The Digital Services (Designation and Enforcement) Order, 2024

L.N. 66 of 2024

MALTA COMMUNICATIONS AUTHORITY ACT

(CAP. 418)

The Digital Services (Designation and Enforcement) Order, 2024

IN EXERCISE of the powers conferred by articles 37(1) and

46(2) of the Malta Communications Authority Act, the Minister

responsible for communications after consultation with the Malta

Communications Authority, has made the following order:-

(1) The title of this order is the Digital Services Citation and

scope.

(Designation and Enforcement) Order, 2024.

(2) This order implements various measures consequential to

Regulation (EU) 2022/2065 of the European Parliament and of the

Council of 19 October 2022 on a Single Market for Digital Services

and amending Directive 2000/31/EC.

In this order, unless the context otherwise requires

Interpretation.

"the Authority" means the Malta Communications

Authority established in accordance with the Malta Cap. 418.

Communications Authority Act;

"Civil Court" means the Civil Court (Commercial Section)

established by article 3 of the Civil Courts (Establishment of S.L. 12.19.

Sections) Order;

"competent authority" means a competent authority, other

than the Malta Communications Authority, designated under

article 3 of this order;

"Digital Services Act" means Regulation (EU) 2022/2065

of the European Parliament and of the Council of 19 October

2022 on a Single Market for Digital Services and amending

Directive 2000/31/EC.

In accordance with the provisions of Article 49(1) and (2) Designation of

of the Digital Services Act, the Authority is designated as the Digital the

Services

Services Coordinator for Malta

Coordinator and

other competent

authorities for

Provided that the provisions applicable to the Digital the

the Digital

Service Coordinator set out in Articles 50, 51 and 56 of the Digital Services Act.

Services Act shall also apply to any competent authority which may be

designated in accordance with this article when executing any

provisions of the Digital Services Act which such competent authority

is empowered to enforce.

The Authority when carrying out its tasks as the Digital

Services Coordinator in Malta and a competent authority in relation to

its tasks under article 3 shall

(a) act in an impartial, transparent and timely manner,

and shall have all the necessary resources to carry out such tasks,

including sufficient technical, financial and human resources to

adequately supervise all providers of intermediary services

falling within their competence;

(b) have sufficient autonomy in managing their budget

within the overall limits of the budget in order not to adversely

affect their independence when acting for the purposes of their

tasks under the Digital Services Act; and

(c) act with complete independence and be free from any

external influence, whether direct or indirect, and shall neither

seek nor take instructions from any other public authority or any

private party.

(1) A judicial or administrative authority that issues an

order to take action against illegal content to a provider of

intermediary services, shall, when issuing any such order, ensure that

the order issued by it complies with the conditions listed in Article

9(2) of the Digital Services Act. If the order does not comply with one

(1) or more of these conditions, that order shall be considered as null

and void for the purposes of the Digital Services Act.

(2) Without prejudice to Article 9(3) of the Digital Services

Act, the judicial or administrative authority issuing any order or, where

applicable, the authority specified therein, in accordance with sub-

article (1) shall, when doing so, transmit forthwith to the Authority a

copy of the order, along with any information received from the

provider of intermediary services concerning the effect given to that

order.

(3) The judicial or administrative authority issuing an order to

take action against illegal content to a provider of intermediary

services in accordance with Article 9 of the Digital Services Act shall,

where necessary, take any such enforcement measures as it may

consider appropriate to ensure compliance with any such order.

(4) Any person applying to a court for an order requiring a

provider of an intermediary service to take action against illegal

content transmitted on the service provided by that provider, shall

provide the court, in addition to any other information that the court

may reasonably require further to any such application, with the

following information

(a) the electronic point of contact that the provider of the

intermediary service has designated pursuant to Article 11(1) of

the Digital Services Act;

(b) all the information listed in Article 9(2)(a)(i) to (v) of

the Digital Services Act; and

(c) where the person is seeking a territorial scope beyond

Malta, a description of the territorial scope sought, and any

additional information required by the court to enable it to ensure

that the scope is limited to what it considers to be strictly

necessary.

