Re-Use Regulations, 2020

L.N. 429 of 2020

RE-USE OF PUBLIC SECTOR INFORMATION ACT

(CAP. 546)

Organisational Structures for Data Sharing and

Re-Use Regulations, 2020

IN EXERCISE of the powers conferred by article 25 of the Re-

Use of Public Sector Information Act, the Minister responsible for

public sector information has made the following regulations:-

Part I - Preliminary

The title of these regulations is the Organisational

Structures for Data Sharing and Re-Use Regulations, 2020.

(2) These regulations provide for

(a)

the establishment of a regulatory authority for the

purposes of the Re-use of Public Sector Information Act;

(b)

the establishment of an implementation authority

for the purposes of the Re-use of Public Sector Information Act;

(c)

the establishment, maintenance and publication of

a Register of Registers;

(d)

the publication of a Data Classification Scheme to

be applied by the data owners to official registers and published

as part of the Register of Registers;

(e)

the legal basis for a standard format and structure

for a Uniform Resource Identifier to be used for the

identification of official records and for a standard metadata

(f)

the legal basis for a set of Administrative and Data

Governance Registers; and

(g)

the establishment of a Data Governance Council.

(3) These regulations shall come into force on such date or

dates as the Minister responsible for Public Sector Information may,

by Notice in the Gazette, establish, and different dates may be so

established for different purposes or different provisions of these

regulations.

(1)

It-titolu ta’ dawn ir-regolamenti huwa r- Titolu, għan u

Regolamenti tal-2020 dwar l-Istrutturi ta’ Organizzazzjoni għat- applikabilità.

Tqassim u l-Użu mill-Ġdid ta’ Data.

(2) Dawn ir-regolamenti jipprovdu għal

(a)

it-twaqqif ta’ awtorità regolatorja għall-finijiet tal-

Att dwar l-Użu mill-Ġdid tal-Informazzjoni tas-Settur Pubbliku; Kap. 546.

(b)

it-twaqqif ta’ awtorità ta’ implimentazzjoni għall-

finijiet tal-Att dwar l-Użu mill-Ġdid tal-Informazzjoni tas- Kap. 546.

Settur Pubbliku;

(ċ)

it-twaqqif, manutenzjoni u pubblikazzjoni ta’

Reġistru tar-Reġistri;

(d)

il-pubblikazzjoni ta’ Skema ta’ Klassifikazzjoni ta’

Data li għandha tiġi applikata minn sidien tad-data għar-reġistri

uffiċjali u ppubblikata bħala parti mir-Reġistru tar-Reġistri;

(e)

il-bażi legali għal format u struttura standard għal

Identifikatur Uniformi ta’ Riżorsi li għandu jintuża għall-

identifikazzjoni ta’ records uffiċjali u għal record standard ta’

metadata;

(f)

il-bażi legali għal sett ta’ Reġistri ta’ Governanza

Amministrattiva u dwar Data; u

(g)

it-twaqqif ta’ Kunsill ta’ Governanza fuq Data.

(3) Dawn ir-regolamenti għandhom jidħlu fis-seħħ f’dik id-

data jew dati kif il-Ministru responsabbli għall-informazzjoni tas-

settur pubbliku jista’ permezz ta’ Avviż fil-Gazzetta, jistabbilixxi, u

dati differenti jistgħu jiġu hekk stabbiliti għal għanijiet differenti jew

dispożizzjonijiet differenti ta’ dawn ir-regolamenti.

In these regulations, unless the context otherwise requires

Interpretation.

