Restriction of the Data Protection

L.N. 177 of 2018

DATA PROTECTION ACT, 2018

(CAP. 586)

Restriction of the Data Protection

(Obligations and Rights) Regulations, 2018

IN EXERCISE of the powers conferred by articles 5 and 33 of

the Data Protection Act, 2018, the Minister for Justice, Culture and

Local Government, after consultation with the Information and Data

Protection Commissioner, has made the following regulations:-

The title of these regulations is the Restriction of the Data

Protection (Obligations and Rights) Regulations, 2018.

In these regulations, unless the context otherwise requires

"Act" means the Data Protection Act;

"Commissioner" shall have the same meaning as is assigned to

it in article 3 of the Act; and

"Regulation" means Regulation (EU) 2016/679 of the European

Parliament and of the Council of 27 April 2016 on the protection of

natural persons with regard to the processing of personal data and on

the free movement of such data, and repealing Directive 95/46/EC.

The scope and purpose of these regulations is to apply

restrictions to certain obligations and rights provided for in Article 23

of the Regulation.

Any restriction to the rights of the data subject referred to

in Article 23 of the Regulation shall only apply where such

restrictions are a necessary measure required

(a)

for the safeguarding and maintaining of national

security, public security, defence and the international relations

of Malta;

(b)

for the prevention, detection, investigation and

prosecution of criminal offences, including measures to combat

any money laundering activity, and the execution of criminal

penalties;

(c)

for the administration of any tax, duty, fines, fees

or other money due or owing to the State, under the Income Tax Cap.123.

Act, the Income Tax Management Act, the Value Added Tax Cap. 372.

Act, the Customs Ordinance, the Excise Duty Act and the Fees Cap. 37.

Ordinance, and any other law allowing for generating revenue Cap.

382. in any manner for the Government of Malta;

(d)

for the administration of social security benefits in

accordance with the Social Security Act and where such data Cap. 318.

has been obtained in confidence when carrying out an

investigation against fraud;

(e)

for the establishment, exercise or defence of a legal

claim and for legal proceedings which may be instituted under

any law;

(f)

for the performance of the functions of the

Commissioner;

(g)

for the delivery of professional services in relation

to the carrying out of social work or social assistance by a

public authority, public body, a voluntary organisation or any

other body delivering such services, and provided that such data

shall have been obtained in confidence specifically for the

purposes of delivering these services to the beneficiary;

(h)

for health data that is processed and where it would

be likely that the application of the rights and obligations

referred to in article 5(1) of the Act would cause serious harm to

the vital interests of the patient; or

(i)

for matters relating to Maltese citizenship where

the Minister responsible for citizenship or any person authorised

to act on his behalf, refuses an application for the acquisition of

Maltese citizenship under the Maltese Citizenship Act.

(1)

Personal data that is subject to a restriction referred Safeguards and

to in regulation 4 shall not be subject to processing that is retention

periods.

incompatible with the purposes for which such data was collected,

unless provided for by law or with the explicit consent of the data

subject.

(2) The data controller shall, pursuant to Article 32 of the

Regulation, implement appropriate technical and organisational

measures to protect personal data processed pursuant to these

regulations against accidental destruction or loss or unlawful forms of

processing.

(3) The retention period to be applied for personal data that are

processed pursuant to these regulations, shall not be longer than what

is necessary for the purpose of the processing of such personal data or

shall not be longer than the period required to achieve the aim of the

restriction, or as provided by law.

The data controller shall inform the data subject about any

restriction provided for under these regulations

Provided that such a disclosure will not be prejudicial to

the purposes of the restriction applied pursuant to these regulations.

Any restriction applied under these regulations shall

respect the essence of the fundamental rights and freedoms of the data

subject and shall be a necessary and proportionate measure.

€0.27