by means of electronic

communications.

(1) Unless otherwise agreed by parties who are not

consumers, where the recipient of the service places his order

through technological means

(a) an electronic contract is concluded when after placing

his order, the recipient of the service has received from

the service provider an acknowledgement of receipt of

the order made by the recipient

Provided that the service provider must acknowledge

receipt of the order made by the recipient without

undue delay and by electronic means; and

(b) the order made by the recipient and the

acknowledgement of receipt are deemed to have been

received when the parties to whom they are addressed

are able to access them.

(2) Unless otherwise agreed by parties who are not consumers,

the service provider shall provide the recipient of the service with

effective and accessible technical means to identify and correct

handling and input errors and accidental transactions prior to the

conclusion of the contract.

(3) The provisions of sub-article (1)(a) and of sub-article (2)

shall not apply to contracts concluded exclusively by electronic

mail or by equivalent individual communications.

(1) Unless otherwise agreed by parties who are not

consumers, and without prejudice to any consumer rights under the

provisions of any other law, the service provider shall provide

information in clear, comprehensive and unambiguous terms

regarding the matters set out in the First Schedule, which Schedule

may by notice in the Gazette, be amended by the Minister after

consultation with the competent regulator

Provided that any such information shall be provided to the

addressee prior to the placement of the order by him.

(2) Unless parties who are not consumers have agreed

otherwise, a service provider shall indicate which relevant codes of

conduct he subscribes to and provide information as to how those

codes can be consulted electronically.

(3) Where the service provider provides terms and conditions

applicable to the contract to the addressee, the service provider

shall make them available to the addressee in a way that allows the

addressee to store and reproduce them.

(4) The provisions of sub-articles (1) and (2) shall not apply to

contracts concluded exclusively by exchange of electronic mail or

by equivalent individual communications.

PART IV

TRANSMISSION OF ELECTRONIC COMMUNICATIONS

(1) If an electronic communication enters a single

information system outside of the control of the originator, then,

save as otherwise agreed between the originator and the addressee

of the electronic communication, the dispatch of the electronic

communication occurs at the time when it enters the information

system.

(2) If an electronic communication enters successively two or

more information systems outside of the control of the originator,

then, unless otherwise agreed between the originator and the

addressee of the electronic communication, the dispatch of the

electronic communication occurs when it enters the first of those

information systems.

(1) If the addressee of an electronic communication has

designated an information system for the purpose of receiving

electronic communications, then, save as otherwise agreed between

the originator and the addressee of the electronic communication or

as otherwise required under the Regulation, the time of receipt of

the electronic communication is the time when the electronic

communication enters the information system.

(2) If the addressee of an electronic communication has not

designated an information system for the purpose of receiving

electronic communications, then, save as otherwise agreed between

the originator and the addressee of the electronic communication,

the time of receipt of the electronic communication is the time

when the electronic communication comes to the attention of the

addressee.

(1) Save as may be otherwise agreed between the

originator and the addressee of an electronic communication -

(a) the electronic communication is deemed to have been

dispatched at the place where the originator has his

place of business; and

(b) the electronic communication is deemed to have been

received at the place where the addressee has his place

of business.

(2)

For the purposes of the sub-article (1) -

(a) if the originator or the addressee has more than one

place of business, and one of those places has a closer

relationship to the underlying transaction, that place of

business shall be deemed to be the originator’s or the

addressee’s place of business; and

(b) if the originator or the addressee has more than one

place of business, but paragraph (a) does not apply, the

originator’s or the addressee’s principal place of

business shall be deemed to be the originator’s or the

addressee’s place of business; and

(c) if the originator or addressee does not have a place of

business, the originator’s or the addressee’s place of

business shall be deemed to be the originator’s or

addressee’s ordinary residence.

(1) Save as otherwise agreed between the originator and

the addressee of an electronic communication, the originator of an

electronic communication is bound by that communication only if

the communication was sent by him or under his authority.

(2) Nothing in sub-article (1) shall affect the operation of any

law that makes provision for-

(a) the conduct engaged by a person within the scope of

the person’s actual or apparent authority to be

attributed to another person; or

(b) a person to be bound by conduct engaged in by another

person within the scope of the other person’s actual or

apparent authority.

(3) An electronic communication between an originator and an

addressee shall be deemed to be of the originator if it was sent by

an information system programmed to operate automatically by or

on behalf of the originator.

