Third Country (Data Protection Act) Regulations, 2003

L.N. 155 of 2003

DATA PROTECTION ACT, 2001

(ACT NO. XXVI of 2001)

Third Country (Data Protection Act) Regulations, 2003

IN exercise of the powers conferred by articles 28 and 54 of the

Data Protection Act, 2001, hereinafter called “the Act”, the Minister

for Information Technology and Investment, having consulted the Data

Protection Commissioner, has made the following regulations>–

The title of these regulations is the Third Country (Data

Protection Act) Regulations, 2003.

Unless otherwise stated in these regulations, the definitions

contained in the Data Protection Act shall apply.

These regulations shall apply to transfers of personal data to

third countries.

A third country shall be any country that at the relevant time

is not a Member State of the European Union.

Prior to transferring personal data to a third country, data

controllers shall notify the Commissioner of any transfer of data resulting

from a processing operation.

Any person who contravenes or fails to comply with these

regulations shall be liable to an administrative fine not exceeding ten

thousand liri for each violation and one thousand liri for each day during

which such violation persists, which fine shall be determined and

imposed by the Commissioner.

Mitbug[ fl-Istamperija tal-Gvern – Printed at the Government Printing Press