"Act" means the Re-Use of Public Sector Information Act;

"Administrative Register" means an official register which is

designed to hold records of an administrative nature mainly dealing

with the organisational structures of the public administration;

"Agency" means the Malta Information Technology Agency;

"application program interface" or "API" is a set of automated

functions and protocols that enable machine-to-machine

communications for the exchange and consumption of data in a

dynamic environment. Such APIs shall follow a registration process

prior to be authorised and included in the national data portal;

"controller" has the same meaning as in Article 4 of the General

Data Protection Regulation;

"data discovery service" means the aggregation of metadata

from various sources within the public administration into a single

centralised repository to enable a comprehensive web-based search

for official registers and datasets including also the pertinent legal

basis and the data owner of each official register; it includes also the

visualisation of the information provided from such searches;

"data owner" means the person or entity responsible for the

processing, security, quality and access permissions of an official

register; when identifiable information relating to a person is

processed, the obligations of a data controller in terms of the General

Data Protection Regulation shall apply;

"dataset" means an aggregation or filtering of selected data

elements from one or more official registers into an identified and

persistent list of records which can be used by other automated

information services;

"Data Governance Register" means an official register which is

intended to maintain records holding information relating to the

technical and other details describing information assets and the

automated systems used by the public administration;

"General Data Protection Regulation" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the

processing of personal data and on the free movement of such data,

and repealing Directive 95/46/EC (General Data Protection

Regulation);

"information system" means a defined set of automated

processes and user interfaces designed to collect, store and

disseminate data for the purpose of providing useful information;

"national data portal" or "Malta Data Portal" or "national open

data portal" means the web-based system and data repository which

shall enable the management and publishing directly by the data

owners of the data sharing permissions and the controlled lists and

vocabularies as reference data, including also the functionality for the

discovery of all official registers and the consumption of open data;

"official record" means an identifiable and distinct entry in an

official register having the necessary qualities to be admissible as

evidence in a court of law;

"official register" means a collection of official records

mandated by Maltese legislation, which is included in the Register of

Registers;

"open data" means information normally of a public domain

nature published by the responsible public sector body in a machine-

readable and non-proprietary format, provided under a licence that

permits re-use and not being subject to fees unless such fees are

limited to the cost of the provisioning of the data and to be accessed

without the need for any form of registration or identification;

"personal data" has the same meaning as in Article 4 of the

General Data Protection Regulation;

"public employee" shall have the same meaning as that provided

in article 2(1) of the Public Administration Act;

"public sector body" shall have the same meaning as assigned to

it by article 2 of the Act;

"reference data" means the lists of controlled vocabularies and

descriptions which are managed by the data owner of the specific

official register in order to provide additional meaning and

classification information to the records held in such registers;

"Register of Registers" shall mean the Register of Registers

established by Part V;

"uniform resource identifier" or "URI" is a web-compliant

format for the allocation of a machine-readable persistent identifier

for every entry in an official register, including the different

identifiers assigned to the different versions of each record; and

"user" shall mean public employees and, or data subjects having

access to an official register.

Part II - Sharing of Data between Public Sector Bodies

The sharing of data between public sector bodies shall be Sharing of data

between public

allowed by the Regulator for the following reasons

sector bodies.

(a)

to facilitate the re-use and exchange of information

between public entities in order to eliminate, wherever possible,

the need for an undertaking to provide the same information to

more than one public sector body;

(b)

to assist in the carrying out of a function of one or

more of the public sector bodies concerned by -

(i) reducing the duplication of tasks carried out

by one or more public sector bodies;

(ii) increasing the efficiency of a public sector

body in carrying out that function;

(iii) facilitating an improvement in the quality of

services being delivered; and, or

(iv) reducing service delivery time-frames to

clients;

(c)

to assist a public sector body in verifying the

identity of an undertaking being regulated or receiving a service

being delivered by the public entity;

(d)

to assist in the identification or correction of any

erroneous information held by one or more of the public entities

(e)

to facilitate an analysis of the structure, functions,

resources and service delivery methods of a public entity; and

(f)

to assist in the drafting of strategies and the

proposal of policies to Government or to implement

Government policies and strategies.

Part III - Establishment, Functions and Conduct of

Affairs of the Authority

In the exercise of his functions under article 25(b) of the

Act, the Minister is hereby appointing the Information and Data

Protection Commissioner as the regulatory authority which shall be

responsible for the monitoring of the implementation of the

provisions of the Act.

In the exercise of its functions under these regulations, the

regulatory authority shall act independently and shall not be subject

to the direction or control of any other person or authority.

It shall be the duty of the regulatory authority to promote

the observance of the requirements of these regulations.

