Criminal Matters) Regulations, 2011

L.N. 198 of 2011

DATA PROTECTION ACT

(CAP. 440)

Processing of Personal Data (Police and Judicial Cooperation in

Criminal Matters) Regulations, 2011

IN EXERCISE of the powers conferred by articles 5 and 54(m)

of the Data Protection Act, the Minister for Justice and Home Affairs

has after consultation with the Information and Data Protection

Commissioner, made the following regulations:-

(1)

The title of these regulations is the Processing of

Personal Data (Police and Judicial Cooperation in Criminal Matters)

Regulations, 2011.

(2) These regulations shall come into force on such day as the

minister responsible for Justice may by notice in the Gazette appoint

and different dates may be appointed in respect of different provisions

for the purposes of these regulations.

(1)

In these regulations, unless the context otherwise

requires

"the Act" means the Data Protection Act;

"the Commissioner" means the Information and Data Protection

Commissioner appointed under article 36 of the Act;

"national competent authorities" means the Police, Customs,

Judicial and other national authorities that are authorised by national

law to process personal data for the purposes of police and judicial

cooperation in criminal matters;

"referencing" means the marking of stored personal data

without the aim of limiting its processing in the future; and

"to make anonymous" means to modify personal data in such a

way that details of personal or material circumstances can no longer

or only with disproportionate investment of time, cost and labour be

attributed to an identified or identifiable natural person.

(2) The definitions contained in article 2 of the Act shall,

unless the context otherwise requires and subject to the provisions of

sub-regulation (1), apply to these regulations.

(1)

The purpose of these regulations is to ensure a high Purpose and

of protection of the fundamental rights and freedoms of natural scope.

persons, and in particular their right to privacy, with respect to the

processing of personal data in the framework of police and judicial

cooperation in criminal matters, provided for by Title VI of the Treaty

on European Union, while guaranteeing a high level of public safety.

(2) In accordance with this regulation, national competent

authorities shall protect the fundamental rights and freedoms of

natural persons, and in particular their right to privacy when, for the

purpose of the prevention, investigation, detection or prosecution of

criminal offences or the execution of criminal penalties, personal

data

(a)

is or has been transmitted or made available to

competent authorities in other Member States or to authorities

or information systems established on the basis of Title VI of

the Treaty on European Union; or

(b)

is or has been received from competent authorities

in other Member States or from authorities or by means of

information systems established on the basis of the Treaty on

European Union or the Treaty establishing the European

Community.

(3) The Act shall be extended to apply to the processing

referred to in sub-regulations (1) and (2), to the extent as provided in

these regulations.

(1)

Personal data may be collected by the national Principles of

competent authorities only for specified, explicit and legitimate lawfulness,

proportionality

purposes in the framework of their tasks and may be processed only and purpose.

for the same purpose for which the data was collected. Processing of

the data shall be lawful and adequate, relevant and not excessive in

relation to the purposes for which it is collected.

(2) Further processing for another purpose shall be permitted

in so far as

(a)

it is not incompatible with the purposes for which

the data were collected;

(b)

the national competent authorities are authorised to

process such data for such other purpose in accordance with the

applicable national law; and

(c)

processing is necessary and proportionate to that

other purpose.

(3) The national competent authorities may also further

process personal data for historical, statistical or scientific purposes,

subject to providing appropriate safeguards, such as making the data

anonymous.

(1)

Personal data shall be rectified if inaccurate and,

where this is possible and necessary, completed or updated.

(2) Personal data shall be erased or made anonymous when it

is no longer required for the purposes for which it was lawfully

collected or is lawfully further processed. Archiving of this data in a

separate data set for an appropriate period in accordance with national

law shall not be affected by this provision.

(3) Personal data shall be blocked instead of erased if there are

reasonable grounds to believe that erasure could affect the legitimate

interests of the data subject. Blocked data shall be processed only for

the purpose which prevented its erasure.