(4) An addressee shall have the right to consider each

electronic communication received by him as a separate electronic

communication and to act on that assumption, except to the extent

that such communication is a duplicate of another electronic

communication and the addressee knew or should have known, had

he exercised reasonable care or used any agreed procedure, that the

electronic communication was a duplicate.

Wherever any legal requirement exists to communicate by

way of registered mail, this requirement shall be deemed to be

satisfied by the use of a qualified electronic registered delivery

service by all parties participating in the communication

Provided that this article shall come into force on such date

as the Minister may expressly determine by order in the Gazette.

PART V

PROVISION OF SIGNATURE CERTIFICATION SERVICES

(Deleted by Act XXXV. 2016.9.).

(Deleted by Act XXXV. 2016.9.).

(Deleted by Act XXXV. 2016.9.).

PART VI

INTERMEDIARY SERVICE PROVIDERS

Repealed by Act I.2024.20.

Repealed by Act I.2024.20.

Repealed by Act I.2024.20.

Repealed by Act I.2024.20.

PART VII

GENERAL

(1) No person shall access, copy or otherwise obtain

possession of or recreate the electronic signature creation device or

an electronic seal creation device of another person without

authorisation, for the purpose of creating, or allowing or causing

another person to create an unauthorised electronic signature or

electronic seal using such signature device.

(2) No person shall alter, disclose or use the electronic

signature creation device or an electronic seal creation device of

another person without authorisation, or in excess of lawful

authorisation, for the purpose of creating or allowing or causing

another person to create an unauthorised electronic signature using

such electronic signature creation device or an electronic seal

creation device.

(3) No person shall create, publish, alter or otherwise use a

certificate or an electronic signature or electronic seal for any

fraudulent or other unlawful purpose.

(4) No person shall misrepresent his identity or authorisation

in requesting or accepting a certificate or in requesting suspension

or revocation of a certification.

(5) No person shall access, alter, disclose or use the electronic

signature creation device or an electronic seal creation device of a

certificate service provider used to issue certificates without the

authorisation of the certificate service provider, or in excess of

lawful authorisation, for the purpose of creating, or allowing or

causing another person to create, an unauthorised electronic

signature or electronic seal using such electronic signature creation

device or an electronic seal creation device.

(6) No person shall publish a certificate, or otherwise

knowingly make it available to anyone likely to rely on the

certificate or on an electronic signature or electronic seal that is

verifiable with reference to data such as codes, passwords,

algorithms, public cryptographic keys or other data which are used

for the purposes of verifying an electronic signature or electronic

seal, listed in the certificate, if such person knows that -

(a) the certificate service provider listed in the certificate

has not issued it; or

(b) the subscriber listed in the certificate has not accepted

it; or

(c) the certificate has been revoked or suspended, unless

such publication is for the purpose of verifying an

electronic signature or electronic seal created prior to

such revocation or suspension, or giving notice of

revocation or suspension.

(7) No person shall use cryptographic or other similar

techniques for any illegal purpose.

(1) The competent regulator shall be responsible for the

supervisory tasks stated in the Regulation and in doing so shall in

particular

(a) supervise qualified trust service providers established

in Malta ensuring through ex ante and ex post

supervisory activities, that such qualified trust service

providers and the qualified trust services that they

provide, meet the requirements laid down in the

Regulation;

(b) take action if necessary, in relation to non-qualified

trust service providers established in Malta through ex

post supervisory activities, when informed that those

non-qualified trust service providers or the trust

services they provide allegedly do not meet the

requirements laid down in the Regulation.

(2) Without prejudice to the generality of the tasks onerous on

the competent regulator as stated in sub-article (1), the competent

regulator shall be responsible for the following

(a) cooperating with other supervisory bodies and provide

them with assistance in accordance with Article 18 of

the Regulation;

(b) analysing the conformity assessment reports referred

to in Articles 20(1) and 21(1) of the Regulation;

(c) informing other supervisory bodies and the public

about breaches of security or loss of integrity in

accordance with Article 19(2) of the Regulation;

(d) reporting to the European Commission about its main

activities in accordance with paragraph 6 of Article 17

of the Regulation;

(e) carrying out audits or requesting a conformity

assessment body to perform a conformity assessment

of the qualified trust service providers in accordance

with Article 20(2) of the Regulation;

