Regulations, 2008

L.N. 198 of 2008

DATA PROTECTION ACT

(CAP. 440)

Processing of Personal Data

(Electronic Communications Sector) (Amendment)

Regulations, 2008

IN EXERCISE of the powers conferred by article 54 of the Data

Protection Act, the Minister responsible for data protection, after

consultation with the Data Protection Commissioner, has made the

following regulations

The title of these regulations is the Processing of Personal Title.

Data (Electronic Communications Sector) (Amendment) Regulations, L.N. 16 of 2003.

2008 and they shall be read and construed as one with the Processing

of Personal Data (Electronic Communications Sector) Regulations,

2003, hereinafter referred to as "the principal regulations".

Immediately after regulation 3 of the principal regulations Addition of title

to the principal

there shall be added the following title

regulations.

"Part I – Processing of Personal Data".

Immediately after regulation 17 of the

principal Adds new Part

II to the

regulations there shall be added the following new Part II

principal

regulations.

"Part II – Retention of Data

In this Part, unless the context

Definitions.

otherwise requires -

"cell ID" means the identity of the cell

from which a mobile telephony call

originated or in which it terminated;

"data" means traffic data and location

data and the related data necessary to

identify the subscriber or user;

"Police" means the Commissioner of

Police and includes any officer of the Police

designated by the Commissioner to act on

his behalf;

"security service" means the Security

Service as defined in the Security Service

Act;

"serious crime" means any crime which

is punishable by a term of imprisonment of

not less than one year and for the purposes

of these regulations includes the crimes

mentioned in articles 35(1)(d) and 35A of

the Electronic Communications (Regulation)

Act;

"subscriber" means any natural or legal

person who is party to a contract with the

provider of publicly available electronic

communications services or of a public

communications network, for the supply of

such services, and includes a pre-paid

customer of such provider;

"telephone service" means calls

(including voice, voicemail and conference

and data calls), supplementary services

(including call forwarding and call transfer)

and messaging and multi-media services

(including short message services, enhanced

media services and multi-media services);

"unsuccessful call attempt" means a

communication where a telephone call has

been successfully connected but not

answered or there has been a network

management intervention;

"user" means any legal entity or natural

person using a publicly available electronic

communications service, for private or

business purposes, without necessarily

having subscribed to that service;

"user ID" means a unique identifier

allocated to persons when they subscribe to

or register with an Internet access service or

Internet communications service.

(1) Notwithstanding the provisions

Obligation to retain data.

of regulations 5, 6, 7 and 8, a service provider of

publicly available electronic communications

services or of a public communications network

shall retain the data specified in regulation 21 to

the extent that those data are generated or

processed by such providers in the process of

supplying

the

communications

services

concerned.

(2) The obligation to retain the data as

provided in sub-regulation (1) shall, to the extent

that such data are generated or processed, and

stored (as regards telephony data) or logged (as

regards internet data) be applicable to

unsuccessful call attempts

Provided that such obligation shall not

be applicable in relation to unconnected calls.

(3) No data revealing the content of any

communication may be retained pursuant to these

regulations.

(1) Data retained under this Part

Access to data.

shall be disclosed only to the Police or to the

Security Service, as the case may be, where such

data is required for the purpose of the

investigation, detection or prosecution of serious

crime.

(2) When data retained under this Part is

required, such data shall be provided by a service

provider of publicly available electronic

communications services or of a public

communications network, from whom it is

required, in an intelligible form and in such a way

that it is visible and legible.

(3) A request for data shall be made in

writing and shall be clear and specific

Provided that where the data is urgently

required, such request may be made orally, so

however that the written request shall be made at

the earliest opportunity.

(4) Data retained under this Part shall,

following the request, be provided without undue

delay.

Service Providers are required to retain

Categories of data to be

retained.

the following categories of data

(1) data necessary to trace and identify the

source of a communication

(a)

concerning

fixed

network

telephony and mobile telephony

(i) the calling telephone

number;

(ii) the name and address of

the subscriber or registered user;

(b) concerning

Internet

access,

Internet e-mail and Internet telephony

(i) the user ID allocated;

(ii) the used ID telephone

number

allocated

to

any

communication entering the public

telephone network;

(iii) the name and address of

the subscriber or registered user to

whom an Internet-Protocol address,

user ID or telephone number was

allocated at the time of the

communication;

(2) data necessary to identify the

destination of a communication

(a)

concerning

fixed

network

telephony and mobile telephony

(i) the telephone number or

numbers dialled or called and, in cases

involving supplementary services such

as call forwarding or call transfer, the

number, or numbers to which the call is

routed;

