DATA PROTECTION ACT

CHAPTER 586

DATA PROTECTION ACT

A N ACT to repeal and to replace the Data Protection Act, Cap. 440.

28th May, 2018

ACT XX of 2018, as amended by Act XII of 2021 and Legal Notice 212

of 2023.

The short title of this Act is the Data Protection Act.

(Article 17)

Oath of Office

I ……………………………………… solemnly swear / affirm

that I will faithfully and conscientiously perform my duties as

(Information and Data Protection Commissioner / Officer of the

Information and Data Protection Commissioner / Employee of the

Information and Data Protection Commissioner) in terms of the Data

Protection Act, the General Data Protection Regulation and in

accordance with the laws of Malta, without fear or favour. (So help

me God).

This Act implements and further specifies the relevant

provisions of Regulation (EU) 2016/679 of the European Parliament

and of the Council of 27 April 2016 on the protection of natural

persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General

Data Protection Regulation).

(Article 27)

FORM A

Summons of Witnesses

INFORMATION AND DATA PROTECTION APPEALS

TRIBUNAL

DATA PROTECTION ACT

In the case.....................................................................

versus........................................................

Application of

Respectfully requests the issue of a summons of a witness in

the above-stated cause against the person mentioned hereunder

to attend for the hearing at the time stated hereunder, and at

any other hearing as may be required, and to bring with him/

her any documents referred to hereunder.

Name and address (home or work or e-mail) of the person

summoned to attend as a witness

……………………………………...........................................

…………………………………………………………………

Documents to be brought by him/her

…………………………………………………………………

Date, time and place where he/she is to attend

…………………………………………………………………

The said ……………………………………is hereby being

warned that should he/she fail to attend the sitting without

informing the Tribunal of his/her unavailability beforehand, he/

she may be compelled to attend by a warrant of escort and shall

be liable to all consequences according to the provisions of the

Code of Organization and Civil Procedure.

Given by order of the Information and Data Protection

Appeals Tribunal.

This, .................... day of .............................. 20...............

(1)

In this Act unless the context otherwise requires

"Commissioner" means the Information and Data Protection

Commissioner appointed under article 11 and includes any officer or

employee of the Commissioner authorised by him in that behalf;

"identity document" means a legally valid identity document

as provided in the Identity Card and other Identity Documents Act;

"Minister" means the Minister responsible for data protection;

"official statistics" shall mean information collected, analysed

and produced for the benefit of the society to characterize collective

phenomena in a considered population and produced by the National

Statistics Office as provided for by law, or by other national

authorities as designated by Eurostat following recommendation by

the National Statistics Office;

"the Regulation" means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and repealing

Directive 95/46/EC;

"Tribunal" means the Information and Data Protection Appeals

Tribunal established under article 24.

(2) The definitions in Article 4 of the Regulation shall apply to

this Act.

PART II

Applicability

(1)

Subject to the provisions of sub-article (2), the

provisions of this Act shall apply to the processing of personal data,

wholly or partly, by automated means and to such processing other

than by automated means where such personal data forms part of a

filing system or is intended to form part of a filing system

Provided that this Act shall not apply to the processing

of personal data

(a)

in the course of an activity which falls outside

the scope of Union law;

(b)

by the Government of Malta when carrying out

activities which fall within the scope of Chapter 2 of Title V of

the Treaty on European Union;

(c)

by a natural person in the course of a purely

personal or household activity; or

(d)

by competent authorities for the purposes of the

prevention, investigation, detection or prosecution of criminal

offences or the execution of criminal penalties, including the

safeguarding against and the prevention of threats to public

security

Provided further that the Minister may by regulations,

after consultation with the Commissioner and with the concurrence of

the Minister responsible for the Police, make provisions on the

processing of personal data by competent authorities for the purposes

of the prevention, investigation, detection or prosecution of criminal

offences or the execution of criminal penalties, including the

safeguarding against and the prevention of threats to public security.