(f)

cooperating with the Office of the Information and

Data Protection Commissioner in Malta, in particular,

by informing that Office without undue delay, about

the results of audits of qualified trust service

providers, where personal data protection rules may in

the opinion of the competent regulator have been

breached;

(g) granting qualified status to trust service providers and

to the services they provide and to withdraw this status

in accordance with Articles 20 and 21 of the

Regulation;

(h) informing the body responsible for the national trusted

list referred to in Article 22(3) of the Regulation about

its decisions to grant or to withdraw qualified status

Provided that such a requirement shall not apply if the

competent regulator also performs the tasks of the

body referred to in this paragraph;

(i)

verifying the existence and correct application of

provisions on termination plans in cases where the

qualified trust service provider ceases its activities

including how information is kept accessible in

accordance with point (h) of Article 24(2) of the

Regulation;

(j)

requiring that trust service providers remedy any

failure to fulfil the requirements laid down in the

Regulation;

(k) establishing, maintaining and publishing trusted lists

in accordance with Articles 22(1) and 22(2) of the

Regulation, and notifying the Commission in relation

thereto in accordance with Article 22(3) of the

Regulation; and

(l)

notifying the Commission in relation to any lists in

accordance with Articles 31(1) and 39(3) of the

Regulation.

(3) The competent regulator may, in the performance of its

supervisory tasks as stated in the Regulation, determine any such

technical and, or operational requirements as it may consider

necessary for the effective implementation and, or compliance with

any of the provisions of the Regulation

Provided that in doing so the competent regulator shall first

consult with any interested parties.

Unless stated otherwise in this Act, where applicable, any

non-compliance with the provisions of this Act or of the

Regulation, shall constitute a breach of this Act, and shall be

treated accordingly by the competent regulator who shall as it

considers appropriate take the necessary regulatory measures in

accordance with its powers at law.

Unless stated otherwise in the Act, a breach of any of the

provisions of the Act shall be subject to any such sanctions as the

competent regulator is empowered by law to impose.

Any person contravening article 23 of the Act, or Articles

19(2), 20(1), 21(1), 21(3), 23 and 24 of the Regulation, shall be

guilty of an offence and shall on conviction be liable to a fine

(multa) of not more than two hundred and fifty thousand euro

(€250,000) or to imprisonment not exceeding two years or to both

such fine (multa) and imprisonment, and in the case of a continuous

offence to a fine not exceeding two thousand, five hundred euro

(€2,500) for each day during which the offence continues

Provided that where any proceedings are undertaken by the

Commissioner of Police under this sub-article, the Commissioner

of Police shall in writing notify the competent regulator of the

taking of such proceedings and of the final outcome of the same.

(1) Where a dispute however so described arises between

a service provider and a consumer further to a complaint by a

consumer alleging an infringement of the Act or of the Regulation

as are enforced by the competent regulator, any party to such a

dispute may refer the dispute to the competent regulator

Provided that in making a complaint the consumer must

prima facie show that he has been affected by the act or omission of

the service provider giving rise to the complaint.

(2) Upon receipt of any reference as aforesaid, or upon

otherwise becoming aware of any such dispute that the competent

regulator believes should be investigated, the competent regulator

shall notify all the parties to the dispute that the matter is being

investigated. In doing so, the competent regulator shall regulate its

own procedure, which procedure shall, as far as is reasonably

possible, be transparent, simple, inexpensive and conducive to a

prompt and fair settlement of the dispute, and shall afford all

parties to the dispute reasonable opportunity to make their

submissions and to produce any relevant information

Provided that the competent regulator may decide not to

initiate an investigation in accordance with this article where it is

satisfied that other means of resolving the dispute in a timely

manner are available to the parties, or if legal proceedings in

relation to the dispute have been initiated by any party to the

dispute, or if another public authority is already investigating the

same dispute.

(3) The competent regulator in resolving any disputes referred

to it under this article, may issue directives to the service provider

requiring that service provider to comply with any measure the

competent regulator may specify for the resolution of the dispute.

Such directives may, having regard to its determination of the

dispute and to all other relevant matters, include an order to effect

the reimbursement of payments received or to make compensation

payments. Such payments may also include the whole or part of the

costs of any party relating to the engagement of a lawyer and, or of

a technical adviser in relation to any submissions relating to the

dispute.

(4) The competent regulator shall make publicly available any

administrative procedures it may from time to time establish in

relation to the handling of any disputes referred to it under this

article.

