Data Governance Regulations, 2024

Suppliment tal-Gazzetta tal-Gvern ta’ Malta Nru. 21,299, 9 ta’ Awwissu, 2024

L.N. 191 of 2024

MALTA DIGITAL INNOVATION AUTHORITY ACT

(CAP. 591)

Data Governance Regulations, 2024

IN EXERCISE of the powers conferred by article 58(2)(a), (b),

(d), (e), (g), (i) and (u) of the Malta Digital Innovation Authority Act,

the Minister responsible for digital economy, acting on the advice of

the Malta Digital Innovation Authority, has made the following

regulations:-

(1) The title of these regulations is the Data Governance Citation and

scope.

Regulations, 2024.

(2) These regulations implement the requirements of

Regulation (EU) 2022/868 of the European Parliament and of the

Council of 30 May 2022 on European data governance and amending

Regulation (EU) 2018/1724 (Data Governance Act).

(1)

In these regulations, unless the context otherwise Interpretation.

requires

"Act" means the Malta Digital Innovation Authority Act;

"Data Governance Council" means the Data Governance

Council established by virtue of regulation 25 of the

Organisational Structures for Data Sharing and Re-Use S.L.546.01.

Regulations;

"Malta Digital Innovation Authority" means the Malta

Digital Innovation Authority established by virtue of article 5 of

the Malta Digital Innovation Authority Act;

"Regulation (EU) 2022/868" means Regulation (EU) 2022/

868 of the European Parliament and of the Council of 30 May

2022 on European data governance and amending Regulation

(EU) 2018/1724 (Data Governance Act).

(2) Any words and expressions which are not defined in these

regulations shall have the same meaning as assigned to them in

Regulation (EU) 2022/868

Provided that unless the context otherwise requires, words

and phrases used in these regulations, which are not defined in

Regulation (EU) 2022/868 and which are not herein defined, shall

have the same meaning as that assigned to them in the Act.

The Data Governance Council shall be the national

competent body designated for the purpose of carrying out the tasks

referred to in Article 7 of Regulation (EU) 2022/868

Provided that where any other competent body is

designated under national law to carry out tasks referred to in Article 7

of Regulation (EU) 2022/868 in relation to a particular sector, such

other competent body shall be deemed to be the competent body

designated for the purpose of carrying out the tasks referred to in

Article 7 of Regulation (EU) 2022/868 in relation to that particular

sector.

(1) An appeal shall lie to the Administrative Review

Tribunal established in the Administrative Justice Act from any

decision taken by a competent public sector body in relation to

requests for the re-use of the categories of data referred to in Article

3(1) of Regulation (EU) 2022/868.

(2) The provisions of the Administrative Justice Act, in so far

as they apply to the Administrative Review Tribunal, shall apply to

any proceedings before the said Tribunal.

(3)

For the purposes of these regulations

(a) the definition "public administration" in the

Administrative Justice Act shall be construed as a reference to

such competent public sector bodies which grant or refuse access

for the re-use of the categories of data referred to in Article 3(1)

of Regulation 2022/868;

(b) the word "decision" shall have the same meaning

attributed to it in the definition "administrative act" in the

Administrative Justice Act.

(4) There shall be a right of appeal from decisions of the

Tribunal to the Court of Appeal in accordance with the provisions of

Part IV of the Administrative Justice Act.

For the purposes of Article 8 of Regulation (EU) 2022/868,

the Data Governance Council shall be the body designated as the

single information point.

(1) For the purposes of Regulation (EU) 2022/868, the Designation of

Malta Digital Innovation Authority shall be the national authority national

competent

designated as the competent authority for data intermediation services authority

intermediation

and for the registration of data altruism organisations and to this end, services and data

altruism

shall have all the powers stipulated by Regulation (EU) 2022/868.

organisations.

(2) Without prejudice to the provisions of the Act, for the

purpose of monitoring compliance of data intermediation services

providers and recognised data altruism organisations with the

requirements of Regulation (EU) 2022/868, the Malta Digital

Innovation Authority shall have all the powers referred to in Article 14

and 24 of Regulation (EU) 2022/868 respectively.

Natural and legal persons may file a complaint in relation Right to file a

to any matter falling within the scope of Regulation (EU) 2022/868 complaint.

individually or, where relevant collectively, with the Malta Digital

Innovation Authority against a data intermediation services provider or

against a recognised data altruism organisation.

The provisions of Part IX of the Act shall apply to

Right to an

effective

judicial remedy.

(a) legally binding decisions referred to in Article 14 of

Regulation (EU) 2022/868 in the management, control and

enforcement of the notification regime for data intermediation

services providers;

(b) legally binding decisions referred to in Articles 19

and 24 of Regulation (EU) 2022/868 for the registration of data

altruism organisations in the monitoring of recognised data

altruism organisations; and

(c) a failure of the Malta Digital Innovation Authority to

act on a complaint filed with it in accordance with regulation 7 of

these regulations.

(1) Articles 42, 43, 44 and Part IX of the Act shall apply Infringements.

to infringements of the obligations regarding transfers of non-personal

data to third countries pursuant to Article 5(14) and Article 31 of

Regulation (EU) 2022/868, the notification obligation of data

intermediation services providers pursuant to Article 11 of Regulation

(EU) 2022/868, the conditions for providing data intermediation

services pursuant to Article 12 of Regulation (EU) 2022/868 and the

conditions for the registration as a recognised data altruism

organisation pursuant to Articles 18, 20, 21 and 22 of Regulation (EU)

2022/868

(2) Without prejudice to the provisions of the Act, due regard

shall be made to the following non-exhaustive and indicative criteria

for the imposition of administrative penalties on data intermediation

services providers and recognised data altruism organisations for

infringements of the obligations referred to in this regulation, where

appropriate

(a) the nature, gravity, scale and duration of the

infringement;

(b) any action taken by the data intermediation services

provider or recognised data altruism organisation to mitigate or

remedy the damage caused by the infringement;

(c) any previous infringements by the data

intermediation services provider or recognised data altruism

organisation;

(d) the financial benefits gained or losses avoided by the

data intermediation services provider or recognised data altruism

organisation due to the infringement, insofar as such benefits or

losses can be reliably established;

(e) any other aggravating or mitigating factors applicable

to the circumstances of the case.

(3) The Malta Digital Innovation Authority may, at its

discretion, prior to initiating any proceedings in relation to an

infringement of the obligations regarding transfers of non-personal

data to third countries pursuant to Article 5(14) of Regulation (EU)

2022/868 consult with the Data Governance Council and, or any other

relevant person.

In the Second Schedule to the Administrative Justice Act,

immediately after the item "Conservation of Wilds Birds Regulations"

there shall be added the following new items

"Cybersecurity Certification Regulations L.N. 133 of 2024

Inferior Competence

Data Governance Regulations L.N. 191 of 2024 Inferior

Competence

Innovative Technology Arrangements and Services (ITAS)

Certification Regulations L.N. 132 of 2024 Inferior

Competence".

€0.18