(2)

This Act shall apply to

(a)

the processing of personal data in the context of

the activities of an establishment of a controller or a processor

in Malta or in a Maltese Embassy or High Commission abroad,

regardless of whether the processing takes place in Malta or

not;

(b)

the processing of personal data of data subjects

who are in Malta by a controller or processor not established in

the European Union, where the processing activities are

related to

(i)

the offering of goods or services,

irrespective of whether a payment of the data subject is

required, to such data subjects in Malta; or

(ii) the monitoring of their behaviour in so

far as their behaviour takes place within Malta;

(c)

the processing of personal data by a controller

not established in the Union but in a place where the laws of

Malta apply by virtue of public international law.

PART III

Restrictions, Consultation and Prior Authorisation

The Minister may, after consultation with the

Commissioner and with the concurrence of the Minister responsible for

justice, by regulations provide for a restriction to the obligations to

which the data controller or processor is subject pursuant to Article 23

of the Regulation.

(1)

Subject to the provisions of sub-article (4),

controllers and processors may derogate from the provisions of

Articles 15, 16, 18 and 21 of the Regulation for the processing of

personal data for scientific or historical research purposes or official

statistics in so far as the exercise of the rights set out in those Articles

(a)

is likely to render impossible or seriously impair

the achievement of those purposes; and

(b)

the data controller reasonably believes that such

derogations are necessary for the fulfilment of those purposes.

(2) Subject to the provisions of sub-article (4), controllers

and processors may derogate from the provisions of Articles 15, 16,

18, 19, 20 and 21 of the Regulation for the processing of personal

data for archiving purposes in the public interest in so far as the

exercise of the rights set out in those Articles

(a)

is likely to render impossible or seriously impair

the achievement of those purposes; and

(b)

the controller reasonably believes that such

derogations are necessary for the fulfilment of those purposes.

(3) Where data processing referred to in sub-articles (1) and

(2) serves at the same time another purpose, the derogations shall

apply only to processing for the purposes referred to in those sub-

articles.

(4) Processing for the purposes referred to in sub-articles (1)

and (2) shall be subject to appropriate safeguards for the rights and

freedoms of the data subject, including pseudonymisation and other

technical and organisational measures to ensure respect for the

principle of data minimisation

Provided that, where such purposes can be fulfilled by

processing which does not permit, or no longer permits, the

identification of data subjects, those purposes shall be fulfilled in that

manner.

A controller shall consult with, and obtain prior

authorisation from, the Commissioner where the controller intends to

process in the public interest

(a)

genetic data, biometric data or data concerning

health for statistical or research purposes; or

(b)

special categories of data in relation to the

management of social care services and systems, including for

the purposes of quality control, management information and

the general national supervision and monitoring of such

services and systems

Provided that, where genetic data, biometric data or data

concerning health are required to be processed for research purposes,

the Commissioner shall consult a research ethics committee or of an

institution recognised by the Commissioner for the purposes of this

article.

An identity document shall only be processed when such

processing is clearly justified having regard to the purpose of the

processing and -

(a)

the importance of a secure identification; or

(b)

any other valid reason as may be provided by

law

Provided that the national identity number or any other

identifier of general application shall be used only under appropriate

safeguards for the rights and freedoms of the data subject pursuant to

the Regulation.

(1)

Personal data processed for the purpose of

exercising the right to freedom of expression and information,

including processing for journalistic purposes or for the purposes of

academic, artistic or literary expression, shall be exempt from

compliance with the provisions of the Regulation specified in sub-

article (2) where, having regard to the importance of the right of

freedom of expression and information in a democratic society,

compliance with any of the provisions as specified in sub-article (2)

would be incompatible with such processing purposes

Provided that when reconciling the right to the

protection of personal data with the right to freedom of expression

and information, the controller shall ensure that the processing is

proportionate, necessary and justified for reasons of substantial

public interest.