The regulatory authority shall receive reports and claims

from any person or associations representing them on violations of

these regulations, to take such remedial action as it may deem

necessary or as may be prescribed under the Act, and to inform such

person or associations of the outcome of its decision.

(1)

In the exercise of the investigative powers the

regulatory authority may request the assistance of the Executive

Police in order to enter and search any premises.

(2) The regulatory authority shall be entitled to obtain on

request access to any system, metadata and any documentation or

copy thereof required in the course of exercising its duties.

(3) Without prejudice to any other provision of any other law,

any person who does not comply with any lawful request relevant to

an investigation by the regulatory authority shall be guilty of an

offence against this regulation.

(1)

Any applicant may apply to the regulatory

authority for a decision with regard to any request specified

hereunder where

(a)

a request for information made by the applicant to a

public sector body has been refused or has not been dealt with in

accordance with the requirements of the Act; or

(b)

a public sector body is not in compliance with the

requirements set out in these regulations.

(2) On receiving an application for a decision under this

regulation, the regulatory authority shall take a decision unless it

appears to it -

(a)

that the applicant has not exhausted any complaints

procedure which may be provided by the public sector body;

(b)

that there has been undue delay in making the

application;

(c)

that the application is frivolous or vexatious; or

(d)

that the application has been withdrawn or

abandoned.

(3) Where the regulatory authority has received an application

under this regulation, it shall either -

(a)

notify the applicant that it has not taken any

decision under this regulation as a result of the application and

of its grounds for not doing so; or

(b)

serve notice of its decision on the applicant and on

the public sector body.

(4) A decision notice shall contain particulars of the right of

appeal.

(5) Where a decision notice requires steps to be taken by the

public sector body within a specified period, the time specified in the

notice shall not expire before the end of the period within which an

appeal can be brought against the notice and, if such an appeal is

brought, no step which is affected by the appeal need be taken

pending the determination or withdrawal of the appeal.

(1)

If the regulatory authority has received an Information

application for a decision or reasonably requires any information for notices.

the purpose of determining whether a public sector body has

complied or is complying with any of the requirements of these

regulations, it may serve the public sector body with an information

notice requiring it, within such time as is specified in the notice, to

furnish the regulatory authority, in such a manner as may be so

specified, with such information as is so specified relating to the

application.

(2) An information notice shall specify the purpose for which

the regulatory authority requires the information and, where it refers

to information recorded in a document, shall include such details as

are reasonably necessary to enable a responsible officer of the public

sector body to identify that document.

(3) A public sector body shall not be required by virtue of this

regulation to make available to the regulatory authority any

information in respect of

(a)

any communication between a professional legal

adviser and his client in connection with the giving of legal

advice to the client with respect to his obligations, liabilities or

rights under this regulation; or

(b)

any communication between a professional legal

adviser and his client, or between such an adviser or his client

and any other person, made in connection with or in

contemplation of proceedings under or arising out of this

regulation (including proceedings before the Tribunal) and for

the purposes of such proceedings.

(4) In sub-regulation (3) references to the client of a

professional legal adviser include references to any person

representing such a client.

(5) The regulatory authority may cancel an information notice

by written notice to the public sector body on which it was served.

(1)

If the regulatory authority is satisfied that a public

sector body has failed to comply with any of its obligations under

these regulations, the Commissioner may serve the authority with an

enforcement notice requiring the authority to take, within such a time

as may be specified in the notice, such steps as may be so specified

for complying with those obligations.

(2) An enforcement notice shall contain a statement of the

requirement or requirements of these regulations with which the

public sector body has, in the regulatory authority’s opinion, failed to

comply, and its reasons for reaching that conclusion.

(3) The regulatory authority may cancel an enforcement notice

by written notice to the public sector body on which it was served.

Where a public sector body or an officer of such public

sector body refuses or, without a good reason, fails to comply with -

(a)

so much of a decision notice as requires steps to be

taken;

(b)

an information notice; or

(c)

an enforcement notice,

the regulatory authority may levy an administrative fine against the

defaulting public sector body or officer thereof.