(1) A judicial or administrative authority that issues an Orders to

order to a provider of intermediary services for it to be provided provide

information

specific information about one (1) or more individual recipients of the issued

Article 10 of the

service shall, in issuing any such order, ensure that the order issued by Digital Services

it complies with the conditions listed in Article 10(2) of the Digital Act.

Services Act. If the order does not comply with one (1) or more of

these conditions, the order shall be considered as null and void for the

purposes of the Digital Services Act.

(2) Without prejudice to Article 10(3) of the Digital Services

Act, the judicial or administrative authority issuing any order or, where

applicable, the authority specified in that order, in accordance with

sub-article (1) shall, when doing so, transmit forthwith to the

Authority a copy of the order, along with any information received

from the provider of intermediary services concerning the effect given

to that order.

(3) The judicial or administrative authority issuing an order to

provide information to a provider of intermediary services in

accordance with Article 10 of the Digital Services Act shall, where

necessary, take such enforcement measures as it may consider

appropriate to ensure compliance with any such order.

(4) Any person applying to a court for the issuance of an order

addressed to a provider of an intermediary service to provide

information about one (1) or more recipients of an intermediary

service provided by that provider, shall furnish the court, in addition to

any other information that the court may reasonably require further to

any such application, with the following information

(a) the electronic point of contact that the provider of the

intermediary service has designated pursuant to Article 11(1) of

the Digital Services Act;

(b) all the information listed in Article 10(2)(a)(i) to (v)

of the Digital Services Act; and

(c) an assessment that the information required is

information that the provider of the intermediary service has

already collected for the purpose of providing its service and is

within the control of that provider.

Any order issued in accordance with this order shall in all

instances as a minimum be notified to the electronic point of contact

designated by the provider of the intermediary service pursuant to

Article 11(1) of the Digital Services Act, and to the Authority.

Providers of intermediary services in Malta whose service

hosting services.

includes or consists of the storage of information by recipients of the

services as referred to in Article 6 of the Digital Services Act, shall

notify the Authority in writing about their provision of such service as

follows

(a) in the case of those providers who already provide

such service on the 17th February 2024, within seven (7) days of

such date; and

(b) in the case of those providers who commence the

provision of such service subsequent to the 17th February 2024,

within seven (7) days from the commencement of such service.

(1) Unless stated otherwise in this order, the Authority

shall, in accordance with its powers at law, be responsible for the

enforcement of the provisions of the Digital Services Act in so far as

such enforcement relates to its role as the Digital Services Coordinator

for Malta

Provided that the exercise of any such powers by the

Authority shall be without prejudice to the exercise of any regulatory

powers as may from time to time be assigned to any other competent

authority in accordance with this order

Provided further that unless otherwise stated expressly in

this order the assignment of the exercise of any regulatory powers to

another competent authority shall be construed as conferring upon that

competent authority the exclusive remit to enforce any such provisions

of the Digital Services Act as may be assigned to it.

(2) Unless expressly provided for at law, the Authority shall

not for the purposes of the Digital Services Act, be responsible for the

taking of any enforcement measures relating to alleged illegal content,

however so described, that may be carried online if not strictly in

relation to its role as Digital Service Coordinator.

(3) The Authority may consult with any other public body,

however so described, in Malta as it may consider necessary in the

exercise of its regulatory tasks under this order, which other public

body shall provide its input as required in writing within such

reasonable period as the Authority may request considering the

specific circumstances relating to any such consultation.

A competent authority shall take such measures in Enforcement of

accordance with its powers at law as it may consider necessary to the

Services Act by

ensure compliance with the provisions of the Digital Services Act competent

authorities

which it is empowered to enforce

designated by

this order.

Provided that when doing so the competent authority

concerned shall, in writing within two (2) working days, inform the

Authority of any measures that may have been taken by it to ensure

compliance therewith.

(1) Without prejudice to its powers under the Malta Investigative

Communications Authority Act, the Authority in the performance of powers

Authority and

its tasks as the Digital Services Coordinator in accordance with the the

authorities in

Digital Services Act in relation to the provisions of the Act that it relation to the

Digital Services

enforces, shall

Act.