(2) For the purposes of the provisions of sub-article (1), the

provisions of the following chapters of the Regulation may be

exempted or derogated therefrom pursuant to Article 85(2) of the said

DATA PROTECTION

Regulation

(a)

Chapter II (Principles)

(i)

Article 5(1)(a) to (e) (principles relating

to processing);

(ii)

Article 6 (lawfulness);

(iii)

Article 7 (conditions for consent);

(iv) Article 10 (data relating to criminal

convictions, etc);

(v)

Article 11(2) (processing not requiring

identification);

(b)

Chapter III (rights of the data subject)

(i)

Article 13(1) to (3) (personal data

collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data

collected other than from data subject);

(iii) Article 15(1) to (3) (access to data and

safeguards for third country transfers);

(iv)

Article 17(1) and (2) (right to erasure);

(v)

Article 18(1)(a), (b) and (d) (restriction

of processing);

(vi)

Article 20(1) and (2) (right to data

portability);

(vii) Article 21(1) (objections to processing);

(c)

Chapter IV (controller and processor)

(i)

Article 25 (data protection by design and

by default);

(ii) Article 27 (representatives of controllers

or processors not established in the Union);

(iii)

Article

(records

of

processing

activities);

(iv) Article 33 (notification of personal data

breach to supervisory authority);

(v)

Article 34 (communication of personal

data breach to the data subject);

(vi)

Article 42 (certification);

(vii) Article 43 (certification bodies);

(d)

Chapter VII (co-operation and consistency)

(i)

Articles 60 to 62 (co-operation);

(ii)

Articles 63 to 67 (consistency).

PART IV

Transborder Data Transfers

In the absence of an adequacy decision pursuant to

Article 45(3) of the Regulation, the Minister may, following

consultation with the Commissioner, by regulations set limits to the

transfer of specific categories of personal data to a third country or an

international organisation for important reasons of public interest.

PART V

The Information and Data Protection Commissioner

(1)

There shall be an Information and Data

Protection Commissioner, who shall be appointed by the Prime

Minister acting on the advice of the Cabinet of Ministers after

consulting the Leader of the Opposition, to perform the duties of

supervisory authority for the purposes of Chapter VI of the

Regulation.

(2) The Commissioner shall be responsible for monitoring

and enforcing the application of the provisions of this Act and the

Regulation, in order to protect the fundamental rights and freedoms

of natural persons in relation to processing of personal data and to

facilitate the free flow of personal data between Malta and any other

Member State.

(3) A person shall not be qualified to hold office as

Commissioner if he

(a)

is a Minister, Parliamentary Secretary, or a

Member of the House of Representatives; or

(b)

is a judge or magistrate of the courts of justice;

or

(c)

is an officer in the public service; or

(d)

is a member of a local council; or

(e)

has a financial or other interest in any enterprise

or activity which is likely to affect the discharge of his

functions as a Commissioner.

(4) The Information and Data Protection Commissioner

shall have the qualifications, experience and skills, in particular in the

area of the protection of personal data, required to perform his duties

and exercise his powers in accordance with the provisions of Article

53(2) of the Regulation.

(1)

In the exercise of his tasks and powers in

accordance with this Act and the Regulation, the Commissioner shall

act with complete independence and shall be free from external

influence, whether direct or indirect, and shall neither seek nor take

instructions or direction from any person or entity.

(2) It shall not be lawful for the Commissioner to carry out

any other profession, business or trade or to hold any other office of

profit whatsoever, even though of a temporary nature, with the

exception of any temporary judicial office on any international court

or tribunal or any international adjudicating body, and the office of

examiner at a University and the Malta College of Arts, Science and

Technology.

(3) Any officers or employees of the Commissioner shall be

chosen by the Commissioner and shall be subject to his exclusive

direction.

(1)

The Commissioner shall have a separate and

distinct legal personality and shall be capable of entering into

contracts, of acquiring, holding and disposing of any kind of property

for the purposes of his tasks and powers, of suing and being sued, and

of doing all such things and entering into all such transactions as are

incidental or conducive to the effective performance of his tasks and

exercise of his powers under this Act and the Regulation.

(2) Any document purporting to be an instrument made or

issued by the Commissioner and signed by him shall be received in

evidence and shall, until the contrary is proved, be deemed to be an

instrument made or issued by the Commissioner.