(1)

Where the regulatory authority imposes an Administrative

administrative fine, it shall by order in writing require the public fines.

sector body to pay such administrative fine, which shall be due to the

regulatory authority as a civil debt

Provided that such order shall be subject to the appeal

procedure.

(2) In the absence of an appeal, the decision of the regulatory

authority shall become final and shall constitute an executive title for

the purposes of Title VII of the Code of Organization and Civil Cap. 12.

Procedure as if the decision had been ordered by a judgement of a

court of civil jurisdiction.

(3) Where a notice imposing an administrative fine is served

on a public sector body and -

(a)

such public sector body fails to appeal within such

time as an appeal may be entered and fails to pay the fine so

imposed; or

(b)

such public sector body appeals within such time to

the Tribunal and the appeal is withdrawn or the Tribunal

confirms the fine in the amount fixed by the Commissioner or in

an amount reduced by it and no further appeal is filed with the

Court of Appeal, or if an appeal is filed with the Court of

Appeal and such Court either confirms the decision taken or

decides that a penalty is due in another amount, or the imposed

penalty is not paid within fifteen days from the date of the

decision or the withdrawal of the appeal, or the date when the

Tribunal or the Court of Appeal confirms or varies the penalty

as aforesaid,

the regulatory authority shall be entitled to take civil action to recover

the amount due.

(4) Such a fine shall not be less than two thousand five

hundred euro (€2,500) and shall not exceed ten thousand euro

(€10,000) for each violation, and or a daily fine not less than twenty-

five euro (€25) and not more than fifty euro (€50).

(5) Without prejudice to the preceding provisions of this

regulation, the regulatory authority may, after giving due regard to the

circumstances of the case, impose an administrative fine on any

public sector body that -

(a)

knowingly provides false information to the

regulatory authority when so requested by the regulatory

authority pursuant to its investigative powers; or

(b)

does not comply with any lawful request pursuant

to an investigation by the regulatory authority

Provided that such a fine shall not be less than two

thousand five hundred euro (€2,500) and shall not exceed ten

thousand euro (€10,000) for each violation.

(1)

Where the regulatory authority exercises its powers

pursuant to these regulations, its decision shall forthwith be served on

the public sector body and the person to whom the decision is

addressed, which decision shall be served either personally, by

registered post to the person’s last known business or private address,

or by electronic means that provide a reliable record of when service

took place.

(2) In the case of service by electronic means, the decision

shall be deemed to have been served upon each person to whom the

decision is addressed when the regulatory authority has received

(a)

an electronic receipt automatically generated by the

e-mail server when the communication is read;

(b)

a written confirmation by return electronic mail

from the person to whom the decision is addressed; or

(c)

a verbal confirmation from the person to whom the

decision is addressed that the electronic mail was received.

(3) If service is not effected within a week of issuing the

decision, because the person to whom the decision refers could not be

found or for any other reason attributable to the person to whom the

decision is addressed, the regulatory authority shall publish a notice

in the Gazette and in one or more daily newspapers, stating that a

decision has been taken in respect of the person to whom the decision

is addressed and inviting him to collect the decision from the

regulatory authority’s office. In any such case, service shall be

deemed to have been effected on the third day after the date of

publication of the last notice.

(1)

Where a decision notice has been served, the

applicant or the public sector body may appeal to the Tribunal against

the notice within twenty working days.

(2) If, on an appeal under this regulation, the Tribunal

considers that -

(a)

the notice against which the appeal is brought is

not in accordance with the law; or

(b)

to the extent that the notice involved an exercise of

discretion by the regulatory authority, it ought to have exercised

its discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as

could have been served by the regulatory authority; and in any other

case the Tribunal shall dismiss the appeal.

(3) Where the Tribunal substitutes a notice as aforesaid, the

regulatory authority shall take action to secure compliance as if that

notice had been issued by the regulatory authority.

Part IV - Implementation of the Act

(1)

In the exercise of his functions under article 25(c) Appointment

of the Act, the Minister is hereby appointing the Malta Information and

the

Technology Agency (MITA) as the implementing entity which shall implementing

entity.

be responsible for the implementation of the provisions of the Act.

