Vaccination against COVID-19 Certificate Order, 2021

L.N. 203 of 2021

PUBLIC HEALTH ACT

(CAP. 465)

Vaccination against COVID-19 Certificate Order, 2021

IN EXERCISE of the powers conferred by article 27 of the

Public Health Act, the Superintendent of Public Health, after

consultation with the Information and Data Protection Commissioner,

has made the following order:-

(1) The title of this order is the Vaccination against Citation and

scope.

COVID-19 Certificate Order, 2021.

(2) The scope of this order is to set out the legal basis for the

processing of personal data by the Superintendent of Public Health

during the COVID-19 pandemic when

(a) an interoperable certificate on vaccination is issued

for persons who have been vaccinated in Malta and who require

such vaccination certificate to travel to a third country; and

(b) verifying and accepting recognised interoperable

certificates on vaccination issued by competent authorities in a

third country for persons arriving in Malta from such third

country.

(3) The provisions of this order shall be read in conformity

with and shall be without prejudice to the provisions of the Data Cap. 586.

Protection Act and the provisions of Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal

data and on the free movement of such data, and repealing Directive

95/46/EC.

Data to be included in the vaccination certificate

(a)

name: surname(s) and forename(s), in that order;

(b)

date of birth;

(c)

disease or agent targeted;

(d)

vaccine/prophylaxis;

(e)

vaccine medicinal product;

(f) vaccine

marketing

authorization

holder

or

manufacturer;

(g)

number in a series of vaccinations/doses;

(h) date of vaccination, indicating the date of the latest

dose received;

(i)

country of vaccination;

(j)

certificate issuer;

(k)

a unique certificate identifier;

(l) passport number or other identification document

number of the person.

€0.36

In this order, unless the context otherwise requires

Interpretation.

"fully vaccinated person" means a person who has received all

applicable doses of an approved vaccine medicinal product according

to instructions published by its manufacturer, which vaccine shall

become effective fourteen (14) days after the last dose has been

received;

"General Data Protection Regulation" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the processing

of personal data and on the free movement of such data, and repealing

Directive 95/46/EC;

"interoperability" or "interoperable" means that a vaccination

certificate and a recognised vaccination certificate are able of being

verified in Malta and in the third country party to a bilateral agreement

in terms of article 4;

"recognised vaccination certificate" means an interoperable

certificate recording that a person has been fully vaccinated and which

certificate is issued in a third country which has a bilateral agreement

with Malta;

"third country" means any country outside the European

Economic Area;

"trust framework" means the rules, policies, specifications,

protocols, data formats and digital infrastructure regulating and

allowing for the reliable and secure issuance and verification of

certificates to guarantee the certificates’ trustworthiness by confirming

their authenticity, validity and integrity;

"unique certificate identifier" means a set of numbers and letters

given to each vaccination certificate issued in accordance with this

order and which shall be specific to each certificate;

"vaccination certificate" means an interoperable certificate

generated in Malta upon the request of a person which includes the

information listed in the Schedule;

"vaccine" means an immunological medicinal product to prevent

COVID-19.

(1) For the purposes of this order, the Superintendent of

Public Health shall be the health authority competent to issue a

vaccination certificate in Malta and shall be considered as the

controller for the purposes of the General Data Protection Regulation.

(2) A person who has been vaccinated in Malta may request the

Superintendent of Public Health to issue a vaccination certificate

Provided that a vaccination certificate shall only be issued

to a fully vaccinated person who requires such a certificate to enter a

third country.

(3) A vaccination certificate shall be made available to the

person in digital or paper-based format.

(4) A vaccination certificate shall only be valid for a period of

six (6) months.

(5) The holder of a vaccination certificate shall be entitled to

request the issuance of a new vaccination certificate if the personal

data contained in the certificate is no longer accurate or up to date, or

the certificate is either no longer available to the holder or otherwise

no longer valid.

(6) For statistics, research and audit purposes, the

Superintendent of Public Health may retain a record containing the

unique certificate identifier as reference of a vaccination certificate

and without including any identifiable details in relation to the holder.

(1) The Government of Malta, after consultation with the Bilateral

Superintendent of Public Health may enter into a bilateral agreement agreement.

with a third country with the scope of mutually recognising

vaccination certificates issued by Malta and such third country

Provided that any bilateral agreement shall be drawn up in

line with the requirements of the General Data Protection Regulation

and any international obligations in place.

(2) The Superintendent of Public Health shall publish a notice

in the Gazette listing the third countries that are party to any bilateral

agreement pursuant to sub-article (1).

(1) The processing of data pursuant to article 3, shall be Legal basis.

necessary for reasons of public interest in the area of public health and

based on articles 6(1)(e) and 9(2)(i) of the General Data Protection

Regulation.

(2) No personal data in relation to vaccination certificates and

recognized vaccination certificates shall be further processed by the

controller for a purpose that goes beyond the scope of these

regulations.

(1) Appropriate technical means based on a trust Trust

framework shall be used for the issuance and verification of vaccine framework.

certificates and recognized vaccine certificates, providing for the

interoperability, integrity and authenticity of such certificates.

(2) The technical means and the trust framework pursuant to sub-

article (1), may be defined in the bilateral agreement signed with the

third country, including data protection by design and default.

(3) The trust framework shall provide for appropriate technical

and organisational measures to ensure adequate security to safeguard

the confidentiality, integrity, availability and resilience of personal

data being processed for the purpose of these regulations.

(4) When a vaccine certificate is issued and verified, the only

data that may be requested shall be that data which is necessary to

avoid the use of forged vaccination certificates and to confirm its

authenticity.