(5) The provisions of this article shall be without prejudice to

the right of the consumer to have recourse, in accordance with

Maltese law, to any other body empowered to resolve any such

disputes and, or to any out-of-court dispute resolution processes,

however so described.

(6)

In issuing a decision under this article the competent

regulator shall state the reasons on which it is based, and shall,

subject to such requirements of commercial confidentiality as it

may deem appropriate, notify the parties to the dispute with a copy

of the decision.

(7) The competent regulator shall publish notice of a decision

given under this article and shall state from where copies of, or

information regarding the decision, may be obtained.

(1) Where the competent regulator feels it is reasonably

appropriate or necessary for the protection of consumers, it may

issue a compliance order against a service provider or any other

person for one or more of the following purposes

(a) requiring any person to take any measures specified in

the compliance order, within the time specified in the

order to ensure that the provisions of the Act and, or of

the Regulation are complied with; or

(b) requiring any person to cease and desist from

committing a breach of the Act and, or of the

Regulation.

(2) The competent regulator shall when issuing a compliance

order under this article

(a) notify a copy of the compliance order on each person

against whom the order is made;

(b) include with the compliance order, information about

the right to contest the order before the Tribunal; and

(c) briefly state the reasons for issuing the compliance

order, which reasons shall be notified to each person

against whom the order is issued and, if any, to the

qualifying body on whose application the order is

issued.

(3) No precautionary warrant or other similar order under this

or any other law shall be issued by the Tribunal or by any court

restraining or restricting the competent regulator from issuing a

compliance order under this Act.

(4) A compliance order issued by the competent regulator shall

come into force with immediate effect, unless the order provides

otherwise.

Repealed by Act XVII.2023.45.

Repealed by Act XVII.2023.45.

(1) A person against whom a compliance order has been

made, may, within twenty days from receipt of notification of the

compliance order, appeal in writing to the Tribunal for the

revocation or amendment of the compliance order, giving detailed

grounds for the request. The competent regulator shall be notified

with the appeal and shall have twenty (20) days from the date when it

is notified with the appeal in which to reply.

(2) The Tribunal may confirm, change or cancel the

compliance order as it considers appropriate, provided that in doing

so the Tribunal shall in all instances state its reasons.

(3) Where an appeal is instituted under this article the

compliance order shall remain in force unless the Tribunal, at the

request of the party contesting the order, specifically orders that the

compliance order shall be suspended pending the outcome of the

appeal, subject to such conditions and amendments to the order as

the Tribunal may determine

Provided that in deciding any such request for a suspension

of the compliance order, the Tribunal shall give its reason in

writing for its decision.

(1) Appeals instituted under article 24E shall be heard and

determined by the Tribunal with urgency and as expeditiously as

possible.

(2) The Tribunal, at the request of any of the parties to the

proceedings before it, may abridge any time limits established

under this Act in relation to the conduct of the appeal before it

Provided that in doing so the Tribunal shall state its reasons

in writing.

The competent regulator when issuing a compliance order

under the Act shall not be required to prove

(a) actual loss or damage; or

(b) actual recklessness, negligence or fault on the part of

the service provider or person against whom the order

is made.

(1) Without prejudice to any other powers it has at law, the

competent regulator may, in writing, order any person to cease and

desist from committing any cross-border infringement and, or from

acting in breach of any of the provisions of the Act, and, or of the

Regulation.

(2) The competent regulator may, in issuing an order under

sub-article (1) require the person concerned to provide it with a

written undertaking whereby that person agrees to cease and desist

from any such breach and which undertaking shall include any

conditions as the competent regulator may consider necessary in

the circumstances.

(3) A person who makes an undertaking in accordance with this

article and who subsequently acts in breach of any conditions stated

in the undertaking, shall be liable to the imposition of an

administrative fine by the competent regulator not exceeding the

sum of twenty-five thousand euro (€25,000) and, or five hundred

euro (€500) for each day during which the failure to comply with

the undertaking persists

Provided that the imposition of a fine under this sub-article

shall be without prejudice to any other sanctions however so

described that the competent regulator may impose at law.

(1) The competent regulator may, for the better

information of the public, require the service provider or person

against whom the compliance order has been issued, at the expense

of the latter to communicate in any manner the competent regulator

considers appropriate, including publication in at least two daily

newspapers

(a) a copy in full or in part -

(i)

of a compliance order made under article 24B;

and, or

(ii) a copy of an undertaking given under article 24H

or an abstract of any such order and, or of any

such undertaking; and, or

(b) a corrective statement in relation to any contravention

of the Act and, or of the Regulation.