(a) require the providers of intermediary services, as well

as any other person acting for purposes related to their trade,

business, craft or profession that may reasonably be aware of

information relating to a suspected infringement including

organisations performing the audits referred to in Articles 37 and

75(2) of the Digital Services Act, to provide such information

without undue delay;

(b) carry out inspections of any premises that such

providers or such persons use for purposes related to their trade,

business, craft or profession, in order to examine, seize, take or

obtain copies of information relating to a suspected infringement

in any form, irrespective of the storage medium; and

(c) ask any member of the staff or representative of such

providers or such persons to give explanations in respect of any

information relating to a suspected infringement and to record

the answers with their consent by any technical means.

(2) A competent authority shall also have the powers of

investigation listed in sub-article (1) in ensuring compliance with the

provisions of the Digital Services Act which that authority enforces.

(1) The Authority in respect of providers of intermediary

services that fall under its competence, or a competent authority in

ensuring compliance with the provisions of the Digital Services Act

which it enforces, where the exercise of its powers at law to bring

about a cessation of any infringement by any such provider have been

exhausted, and the infringement has not been remedied or is

continuing and is causing serious harm which cannot be avoided

through the exercise of its other powers at law, then the Authority or

the competent authority concerned as the case may be, may in the first

instance require the management body of such provider, without undue

delay, to examine the situation, adopt and submit an action plan setting

out the necessary measures to terminate the infringement, ensure that

the provider takes those measures, and report to the Authority or the

competent authority concerned as the case may be, on the measures

taken.

(2) If the Authority or the competent authority, as the case may

be, considers that a provider of intermediary services has not

sufficiently complied with the requirements referred to in sub-article

(1), that the infringement has not been remedied or is continuing and is

causing serious harm, and that the infringement entails a criminal

offence involving a threat to the life or safety of persons, then the

Authority or the competent authority concerned as the case may, be

shall file an application to the Civil Court requesting the issue of an

order for the temporary restriction of access of recipients to the service

concerned by the infringement or, only where that is not technically

feasible, to the online interface of the provider of intermediary services

on which the infringement takes place.

(3) The Authority or the competent authority concerned as the

case may be shall, unless it is acting upon the request of the European

Commission referred to in Article 82 of the Digital Services Act, prior

to filing an application to the Civil Court for the issue of an order

under sub-article (2), invite interested parties to submit written

observations to the Authority or the competent authority concerned as

the case may be, within a period that shall not be less than two (2)

weeks, describing the measures that it intends to request and

identifying the intended addressee or addressees thereof.

(4) The provider of intermediary services, the intended

addressee or addressees and any other third party demonstrating a

legitimate interest shall be entitled to participate in the proceedings

before Civil Court initiated by the Authority or the competent

authority concerned as the case may be, in accordance with sub-article

(3).

(5) The Civil Court, on receipt of an application in accordance

with sub-article (3) shall order the notification of the application with

urgency onto the provider of intermediary services, the intended

addressee or addressees and any other party that has demonstrated to

the Authority or the competent authority concerned as the case may be,

that it has a legitimate interest to participate in any such proceedings.

Such persons shall be entitled to reply to the application within such

period as the Civil Court may determine, which period shall not

exceed ten (10) days or any lesser period as the Civil Court may deem

appropriate in the circumstances, which period shall commence as

from the date of notification onto such persons

Provided that the Civil Court shall consider and determine

any such application with urgency

Provided further that without prejudice to this sub-article, Cap. 12.

the provisions of the Code of Organization and Civil Procedure for the

hearing and determination of cases and of any appeal therefrom shall

apply to any such action.

(6) Any measure ordered in accordance with this article shall

be proportionate to the nature, gravity, recurrence and duration of the

infringement, without unduly restricting access to lawful information

by recipients of the service concerned.

(7) Where the Civil Court issues an order for a temporary

restriction of access, such restriction of access shall be for a period of

four (4) weeks, subject to the possibility that the Court in its order may

allow the Authority or the competent authority concerned as the case

may be, to extend that period for further periods of the same length,

subject to a maximum number of extensions as the Court may

determine.