(4) When the personal data is contained in a judicial decision

or record related to the issuance of a judicial decision, the

rectification, erasure or blocking shall be carried out in accordance

with national rules on judicial proceedings.

Appropriate time limits shall be established for the erasure

of personal data or for a periodic review of the need for the storage of

the data. Procedural measures shall ensure that these time limits are

observed.

The processing of sensitive personal data shall be

permitted only when this is strictly necessary and subject to adequate

safeguards as provided or may be prescribed by national law.

A decision which produces an adverse legal effect for the

data subject or significantly affects him and which is based solely on

automated processing of data intended to evaluate certain personal

aspects relating to the data subject shall be permitted only if

authorised by a law which also lays down measures to safeguard the

legitimate interests of the data subject.

(1)

National competent authorities shall take all

reasonable steps to provide that personal data which is inaccurate,

incomplete or no longer up to date is not transmitted or made

available. To that end, national competent authorities shall, as far as

practicable, verify the quality of personal data before it is transmitted

or made available. As far as possible, in all transmissions of data,

available information shall be added which enables the authority of

the receiving Member State to assess the degree of accuracy,

completeness, up-to-dateness and reliability.

(2) If it emerges that incorrect data has been transmitted or

data has been unlawfully transmitted, the recipient must be notified

without delay. The data must be rectified, erased, or blocked without

delay in accordance with regulation 5.

(3) Where personal data is transmitted to national competent

authorities without a specific request, such authorities receiving the

information shall verify without delay whether this data is necessary

for the purpose for which it was transmitted.

(1)

Upon transmission or making available of the data, Time limits.

the transmitting authority may in line with its national law and in

accordance with regulations 5 and 6, indicate the time limits for the

retention of data, upon the expiry of which, the recipient shall erase or

block the data or review whether or not it is still needed. This

obligation shall not apply if, at the time of the expiry of these time

limits, the data is required for a current investigation, prosecution of

criminal offences or enforcement of criminal penalties.

(2) Where the transmitting authority has not indicated a time

limit in accordance with sub-regulation (1), the time limits referred to

in regulations 5 and 6 for the retention of data provided for under the

national law of the authority receiving the information shall be

applicable.

(1)

National competent authorities shall ensure that all Logging and

transmissions of personal data are logged or documented for the documentation.

purposes of verification of the lawfulness of the data processing, self-

monitoring and ensuring proper data integrity and security.

(2) Logs or documentation prepared under sub-regulation (1)

shall be communicated on request to the Commissioner for the

control of data protection. The Commissioner shall use this

information only for the control of data protection and for ensuring

proper data processing as well as data integrity and security.

(1)

Personal data received from or made available by Personal data

the competent authority of another Member State may, in accordance received

another Member

with the requirements of regulation 4(2), be further processed by a State.

national competent authority only for the following purposes other

than those for which they were transmitted or made available

(a)

the prevention, investigation, detection or

prosecution of criminal offences or the execution of criminal

penalties other than those for which they were transmitted or

made available;

(b)

other judicial and administrative proceedings

directly related to the prevention, investigation, detection or

prosecution of criminal offences or the execution of criminal

penalties;

(c)

the prevention of an immediate and serious threat

to public security; or

(d)

any other purpose only with the prior consent of the

transmitting authority or with the consent of the data subject,

given in accordance with national law.

(2) The national competent authorities may also further

process personal data transmitted by competent authorities of other

Member States for historical, statistical or scientific purposes, subject

to providing appropriate safeguards, such as, making the data

anonymous.

(1)

When processing personal data originating from

competent authorities of other Member States, national competent

authorities shall ensure compliance with specific processing

restrictions applicable under the law of the transmitting authority.

(2) Where personal data transmitted by national competent

authorities is subject to specific processing restrictions under national

law, the national competent authority providing the information shall

inform the receiving authority of such restrictions.

(3) When applying sub-regulation (2), national competent

authorities shall not apply restrictions regarding data transmissions to

competent authorities in other Member States or to agencies or bodies

established pursuant to Title VI of the Treaty on European Union

other than those applicable to similar national data transmissions.