(1)

The Commissioner shall hold office for a term of

five years and shall be eligible for reappointment on the expiration of

his term of office.

(2) The Commissioner shall not be removed from his office

except by the Prime Minister upon an address of the House of

Representatives supported by the votes of not less than two-thirds of

all the members thereof and praying for such removal on the ground

of proved inability to perform the duties of his office (whether arising

from infirmity of body or mind or any other cause) or proved

misbehaviour.

(3) The Commissioner shall nominate a person from his

office to act as Deputy Commissioner and who shall have the

qualifications, experience and skills, in particular in the area of the

protection of personal data.

(4) If the Commissioner resigns, if his office is otherwise

vacant, if for any reason he is unable to perform the duties of his

office, or for any other temporary purpose where the Commissioner

considers it necessary not to carry out any of his duties that were he a

judge of the superior courts he would abstain, the Deputy

Commissioner shall perform the Commissioner’s duties and exercise

his powers in accordance with the provisions of Article 53(2) of the

Regulation.

(1)

The Commissioner shall perform the duties

assigned to him under this Act and the Regulation and shall carry out

the functions assigned to him under the Freedom of Information Act

and any other law.

(2) The Commissioner shall have the power to institute civil

judicial proceedings in cases where the provisions of this Act or the

Regulation have been or are about to be violated.

(3) The Commissioner may seek the advice of, and may

consult with, any other competent authority in the exercise of his

functions under this Act and the Regulation.

(1)

In the exercise of the investigative powers

pursuant to Article 58 of the Regulation, or any other law, the

Commissioner may request the assistance of the executive police in

order to enter and search any premises.

(2) In the event of joint operations with supervisory

authorities of one or more other Member States the Commissioner

may, where appropriate, in accordance with the provisions of Article

63 of the Regulation, confer powers, including investigative powers,

on the seconding supervisory authority’s members or staff

Provided that such powers are exercised under the

guidance and in the presence of the Commissioner.

(1)

The Commissioner and any officer and

employee of the Commissioner shall, before assuming their duties,

take the oath of office set out in the First Schedule, to carry out their

duties with equity and impartiality and in accordance with the

provisions of this Act and the Regulation, and shall be subject to the

provisions of the Official Secrets Act, Professional Secrecy Act and

the Code of Ethics applicable to public officers.

(2)

The oath of office shall be taken before the State

Advocate.

(1)

The financial resources required by the

Commissioner for the effective performance of his tasks and exercise

of his powers under this Act and the Regulation, under the Freedom

of Information Act and under any other law, as may be fixed by the

House of Representatives in accordance with this article, shall be a

charge on the Consolidated Fund without the need of any further

appropriation other than this Act.

(2) Where during the course of any financial year the sum

fixed by the House of Representatives is, in the opinion of the

Commissioner, insufficient to enable him to efficiently and

effectively fulfil his functions, the Commissioner shall prepare

supplementary estimates for consideration by the House of

Representatives.

(3) The Commissioner shall cause to be prepared in every

financial year, and shall not later than six months after the end of

each such year adopt, estimates of the income and expenditure of the

Commissioner for the next following financial year.

(4) A copy of the estimates shall, upon their adoption by the

Commissioner, be sent forthwith to the Minister and to the Minister

responsible for finance.

(5) The Minister shall at the earliest opportunity, and not

later than six weeks after he has received a copy of the estimates from

the Commissioner, approve the same with or without amendment

after consultation with the Minister responsible for finance.

(1)

The Commissioner shall cause to be kept proper

accounts and other records in respect of his operations under this Act,

the Regulation and under the Freedom of Information Act and any

other law, and shall cause to be prepared a statement of accounts in

respect of each financial year.

(2) The accounts of the Commissioner shall be audited by

an auditor or auditors to be appointed by the Commissioner

Provided that the Minister responsible for finance may,

after consultation with the Minister, require the books or the accounts

of the Commissioner to be audited or examined by the Auditor

General who shall for the purpose have the power to carry out such

physical checking and other certifications as he may deem necessary.