(ii) the name and address of

the subscriber or registered user;

(b) concerning Internet e-mail and

Internet telephony

(i) the user ID or telephone

number of the intended recipient of an

Internet telephony call;

(ii) the name and address of

the subscriber or registered user and

user ID of the intended recipient of the

communications;

(3) data necessary to identify the date,

time and duration of a communication

(a) concerning

fixed

network

telephony and mobile telephony, the date

and time of the start and end of the

communication;

(b) concerning

Internet

access,

Internet e-mail and Internet telephony

(i) the date and time of the

log-in and log-off of the Internet access

service, based on a certain time zone,

together with the Internet Protocol

address, whether dynamic or static,

allocated by the Internet access service

provider to a communication, and the

user ID of the subscriber or registered

user;

(ii) the date and time of the

log-in and log-off of the Internet e-mail

service or Internet telephony service,

based on a certain time zone;

(ii) the date and time of the

log-in and log-off of the Internet e-mail

service or Internet telephony service,

based on a certain time zone;

(4) data necessary to identify the type of

communication

(a) concerning

fixed

network

telephony and mobile telephony, the

telephone service used;

(b) concerning Internet e-mail and

Internet telephony, the Internet service used;

(5) data necessary to identify users’

communication equipment or what purports to be

their equipment

(a)

concerning

fixed

network

telephony, the calling and called telephone

numbers;

(b) concerning mobile telephony

(i) the calling and called

telephone numbers;

(ii) the International Mobile

Subscriber Identity of the calling party;

(iii) the International Mobile

Equipment Identity of the calling party;

(iv) the International Mobile

Subscriber Identity of the called party;

(v) the International Mobile

Equipment Identity of the called party;

(vi) in the case of pre-paid

anonymous services, the date and time

of the initial activation of the service

and the location label (Cell ID) from

which the services was activated;

(c) concerning

Internet

access,

Internet e-mail and Internet telephony

(i) the calling telephone

numbers for dial-up access;

(ii) the digital subscriber line

or other end point of the originator of

the communication;

(6) data necessary to identify the location

of mobile communication equipment

(a) the location label (Cell ID) at the

start of the communication;

(b) data identifying the geographic

location of cells by reference to their

location labels (Cell ID) during the period

for which communications data are retained.

The categories of data specified in

Periods of retention.

regulation 21 shall be retained by the service

providers for the following periods

(a)

communications data relating to

Internet Access and Internet e-mail for a

period of six months from the date of

communication;

(b) communications data concerning

fixed network telephony, mobile telephony

and Internet telephony for a period of one

year from the date of communication.

(1) The Police may, in addition to

Conservation order.

the request for data under regulation 20, issue a

conservation order in relation to the data.

(2) The conservation order shall be served

on the service provider within the retention period

applicable under regulation 22.

(3) Where a conservation order has been

issued, the service provider shall conserve the

data-

(a) either for a period of six months

in addition to the original or extended

applicable retention period which period

shall not, without an order of a Magistrate or

of a competent Court, exceed a total period

of two years; or

(b) where criminal proceedings have

been commenced within the applicable

retention period or within such period as

extended in accordance with paragraph (a),

for such time as may be necessary for the

conclusion of the criminal proceedings

where the data is required to be produced as

evidence; such conclusion shall be deemed

to occur when the judgement in the

proceedings becomes final and conclusive,

whichever is the longer period.

Data retained under this Part shall

Data security.

comply with the data security principles

established under the Act and shall as a

minimum -

(a)

be of the same quality and

subject to the same security and protection

as the data on the network;

(b) be subject to appropriate

technical and organisational measures to

protect the data against accidental or

unlawful destruction, accidental loss or

alteration, or unlawful storage, processing,

access or disclosure;

(c)

be subject to appropriate

technical and organisational measures to

ensure that they can be accessed by specially

authorised personnel only;

(d) except for such data as are the

subject of a conservation order, be destroyed

at the end of the applicable retention period.

(1) Service providers shall, in

Statistics.

relation to the retention of data under this Part,

provide on an annual basis, the following

information

to

the

Data

Protection

Commissioner -

(a) the cases in which information

was provided under this Part;

(b) the time elapsed between the

date on which the data were retained and the

date on which the transmission of the data

was requested;

(c) any cases where requests for data

could not have been met.

(2) Any statistics provided under this

regulation shall not contain any personal data.".

Mitbug] fl-Istamperija tal-Gvern - Printed at the Government Printing Press

€0.75