(1)

National competent authorities shall provide that

personal data transmitted or made available by the competent

authority of another Member State may be transferred to third States

or international bodies, only if

(a)

it is necessary for the prevention, investigation,

detection or prosecution of criminal offences or the execution of

criminal penalties;

(b)

the receiving authority in the third State or

receiving international body is responsible for the prevention,

investigation, detection or prosecution of criminal offences or

the execution of criminal penalties;

(c)

the authority of the Member State from which the

data was obtained has given its consent to transfer in

compliance with its national law; and

(d)

the third State or international body concerned

ensures an adequate level of protection for the intended data

processing.

(2) Transfer without prior consent in accordance with sub-

regulation (1)(c) shall be permitted only if transfer of the data is

essential for the prevention of an immediate and serious threat to

public security of a Member State or a third State or to essential

interests of a Member State and the prior consent cannot be obtained

in good time. The authority responsible for giving consent shall be

informed without delay.

(3) By way of derogation from sub-regulation (1)(d), personal

data may be transferred if

(a)

one or more conditions established under article 28

of the Act are met, and in particular if

(i) the transfer is necessary for legitimate

specific interests of the data subject; or

(ii) the transfer is necessary for legitimate

prevailing interests, especially important public interests;

(b)

the third State or receiving international body

provides safeguards which are deemed adequate by the

Information and Data Protection Commissioner in accordance

with article 28(3) of the Act.

(4) The adequacy of the level of protection referred to in sub-

regulation (1)(d) shall be assessed in accordance with article 27(2) of

Where personal data is received from or made Transmission to

available by the competent authority of another Member State, the private

in Member

national competent authority receiving the information may transmit States.

such data to private parties only if

(a)

the competent authority of the Member State from

which the data was obtained has consented to transmission in

compliance with its national law;

(b)

no legitimate specific interests of the data subject

prevent transmission; and

(c)

in particular cases transfer is essential for the

national competent authority transmitting the data to a private

party for

(i)

the performance of a task lawfully assigned to

it;

(ii) the prevention, investigation, detection or

prosecution of criminal offences or the execution of

criminal penalties;

(iii) the prevention of an immediate and serious

threat to public security; or

(iv) the prevention of serious harm to the rights of

individuals.

(2) The national competent authority transmitting the data to a

private party shall inform the latter of the purposes for which the data

may exclusively be used.

(3) The recipient shall, on request, inform the national

competent authority which transmitted or made available the personal

data about their processing.

(1)

The data subject shall have the right to be informed

regarding the collection or processing of personal data by the national

competent authorities, in accordance with article 19 of the Act. The

information shall be subject to the exemptions provided in article 23

of the Act.

(2) When personal data has been transmitted or made available

between a national competent authority and a competent authority in

another Member State, the national competent authority may, in

accordance with the provisions referred to in sub-regulation (1),

request that the competent authority of the other Member State does

not inform the data subject.

(3) In accordance with the procedure referred to in sub-

regulation (2), national competent authorities involved in data

exchanges with competent authorities of other Member States, may

also be subject to a request from the latter authorities, not to provide

information to the data subject. In such case, the national competent

authority shall not inform the data subject without the prior consent of

the other authority making the request.

(1)

Every data subject shall have the right to request Right of access.

access to the information being processed in relation to him by a

national competent authority. Such request shall be submitted in

accordance with article 21 of the Act.

(2) The national competent authority receiving the request

shall provide the data subject with information in accordance with

article 21(2) of the Act.

(3) The information referred to in sub-regulation (2), may be

subject to restrictions in accordance with article 23 of the Act, and in

order to avoid obstructing official or legal inquiries, investigations or

procedures, provided that

(a)

such restriction constitutes a necessary and

proportionate measure, having due regard to the legitimate

interests of the person concerned; and

(b)

in case of a restriction, the data subject shall be

entitled to receive a confirmation from the Commissioner that

all necessary verifications have taken place.