(8) The Authority or the competent authority concerned as the

case may be shall only extend the period of four (4) weeks for a

temporary restriction of access in accordance with sub-article (7)

where, having regard to the rights and interests of all parties affected

by that restriction and all relevant circumstances, including any

information that the provider of intermediary services, the addressee or

addressees and any other third party that demonstrated a legitimate

interest may provide to it, it considers that the following conditions

have been met

(a) that the provider of intermediary services has failed

to take the necessary measures to terminate the infringement;

and

(b) that the temporary restriction does not unduly restrict

access to lawful information by recipients of the service, having

regard to the number of recipients affected and whether any

adequate and readily accessible alternatives exist

Provided that where the Authority or the competent

authority concerned, as the case may be, considers that the conditions

set out in paragraphs (a) and (b) have been met, but that it cannot

further extend the period pursuant this sub-article, it shall submit a

new request to the Civil Court as provided for in sub-article (2).

(9) The Authority or the competent authority concerned, as the

case may be, shall ensure that any measure taken in exercise of its

powers under this article shall be effective, dissuasive and

proportionate, having regard, in particular, to the nature, gravity,

recurrence and duration of the infringement or suspected infringement

to which those measures relate, as well as the economic, technical and

operational capacity of the provider of the intermediary services

concerned, where relevant.

Any administrative penalties that the Authority or a

competent authority, as the case may be, may decide to impose in

accordance with its powers at law for any infringement of any of the

provisions of the Digital Services Act which it enforces, shall not

exceed for each infringement

(a) six per cent (6%) of the annual worldwide turnover of

the provider of intermediary services concerned in the preceding

financial year

Provided that where the infringement relates to the

supply of incorrect, incomplete or misleading information,

failure to reply or rectify incorrect, incomplete or misleading

information and failure to submit to an inspection, the

administrative penalty that may be imposed shall not exceed one

per cent (1%) of the annual income or worldwide turnover of the

provider of intermediary services or person concerned in the

preceding financial year; and

(b) in the case of a periodic administrative penalty

payment, five per cent (5%) of the average daily worldwide

turnover or income of the provider of intermediary services

concerned in the preceding financial year per day, calculated

from the date specified in the decision concerned.

The Authority or any other competent authority may decide Procedures for

to establish procedures for the making and resolution of complaints complaints

relating to an

concerning an infringement of the Digital Services Act, which infringement

the Digital

procedures shall be in accordance with Article 53 of the Digital Services Act.

Services Act and shall, amongst other matters, provide

(a) for the form and procedures by which a complaint

may be made;

(b) for the procedures to be followed in considering a

complaint;

(c) for the procedures for determining whether the

complaint should be transmitted to another authority in Malta or

to a Digital Services Coordinator in another Member State of the

European Union, including procedures for such transmission;

(d) for the procedures to be followed on notification of a

complaint from a Digital Services Coordinator in another

Member State of the European Union; and

(e) for the procedures by which the complainant and the

provider of the intermediary service shall be informed of the

progress and outcome of the complaint.

Without prejudice to any of the provisions of the Digital Obligation to

Services Act or of this order, where a provider of an intermediary inform

competent

services becomes aware of any alleged illegal activity undertaken or public

of any alleged

information provided by a recipient of its service, that provider shall illegal activity.

immediately inform the competent public authority of any such

activity or information.

The Prime Minister by virtue of the powers conferred to Order extending

him in accordance with article 37(1) of the Malta Communications the

of the

Authority Act is hereby extending the jurisdiction of the Administrative

Review

Administrative Review Tribunal in relation to any contestation of any Tribunal to

decision, however so described, given by a competent authority decisions

by a competent

designated under article 3 of this order.

authority.

Immediately after item (v) of the Second Schedule to the Amendment to

Malta Communications Authority Act, there shall be added the the

Schedule to

following new item

"(vi) Regulation (EU) 2022/2065 of the European

Parliament and of the Council of 19 October 2022 on a Single

Market for Digital Services and amending Directive 2000/31/EC

(Digital Services Act).".

€0.90