(3) After the end of each financial year, and not later than

the date on which the estimates of the Commissioner are forwarded to

the Minister under article 18(4), the Commissioner shall cause a copy

of the statement of account duly audited to be transmitted to the

Minister and to the Minister responsible for finance together with a

copy of any report made by the auditors on that statement or on the

accounts of the Commissioner.

(4) The Minister shall, at the earliest opportunity and not

later than eight weeks after he has received a copy of every such

statement and report, or if at any time during that period the House of

Representatives is not in session, within eight weeks from the

beginning of the next following session, cause every such statement

and report to be laid on the Table of the House of Representatives.

(5) The Commissioner shall, by not later than six months

after the end of each financial year, make and transmit to the Minister

and to the Minister responsible for finance a report dealing generally

with the activities of the Commissioner during the financial year and

containing such information relating to the proceedings and policy of

the Commissioner as either of the said Ministers may from time to

time require. The Minister shall, at the earliest opportunity and not

later than eight weeks after he has received a copy of every such

report, or if at any time during that period the House of

Representatives is not in session, within eight weeks from the

beginning of the next following session, cause a copy of every such

report to be laid on the Table of the House of Representatives.

PART VI

Administrative Fines and Penalties

(1)

Where the Commissioner imposes an

administrative fine, he shall by order in writing require the controller

or processor, as the case may be, to pay such administrative fine,

which shall be due to the Commissioner as a civil debt

Provided that such order shall be subject to the appeal

procedure as established under article 26.

(2) In the absence of an appeal, the decision of the

Commissioner shall become final and shall constitute an executive

title for the purposes of Title VII of the Code of Organization and

Civil Procedure as if the decision had been ordered by a judgement of

a court of civil jurisdiction.

(3) Where a notice imposing an administrative fine is served

on a person and -

(a)

such person fails to appeal within such time as

an appeal may be entered under article 26, and fails to pay the

fine so imposed; or

(b)

such person appeals within such time to the

Tribunal and the appeal is withdrawn or the Tribunal confirms

the fine in the amount fixed by the Commissioner or in an

amount reduced by it and no further appeal is filed with the

Court of Appeal, or if an appeal is filed with the Court of

Appeal and such Court either confirms the decision taken or

decides that a penalty is due in another amount, or the imposed

penalty is not paid within fifteen days from the date of the

decision or the withdrawal of the appeal, or the date when the

Tribunal or the Court of Appeal confirms or varies the penalty

as aforesaid,

the Commissioner shall be entitled to take civil action to recover the

amount due.

The Commissioner may, after giving due regard to the

circumstances of the case pursuant to Article 83(2) of the Regulation,

impose an administrative fine on a public authority or body

Provided that such a fine shall not exceed twenty-five

thousand euro (€25,000) for each violation and, additionally, the

Commissioner may impose a daily fine payment of twenty-five euro

(€25) for each day during which such violation persists, which fine

shall be determined and imposed by the Commissioner in accordance

with the procedure under article 26 for an infringement of Article

83(4) of the Regulation

Provided further that such a fine shall not exceed fifty

thousand euro (€50,000) for each violation and, additionally, the

Commissioner may impose a daily fine payment of fifty euro (€50)

for each day during which such violation persists, which fine shall be

determined and imposed by the Commissioner, in accordance with

the procedure stipulated under article 26 for an infringement of

Articles 83(5) or 83(6) of the Regulation.

Without prejudice to the provisions of article 21 and

Article 83 of the Regulation, any person who -

(a)

knowingly provides false information to the

Commissioner when so requested by the Commissioner

pursuant to his investigative powers under Article 58 of the

Regulation, or any other law; or

(b)

does not comply with any lawful request

pursuant to an investigation by the Commissioner,

shall be guilty of an offence against this article and shall, upon

conviction, be liable to a fine (multa) of not less than one thousand,

two hundred and fifty euro (€1,250) and not more than fifty thousand

euro (€50,000) or to imprisonment for six months or to both such fine

(multa) and imprisonment

Provided that no proceedings shall be instituted in

respect of any offence under this article except where the

Commissioner provides information to any officer of the Executive

Police.