(2) Any communications required in terms of sub-article (1)

must be made within seven days from receipt of a notice issued by

the competent regulator requiring the service provider or person

concerned to make any such communications. Where the said

communications are not effected as aforesaid, the competent

regulator may proceed to issue the communications itself and any

expenses incurred by the competent regulator in issuing any

communications made by it in accordance with the provisions of

this article shall be recoverable as a civil debt from the person

against whom the compliance order was issued.

Any person aggrieved by a decision however so described

taken by the competent regulator in accordance with the Act and

having a legal interest to contest such a decision, may appeal to the

Tribunal

Provided that in the case of a contestation of any matter

relating to the issue of a compliance order as provided for in this

Act, the procedures as stated in article 24E shall apply.

(1) The competent regulator may request the advice of

and where appropriate shall consult with any other enforcement

authority in the exercise of any of its functions under the Act and,

or the Regulation.

(2) In acting in accordance with any of the provisions of this

Act, an enforcement authority shall, in all instances, first consult

and act in co-ordination with the competent regulator.

(1) The Minister may make regulations to provide for any

matter related to electronic commerce however so described,

electronic identification, trust services, electronic transactions, and

any such other matters as may be complementary or related thereto,

in order to give fuller effect to the provisions of this Act, and in

particular, but without prejudice to the generality of the aforesaid,

such regulations may provide for -

(a) any derogation from or restriction in relation to any

cross-border transaction where this is necessary for

one of the following reasons -

(i)

public policy, in particular the protection of

minors, or the fight against any incitement to

hatred on grounds of race, sex, religion, political

opinion or nationality;

(ii) the protection of public health;

(iii) public security;

(iv) consumer protection;

(b) identifying

(i) transactions;

(ii) requirements or permissions to give information

in writing;

(iii) requirements or permissions to produce

documents;

(iv) requirements to retain information, documents

and communications;

(v) trust services;

that may be exempt from any provision of this Act;

(c) (Deleted by Act XXXV. 2016.14.);

(d) (Deleted by Act XXXV. 2016.14.);

(e) any matter relating to commercial communications,

including, but not limited to matters relating to:-

(i)

information to be provided in commercial

communications;

(ii) unsolicited commercial communications;

(iii) commercial communications by regulated

professions;

(f)

the authorisation to the competent regulator to impose

administrative fines or sanctions on any person acting

in contravention of any provision of this Act or of any

regulation made thereunder

Provided that -

(i) any administrative fine provided for by regulations

made under this article shall not exceed the amount

of one hundred and twenty-five thousand euro

(€125,000) for each breach and two thousand and

five hundred euro (€2,500) for each day during

which failure to observe the provisions of any

regulation made thereunder persists;

(ii)

regulations made under this paragraph may

prescribe that any such administrative penalty or

sanction shall be due to the competent regulator

as a civil debt constituting an executive title for

the purposes of Title VII of Part I of Book

Second of the Code of Organization and Civil

Procedure as if the payment of the amount of the

fine had been ordered by a judgement of a court

of civil jurisdiction;

(iv)

such regulations may also prescribe any right of

appeal from decisions of the competent regulator

to impose an administrative sanction;

(g) procedures to be established for out of court schemes,

for the settlement of disputes arising in relation to

information society services including appropriate

electronic measures;

(h) the compliance with any international obligation

entered into by Government in relation to any aspect

of electronic commerce regulated by or under this Act;

(i)

the definition of requirements and procedures for the

designation of appropriate public or private bodies

authorised to assess the conformity of qualified

electronic signature creation devices and qualified

electronic seal creation devices with the requirements

of the Regulation, as well as the designation itself of

such bodies; and

(j)

any fees and, or charges, however so described, that

may be payable in relation to any matters regulated by

or under this Act or by or under the Regulation.

(2) The Minister may also by regulations amend the Schedules

to this Act and prescribe anything that may or is required to be

prescribed under this Act.

In the case of conflict between the Maltese and English

texts of this Act, the English text shall prevail.

ELECTRONIC COMMERCE

ELECTRONIC COMMERCE

ELECTRONIC COMMERCE

ELECTRONIC COMMERCE