(4) Any refusal or restriction of access shall be set out in

writing to the data subject. At the same time, the factual or legal

reasons on which the decision is based shall also be communicated to

him. The latter communication may be omitted where the refusal or

restriction occurred in terms of sub-regulation (3), and where the

provision of information on the factual or legal reasons may prejudice

a legal task of the national competent authority being exercised

within the meaning of article 23 of the Act. In all of these cases the

data subject shall be advised that he may lodge an appeal to the

Commissioner or seek judicial or legal redress within the competent

Court.

(1)

The data subject shall have the right to request Right to

rectification, erasure or blocking of personal data that has not been rectification,

erasure or

processed in accordance with these regulations and in particular blocking.

regulations 5, 9, and 10.

(2) The national competent authority processing the

information shall verify whether the request of the data subject is

justified, and ensure that the necessary measures are taken in

accordance with article 22 of the Act.

(3) If the accuracy of an item of personal data is contested by

the data subject and its accuracy or inaccuracy cannot be ascertained,

referencing of that item of data may take place.

(4) Where the national competent authority refuses

rectification, erasure or blocking, the refusal shall be communicated

in writing to the data subject who must be informed that he may lodge

an appeal to the Commissioner or seek judicial or legal redress within

the competent Court.

(1)

Where access, rectification, blocking or erasure is

refused or restricted the data subject shall be entitled to appeal to the

Commissioner within thirty days from when the data subject is

informed, or may reasonably be deemed to have known, of the

decision.

(2) In the examination of an appeal, the Commissioner shall

review the decision and shall inform the data subject about such

review and whether the national competent authority acted properly

or not.

(1)

Where a data subject has suffered damage as a

result of an unlawful processing operation, or of any act incompatible

with these regulations, he shall be entitled to exercise an action for

damages in accordance with article 46 of the Act.

(2) Where the national competent authority is the recipient of

personal data transmitted by a competent authority of another

Member State, the former authority cannot, in the context of its

liability vis-à-vis an injured party, cite in its defence that the data

transmitted was inaccurate. If the national competent authority pays

compensation for damage caused by the use of incorrectly transmitted

data, it shall be entitled to request a refund of the amount paid in

damages, from the competent authority responsible for the inaccurate

transmission, taking into account any fault that may lie with the

national competent authority itself.

(3) Where it is proven that the national competent authority

transmits inaccurate data, as a result of which, the data subject suffers

damages, which are then compensated by the competent authority of

another Member State being the recipient of the information, the

national competent authority shall have the liability to refund the

amount paid in compensation.

(1)

Any person who has access to personal data which

falls within the scope of these regulations may process such data only

if that person is a member of, or acts on instructions of, the national

competent authority, unless he is required to do so by law.

(2) Persons working for a national competent authority shall

be bound by all the data protection rules applicable to the national

competent authority in question and also any other law or legally

binding instrument regulating confidentiality and secrecy applicable

to their official capacity.

(1)

National competent authorities shall implement Security of

appropriate technical and organisational measures to protect personal processing.

data against accidental or unlawful destruction or accidental loss,

alteration, unauthorised disclosure or access, in particular where the

processing involves the transmission over a network or the making

available by granting direct automated access, and against all other

unlawful forms of processing, taking into account in particular the

risks represented by the processing and the nature of the data to be

protected. Having regard to the state of the art and the cost of their

implementation, such measures shall ensure a level of security

appropriate to the risks represented by the processing and the nature

of the data to be protected.