(1)

Where the Commissioner exercises his powers

pursuant to the Regulation, or any other law, the decision of the

Commissioner shall forthwith be served on the person to whom the

decision is addressed, which decision shall be served either

personally, by registered post to the person’s last known business or

private address, or by electronic means that provide a reliable record

of when service took place.

(2) In the case of service by electronic means, the decision

shall be deemed to have been served upon each person to whom the

decision is addressed when the Commissioner has received

(a)

an electronic receipt automatically generated by

the e-mail server when the communication is read;

(b)

a written confirmation by return electronic mail

from the person to whom the decision is addressed; or

(c)

a verbal confirmation from the person to whom

the decision is addressed that the electronic mail was received.

(3) If service is not effected within a week of issuing the

decision, because the person to whom the decision refers could not be

found or for any other reason attributable to the person to whom the

decision is addressed, the Commissioner shall publish a notice in the

Gazette and in one or more daily newspapers, stating that a decision

has been taken in respect of the person to whom the decision is

addressed and inviting him to collect the decision from the

Commissioner’s office. In any such case, service shall be deemed to

have been effected on the third day after the date of publication of the

last notice.

PART VII

Appeals

(1)

There shall be a tribunal to be known as the

Information and Data Protection Appeals Tribunal, referred to in this

Act as ''the Tribunal'', having the functions and powers assigned to it

by this Act or by any other law.

(2) The Tribunal shall consist of a chairperson and two other

members appointed by the Minister.

(3) The chairperson shall be an advocate with a minimum of

twelve years legal experience and shall have the qualifications,

experience and skills, in particular in the area of the protection of

personal data, required to fulfil his role.

(4)

The two other members mentioned in sub-article (2)

shall be persons who, in the opinion of the Minister, equally represent

the interests of data subjects on the one hand, and of data controllers

and data processors on the other, and who have the qualifications,

experience and skills, in particular in the area of the protection of

personal data, required to fulfil their roles.

(5) The chairperson and other members of the Tribunal shall

hold office for a period of three years and cannot be removed during

their term of office except on grounds of proved inability to perform

the functions of their office, whether arising from infirmity of body

or mind or any other cause, or proved misbehaviour.

(6) A member of the Tribunal may be challenged or abstain

for any of the reasons for which a judge may be challenged or abstain

in accordance with article 734 of the Code of Organization and Civil

Procedure. In any such case the Minister shall appoint a person,

having the qualifications of the member challenged or abstaining, to

sit as a member of the Tribunal in substitution of the said member.

(7) A member of the House of Representatives or of a local

council, a judge or a magistrate, or an officer in the public service

shall be disqualified from being appointed or continuing to be a

member of the Tribunal for so long as he holds that office.

(8) The Minister shall also designate a person to serve as

secretary to the Tribunal.

(1)

There shall be a Registry of the Tribunal and all

records shall be filed therein and made accessible to the public.

(2) The Secretary to the Tribunal shall be responsible for

managing the Registry. The Secretary shall also perform any other

duty which may be incumbent upon him under this Act or any rules

made thereunder.

(1)

Any person to whom a legally binding decision

of the Commissioner is addressed, shall have the right to appeal in

writing to the Tribunal within twenty days from the service of the

said decision as provided in article 23.

(2) An appeal to the Tribunal may be made on any of the

following grounds

(a)

that a material error as to the facts has been

made;

(b)

that there was a material procedural error;

(c)

that an error of law has been made;

(d)

that there was some material illegality, including

unreasonableness or lack of proportionality.

(3) An appeal from a decision of the Commissioner shall be

filed in the Registry of the Tribunal and shall contain

(a)

the grounds on which such appeal is based;

(b)

the names of the witnesses the appellant intends

to produce in evidence, together with their full address, stating

in respect of each of them the facts and proof he intends to

establish by their evidence; and

(c)

any other documents as may be necessary in

support of the appeal.

