Organisation Regulations, 2023

L.N. 204 of 2023

DATA PROTECTION ACT

(CAP. 586)

Enforcement of the Rights of Data Subjects in relation to

Transfers of Personal Data to a Third Country or an International

Organisation Regulations, 2023

IN EXERCISE of the powers conferred by article 33(i) of the

Data Protection Act, the Minister responsible for data protection, after

consultation with the Information and Data Protection Commissioner,

has made the following regulations:-

(1) The title of these regulations is the Enforcement of Citation and

Rights of the Data Subjects in relation to Transfers of Personal Data to scope.

a Third Country or an International Organisation Regulations, 2023.

(2) These regulations implement the Council Implementing

Decision (EU) 2021/914 of 4 June 2021 on standard contractual

clauses for the transfer of personal data to third countries pursuant to

Regulation (EU) 2016/679 of the European Parliament and of the

Council.

(3) The scope of these regulations is to establish rights in

Maltese law for third party beneficiaries with respect to transfers of

personal data to a third country or an international organisation.

In these regulations, unless the context otherwise requires

Interpretation.

"Act" means the Data Protection Act;

"identifiable natural person" means a person who can be

identified, directly or indirectly, in particular by reference to an

identifier such as a name, an identification number, location data,

an online identifier or to one or more factors specific to the

physical, physiological, genetic, mental, economic, cultural or

social identity of that natural person;

"Minister" means the Minister responsible for data

protection;

"Regulation" means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and

repealing Directive

95/46/EC

(General

Data

Protection

Regulation);

"personal data" means any information relating to an

identified or identifiable natural person and the said person is

known as "data subject".

Without prejudice to any other remedy available to the data

subject pursuant to the Act and the Regulation, a data subject whose

personal data is transferred by a controller or a processor to a third

country or to an international organisation pursuant to Article 46 of the

Regulation shall be entitled to enforce third party beneficiary rights

conferred on data subjects by the instrument concerned, or by any

clauses or rules expressed to be for the benefit of data subjects in the

said instrument.

(1) The relevant instruments for providing appropriate

safeguards pursuant to Article 46 of the Regulation and that shall

entitle the data subject to third party beneficiary rights, are

(a) standard data protection clauses adopted by the

European Commission in accordance with the examination

procedure referred to in Article 93(2) of the Regulation; or

(b) any other instrument granting third party beneficiary

rights to the data subjects which is recognised under Chapter V

of the Regulation as an appropriate safeguard utilised to regulate

the international transfer of personal data.

(2) Any action by the data subject to enforce rights granted to

him and any clauses expressed to be for the benefit of the data subject

shall be deemed to give rise to an action founded on contract.

€0.18