(2) In the exercise of its functions, the implementing entity

shall be responsible for the implementation of the objectives of the

Act and, without prejudice to the generality of the foregoing, the

implementing entity shall -

(a)

serve as the main co-ordinator and first line of call

for any of the obligations arising from the Act

Provided that the implementing entity shall, at all

times, seek the instructions of, and execute any directions

received from, the data owner when observing its

responsibilities listed in this sub-regulation;

(b)

publish a standard and format for the management

of communications between the public administration and

natural persons and, or organisations; and

(c)

establish the national data portal through which the

data discovery and data consumption services, as may be

applicable and authorised by the data owner, shall be provided.

(3) The implementing entity shall provide the information

system platform for the Register of Registers as well as the

Administrative Registers and shall supervise and co-ordinate with the

data owners to ensure that the classification and other metadata as

provided for in these regulations are being maintained by the relevant

data owner.

(4) Any refused request for data or disagreement in regard to

the classifications or other decisions taken by the data owner, and

arising from within the public administration, shall in the first

instance be dealt with through an escalation procedure which refers

the relevant facts for the consideration of the Data Governance

Council as established and regulated by Part XI.

(5) Any other dispute concerning a refused request for data or

any challenge in regard to the details as published on the national data

portal shall follow the process as established in regulation 7.

In order to ensure adherence, by the implementing entity,

of its responsibilities set out in regulation 16(2), data owners shall be

responsible to

(a)

directly maintain and ensure that the classification

and other metadata as published on the national data portal

reflects the true information in respect of the specific register or

registers which fall within their legal responsibilities; and

(b)

provide to the implementing entity the required

software products and tools that shall be used to enable the

‘machine to machine’ communication of contents that may be

allowed to be shared or re-used on the basis of the

classifications assigned and published by the data owner on the

national data portal;

(c)

data owners shall be obliged to maintain and

publish on the national data portal a list of datasets and their

respective API’s. Each dataset thus published should also be

linked to an official register as previously included in the

Register of Registers; and

(d)

data owners shall be obliged to maintain on the

national data portal the relevant data governance details which

may be authorised by the Data Governance Council so that the

relevant data flows and data dependencies can be effectively

managed at the national level.

Part V - Register of Registers

(1)

The implementing entity shall publish a list of

official registers for the data catalogue of the national open data

portal known as the Register of Registers, which shall include therein

(a)

the name of the official register;

(b)

the law applicable to the official register;

(c)

the public sector body or function responsible for

the official register;

(d)

the relevant classification indicators as applicable

and according to the Classification Scheme authorised in the

First Schedule; and

(e)

the uniform resource identifier (‘URI’) to serve as

the persistent internal identifier of an official register.

(2) The implementing entity shall ensure transparency in its

processes relating to the Register of Registers by adhering to the rules

as applicable to any official register and as indicated in these

regulations.

Part VI - Data Classification Scheme

(1)

The implementing entity shall co-ordinate with the Data

identified data owner of each register so that such data owner shall Classification

Scheme.

use the values and criteria as published in the First Schedule in order

to add the applicable classification indicators to the information

maintained pertinent to the register. Such information shall also be

made available as part of the Open Data publications from the

national data portal.

Part VII - Uniform Resource Identifier

(1)

The implementing entity shall publish a standard URI structure

and format for the management of a persistent identifier to be applied and format.

to all official records.

(2) The Uniform Resource Identifier shall be composed of

three main parts, namely the indication that this is a record which has

its legal authority from the Laws of Malta, a second part which

identifies the official register and the third part which shall identify

the individual record or a particular version of the same record

according to the record version control mechanism described in

regulation 21.

(1)

The implementing entity shall publish a standard Record Version

and format for the management of a record version control Control

mechanism.

mechanism.

(2) Every official record shall provide the facility to identify

the different versions resulting either from the original insertion into

the register and for any other change of any one of the elements that

constitute such a record from the business perspective.

(3) Each record version shall have its own unique Uniform

Resource Identifier which will enable the identification of all changes

to a specific record with time stamps indicating the start and the end

of such a record version.