(4) The Registry of the Tribunal shall, no later than ten days

from the date of filing of the appeal

(a)

serve a copy of the appeal on the Commissioner,

and request him to file a statement on his decision together

with any other information on which such decision was based,

within twenty days from the date when the appeal was served;

and

(b)

serve a copy of the appeal on the respondent or

respondents to the appealed decision, and request the

respondent or respondents to file a reply within twenty days of

service of the appeal.

(5) The respondent or respondents shall file their reply to

the appeal in the Registry of the Tribunal within twenty days of

service of the appeal. Such reply shall contain

(a)

a statement of the facts upon which the

respondent bases his rebuttal of the appellant’s claim;

(b)

the names of the witnesses the respondent

intends to produce in evidence, together with their full address,

stating, in respect of each of them, the facts and proof he

intends to establish by their evidence; and

(c)

any other documents as may be necessary in

support of the defence.

(6) The reply, together with any documents in support

thereof, shall be served without delay on the appellant and on the

Commissioner by the Tribunal.

(7) Upon the expiry of the time-limits for filing the

Commissioner’s statement and the reply, the Tribunal shall fix a date

and time for the hearing. The Tribunal shall notify such date and time

to the appellant, the respondent or respondents to the appealed

decision and to the Commissioner.

(8) The parties to an appeal may be represented or assisted

by their advocates or legal procurators, or by any other person who

enjoys their trust

Provided that no person shall claim fees for representing

or assisting a party before the Tribunal unless such assistance is

provided by an advocate or legal procurator.

(1)

The Tribunal shall be competent to hear and

decide any appeal made to it in accordance with the provisions of this

Act and, subject to the provisions of article 29, the decisions of the

Tribunal shall be final and binding.

(2) The Tribunal may summon any person to appear before

it to give evidence and produce documents. The Tribunal may also

appoint experts to advise it on any technical issue that may be

relevant to its decision. On the day appointed by the Tribunal for the

hearing of the appeal, it shall hear, under oath, the evidence of the

appellant and of the respondent, as well as of other witnesses. The

secretary shall issue the necessary summons by the method of service

referred to in article 23 for any person involved in the hearing of the

appeal.

(3) The Tribunal shall hold its sittings in public unless,

having regard to the nature of the appeal or any other matter before it,

it deems it proper to conduct the proceedings or part thereof in

private.

(4) The Tribunal shall have the same powers as are

competent to the First Hall, Civil Court according to law.

(5) Without prejudice to the provisions of this Act or any

other law, the Tribunal shall regulate its own procedure.

(6) If any party requires the attendance of witnesses, that

party shall complete Form A in the Second Schedule, which shall be

signed by the Chairman of the Tribunal and served on each witness in

accordance with sub-article (2).

(1)

In determining an appeal the Tribunal may

(a)

dismiss the appeal and confirm the decision in

its entirety;

(b)

substitute the decision;

(c)

modify or vary the decision; or

(d)

annul the decision.

(2) The Tribunal shall give reasons for its decision and shall

cause such decision to be made public omitting, if it deems it

appropriate for reasons of confidentiality, the identity of the persons

involved.

(3) The effects of a decision of the Commissioner which is

appealed from shall not, except where the Tribunal or the Court of

Appeal, as the case may be, so orders, be suspended by virtue of the

appeal

Provided that any administrative fine imposed by the

Commissioner shall not apply until the person on whom the

administrative fine is imposed has exhausted all legal remedies

provided pursuant to articles 26 and 29, or if the person to whom the

decision is addressed has permitted the relevant time-limits to expire

without availing himself of the said legal remedies.

(4) The decisions of the Tribunal shall be notified to all

parties to the appeal and to the Commissioner, by any of the methods

of service referred to in article 23.

Any party to an appeal before the Tribunal who feels

aggrieved by a decision of the Tribunal, or the Commissioner if he

feels aggrieved by any such decision, may appeal to the Court of

Appeal as constituted in accordance with article 41(9) of the Code of

Organization and Civil Procedure by means of an application filed in

the registry of that court within twenty days from the date on which

the decision of the Tribunal was notified pursuant to article 26.

