Processing of Personal Data (Electronic Communications Sector)

L.N. 239 of 2011

DATA PROTECTION ACT

(CAP. 440.)

Processing of Personal Data (Electronic Communications Sector)

(Amendment) Regulations, 2011

IN exercise of the powers conferred by article 54 of the Data

Protection Act, the Minister for Justice and Home Affairs, after

consultation with the Information and Data Protection Commissioner,

has made the following regulations:-

(1)

The title of these regulations is the Processing of Citation and

Personal Data (Electronic Communications Sector) (Amendment) commencement.

Regulations, 2011 and these regulations shall be read and construed

as one with the Processing of Personal Data (Electronic S.L. 440.01.

Communications Sector) Regulations, hereinafter referred to as "the

principal regulations".

(2) These regulations shall come into force on such date as the

Minister responsible for data protection may establish by notice in the

Gazette .

Regulation 2 of the principal regulations shall be amended Amends

regulation 2 of

as follows

the principal

regulations.

(a)

the definition "location data" shall be substituted

by the following

" "location data" means any data processed in an

electronic communications network or by an electronic

communication service, indicating the geographic position

of the terminal equipment of a user of a publicly available

electronic communications service;"; and

(b)

immediately after the definition "person" there

shall be added the following new definition

" "personal data breach" means a breach of security

leading to the accidental or unlawful destruction, loss,

alteration, unauthorised disclosure of, or access to,

personal data transmitted, stored or otherwise processed in

connection with the provision of a publicly available

electronic communications service;".

In regulation 3 of the principal regulations, immediately Amends

after the words "in Malta and any other country" there shall be added regulation

the principal

the words ", including public communications networks supporting regulations.

data collection and identification devices,".

Immediately after regulation 3 of the principal regulations

there shall be added the following new regulation

3A. (1)

In the case of a personal data

breach, the provider of publicly available electronic

communications services shall, without undue

delay, notify the personal data breach to the

Commissioner.

(2) When the personal data breach is likely to

adversely affect the personal data or privacy of a

subscriber or individual, the provider shall also

notify the subscriber or individual of the breach

without undue delay.

(3) Notification of a personal data breach to

a subscriber or individual concerned shall not be

required if the provider has demonstrated to the

satisfaction of the Commissioner that he has

implemented appropriate technological protection

measures, and that those measures were applied to

the data concerned by the security breach. Such

technological protection measures shall render the

data unintelligible to any person who is not

authorised to access it.

(4) Without prejudice to the provider’s

obligation to notify subscribers and individuals

concerned, if the provider has not already notified the

subscriber or individual of the personal data breach,

the Commissioner, having considered the likely

adverse effects of the breach, may require him to do

so.

(5) The notification to the subscriber or

individual shall at least include the nature of the

personal data breach and the contact points where

more information can be obtained, and shall

recommend measures to mitigate the possible adverse

effects of the personal data breach. The notification

to the Commissioner shall, in addition, include the

consequences of, and the measures proposed or taken

by the provider to address, the personal data breach.

(6) The Commissioner shall encourage the

drawing up of guidelines and, where necessary, issue

instructions concerning the circumstances in which

providers are required to notify personal data

breaches, the format of such notification and the

manner in which the notification has to be made.

(7) Service providers shall maintain an

inventory of personal data breaches comprising the

facts surrounding the breach, its effects and the

remedial action taken which shall be sufficient to

enable the Commissioner to verify compliance with

the provisions of this regulation.".

Regulation 5 of the principal regulations shall be Substitutes

substituted by the following

"5. (1)

The storing of information or the gaining of

access to information stored in the terminal equipment of a

subscriber or user shall only be allowed on condition that the

subscriber or user concerned has given his consent, having been

provided by the controller with clear and comprehensive

information in terms of article 19 of the Act.

(2)

The requirements contained in this regulation shall

not prevent the technical storage or access for the sole purpose

of carrying out or facilitating the transmission of a

communication over an electronic communications network or

as may be strictly necessary in order for the service provider to

provide an information society service explicitly requested by

the subscriber or user to provide the service.".

Regulation 9 of the principal regulations shall be Substitutes

substituted by the following

(1)

A person shall not use, or cause to

be used, any publicly available electronic

communications service to make an unsolicited

communication for the purpose of direct marketing

by means of -

(a)

an automatic calling machine; or

(b)

a facsimile machine; or

(c)

electronic mail,

to a subscriber or user, irrespective of whether such

subscriber or user is a natural person or legal person,

unless the subscriber or user has given his prior

consent in writing to the receipt of such a

communication.

(2) Notwithstanding sub-regulation (1), where

a person has obtained from his customers their

contact details for electronic mail in relation to the

sale of a product or a service, in accordance with the

Act, that same person may use such details for direct

marketing of its own similar products or services

Provided that customers shall be given the

opportunity to object, free of charge and in an easy

and simple manner, to such use of electronic contact

details at the time of their collection and on the

occasion of each message where the customer has

not initially refused such use.

(3) A person who uses or causes to be used

any other means of communication other than those

stated in sub-regulations (1) and (2) for the purpose

of direct marketing shall, at no charge to the

subscriber or user, ensure that any such

communications to a subscriber or user are not sent if

the subscriber or user requests that such

communications cease.

(4) In all cases the practice of sending

electronic mail for the purposes of direct marketing

disguising or concealing the identity of the sender on

whose behalf the communication is made, which

contravene the provisions of regulation 6 of the

Electronic Commerce (General) Regulations, or

which do not have a valid address to which the

recipient may send a request that such

communications cease, or which encourage recipients

to visit websites that contravene such regulation,

shall be prohibited.".

€0.36