(4) The obligation to achieve this version control mechanism

rests with the respective data owners and is applicable for information

systems introduced after the coming into force of these regulations.

Part VIII – Metadata Standards

(1)

The implementing entity shall publish a standard

and format for the management of a metadata record, also referred to

as the record label, to be applied to all official records.

(2) The owner of an official register shall be obliged to follow

such standards which are aimed at enabling interoperability of

records and information required for an audit of such records and for

the provenance and the process from which records originate in view

of the retention periods that may be applicable on the basis of such

information.

Part IX - Reference Data Management

(1)

The implementing entity shall provide a repository

and the necessary maintenance, discovery and publishing facilities for

the reference data as applicable to all official registers included in the

Register of Registers.

(2) The owner of an official register shall be obliged to use

such facilities to maintain and publish the reference data pertinent to

the specific register.

Part X - Administrative Registers

(1)

The implementing entity shall provide a repository

and the necessary maintenance, discovery and publishing facilities for

the administrative data as applicable to all official registers included

in the Register of Registers and which are classified as administrative

or data governance registers.

(2) Such registers shall follow the normal rules as applicable

to other official registers.

(3) Public administration systems and processes shall be

obliged to use the official records from the administrative registers

when such records are published and accessible through API’s from

the national data portal or other authorised portals as applicable. Such

data can be copied and stored as part of the local data repositories for

continuity and operational reasons provided it is not updated or in any

way maintained or changed at the line-of-business level.

Part XI - Data Governance Council

(1)

There shall be established a Data Governance Data

Council, hereinafter referred to as "the Council", which shall have the Governance

Council.

functions referred to in the following provisions of this regulation.

(2) The Council shall serve as the focal point for co-ordination

and mediation, as may be required, in relation to the management of

official registers and official records within the public administration

functions.

(3) The Council shall be the main consultative and advisory

body in respect of all matters relating to the governance of official

registers and high-level discussions, mediation and the formulation of

policy, direction and decisions relating to corporate and enterprise

(horizontally applicable) data within the public administration.

(4) The Council shall be involved in the discussions between

data owners and any third party requesting access to specific registers

or datasets before such requests are submitted for the consideration of

the regulatory authority. The proposals or decisions of the Council

shall be without prejudice to, and subject to, decisions of the

regulatory authority.

(5) The Council shall be composed of a chairperson and

members having the required credentials and academic background

necessary for an informed discussion on the subject of data

management in the context of the public administration processes and

requirements as appointed for a term of three (3) years by the

Principal Permanent Secretary.

(6) The core members of the Council shall be selected from

the main functions of the public administration which have the most

impact on the implementation of the information systems and the

related national strategies as may be applicable at the time. The

number of core members forming part of the Council shall not exceed

ten (10) persons.

(7) The Council may also invite and involve other experts and

subject-matter specialists as may be required from time to time and

according to the issues and subjects then being dealt with at the time.

(8) The Council shall, after due consideration and appraisal of

the information supplied, refer the disputed requests received,

conclusions and proposals agreed within the Council to the Principal

Permanent Secretary for authorisation or any other direction as may

be applicable.

First Schedule

Data Classification Scheme

The list of classification headings and the relevant options

applicable to each such heading is available from the following link

https://open.data.gov.mt/search_all.html?id=52898&key=Subordinates

Second Schedule

Register of Registers

The list of Registers included in the Register of Registers is

available from the following link

https://open.data.gov.mt/search_all.html?id=52900&key=Subordinates

Third Schedule

Metadata record structure

The list of the elements that make up the minimum metadata

details for official registers and datasets is available from the

following link

https://open.data.gov.mt/search_all.html?id=52901&key=Subordinates

Fourth Schedule

Administrative Registers

The list of Registers under the Administrative Registers

classification is available from the following link

https://open.data.gov.mt/search_all.html?id=52902&key=Subordinates

Fifth Schedule

Data Governance Registers

The list of Registers under the Data Governance Registers

classification is available from the following link

https://open.data.gov.mt/search_all.html?id=52903&key=Subordinates

€1.53