(1)

Without prejudice to any other remedy available

to him, including the right to lodge a complaint with the

Commissioner, a data subject may, where he believes that his rights

under the Regulation or this Act have been infringed as a result of the

processing of his personal data in contravention of the provisions of

the Regulation or this Act, by sworn application filed before the First

Hall of the Civil Court, institute an action for an effective judicial

remedy against the controller or processor concerned.

(2) A data subject may also, by sworn application filed

before the First Hall of the Civil Court, institute an action for

damages against the controller or processor who processes personal

data in contravention of the provisions of the Regulation or this Act.

(3) If in determining an action under sub-article (2) the

court finds that the controller or processor is liable for the damage

caused pursuant to Article 82 of the Regulation, the court shall

determine the amount of damages, including, but not limited to,

moral damages as the court may determine, due to the data subject.

(4) Any action under this article shall be instituted within a

period of twelve months from the date when the data subject became

aware, or ought to have reasonably become aware, of such a

contravention, whichever is the earlier.

(1)

Where the Commissioner fails to act in

accordance with Article 78(2) of the Regulation, the data subject may

appeal to the Tribunal in accordance with the procedures established

in article 26.

(2) Where the Tribunal finds that such an appeal is justified

it shall, where appropriate, order the Commissioner to update the data

subject on the progress or outcome of the complaint lodged or order

the Commissioner to handle the complaint lodged in accordance with

Article 77(1) of the Regulation.

PART VIII

General Provisions

(1)

The certification bodies referred to in Article 43

of the Regulation shall be accredited by the National Accreditation

Board (Malta) as established by regulation 3 of the National

Accreditation Board (Malta) (Establishment) Regulations.

(2) The Board referred to in sub-article (1) shall accredit

certification bodies in accordance with EN-ISO/IEC 17065/2012 and

with the additional criteria and requirements established by the

Commissioner.

(3) For the purposes of this article, the National

Accreditation Board (Malta) may consult the Commissioner in the

process of accrediting certification bodies.

(4) Where the Commissioner concludes that the conditions

for accreditation are not, or are no longer met, or where action taken

by a certification body infringes the Regulation, the Commissioner

shall advise the National Accreditation Board (Malta) not to issue

such accreditation, or to revoke such accreditation, as the case may

be.

The Minister may, after consultation with the

Commissioner, prescribe regulations for the better carrying out of the

provisions of this Act and the Regulation, and without prejudice to

the generality of the foregoing and the provisions of the Regulation,

may in particular prescribe regulations concerning

(a)

any

fees

that

may

be

levied

by

the

Commissioner;

(b)

the criminal penalties that may be imposed under

this Act;

(c)

for establishing rules, procedures, formalities

and time limits in respect of any matter provided for under this

Act;

(d)

the extension of the application of this Act to

any particular activity or sector and to provide for the manner

in which data protection is to be implemented in specific

sectors or in respect of specific activities;

(e)

for anything that may be prescribed under any of

the provisions of this Act or the Regulation;

(f)

the cases, other than those referred to in Article

37(1) of the Regulation, where the controller or processor or

associations and other bodies representing categories of

controllers or processors shall designate a data protection

officer;

(g)

the establishment of a lower age than sixteen

years where the processing of the personal data of a child shall

be deemed to be lawful in the absence of consent by the holder

of parental responsibility over the child, provided that such

lower age is not below thirteen years pursuant the provisions

of Article 8(1) of the Regulation;

(h)

to amend the Schedules to this Act; and

(i)

on any other matter relating to data protection.

(1)

The Data Protection Act, hereinafter referred to

as "the repealed Act", is hereby repealed, and any references in any

law to the repealed Act shall be construed as references to this Act.

(2)

Notwithstanding the provisions of sub-article (1)

(a)

the repealed Act shall remain in force for the

purpose of any act, decision, action or proceedings taken in

respect of any breach of the repealed Act that occurred or were

instituted prior to the coming into force of this Act; and

(b)

any subsidiary legislation made under the

provisions of the repealed Act shall, until other provision is

made under or by virtue of this Act, continue in force and have

effect as if it was made under this Act.