(2) In respect of automated data processing, national

competent authorities shall implement measures designed to

(a)

deny unauthorised persons access to data-

processing equipment used for processing personal data

(equipment access control);

(b)

prevent the unauthorised reading, copying,

modification or removal of data media (data media control);

(c)

prevent the unauthorised input of data and the

unauthorised inspection, modification or deletion of stored

personal data (storage control);

(d)

prevent the use of automated data-processing

systems by unauthorised persons using data communication

equipment (user control);

(e)

ensure that persons authorised to use an automated

data-processing system only have access to the data covered by

their access authorisation (data access control);

(f)

ensure that it is possible to verify and establish to

which bodies personal data has been or may be transmitted or

made available using data communication equipment

(communication control);

(g)

ensure that it is subsequently possible to verify and

establish which personal data has been input into automated

data-processing systems and when and by whom the data was

input (input control);

(h)

prevent

the

unauthorised

reading,

copying,

modification or deletion of personal data during transfers of

personal data or during transportation of data media (transport

control);

(i)

ensure that installed systems may, in case of

interruption, be restored (recovery);

(j)

ensure that the functions of the system perform,

that the appearance of faults in the functions is reported

(reliability) and that stored data cannot be corrupted by means

of a malfunctioning of the system (integrity).

(3) Where a national competent authority engages a processor

to act upon its behalf within the meaning of article 25 of the Act, such

processor may be designated only if it can guarantee observance of

the requisite technical and organisational measures under sub-

regulation (1) and comply with the instructions of the national

competent authority under regulation 21. The national competent

authority shall monitor the processor in those respects.

(4) Personal data may be processed by a processor only on the

basis of a written contract or any other legally binding instrument

laying down specific data protection rules applicable to the entrusted

data processing.

(1)

The processing of personal data for the purposes of

these regulations, shall be subject to the notification requirements

established under article 29 of the Act.

(2) Pursuant to sub-regulation (1), national competent

authorities shall notify the Commissioner with the processes of

personal data. The notification shall specify the details referred to in

article 29(3) of the Act.

National competent authorities shall consult with the

Commissioner, prior to processing personal data which will form part

of a new filing system to be created where

(a)

sensitive personal data is to be processed; or

(b)

the type of processing, in particular using new

technologies, mechanism or procedures, holds otherwise

specific risks for the fundamental rights and freedoms, and in

particular the privacy of the data subject.

(1)

The Commissioner shall be responsible for the

independent supervision and to provide advice and monitor the

application of these regulations.

(2) In order to ensure compliance with these regulations the

Commissioner shall exercise the same functions and powers as

conferred to him under the Act.

(3) Pursuant to sub-regulation (2), the Commissioner may

impose fines as stipulated in the Act and as may be prescribed by

means of specific regulations laying down effective, proportionate

and dissuasive penalties to be imposed in case of infringements of

said Act and regulations made thereunder.

(1)

The provisions of these regulations shall not Relationship to

prejudice any obligations and commitments incumbent upon Malta by agreements

third States.

virtue of bilateral or multilateral agreements with third States existing

at the time of adoption of these regulations.

(2) Where in the application of bilateral or multilateral

agreements, a national competent authority transfers to a third State,

personal data obtained from another Member State, such transfer

shall respect regulation 14(1)(c) or (2), as appropriate.

(3) Notwithstanding sub-regulations (1) and (2), national

competent authorities, shall to the extent possible, implement

appropriate contractual provisions to ensure that the transfer of

personal data to third countries resulting from international

obligations of Malta provides an adequate level of data protection.

(4) The contractual provisions referred to in sub-regulation (3)

shall be integrated in the bilateral or multilateral agreement in case of

renegotiation, or shall be implemented distinctively from the bilateral

or multilateral agreement, provided that such provisions are not

inconsistent with those contained in the existing agreement.

(5) Prior to implementing any contractual provisions within

the meaning of sub-regulation (3), the national competent authorities

shall submit such provisions to the Commissioner for approval.

Where in acts, adopted under Title VI of the Treaty on Relationship to

European Union prior to the date of entry into force of these previously

adopted acts of

regulations and regulating the exchange of personal data involving the Union.

national competent authorities, or the access of such designated

authorities to information systems established pursuant to the Treaty

establishing the European Community, specific conditions have been

introduced as to the use of such data, these conditions shall take

precedence over the provisions of these regulations on the use of data

exchanged with other Member States.

In the case of conflict between the Maltese and English English text to

prevail.

texts of these regulations, the English text shall prevail.

B

€1.17