Identity Malta Agency (Establishment) (Amendment) Order, 2025

L.N. 141 of 2025

PUBLIC ADMINISTRATION ACT

(CAP. 595)

Identity Malta Agency (Establishment) (Amendment) Order, 2025

IN EXERCISE of the powers conferred by article 26 of the

Public Administration Act, the Prime Minister has made the following

The title of this order is the Identity Malta Agency Citation.

(Establishment) (Amendment) Order, 2025 and this order shall be read

and construed as one with the Identity Malta Agency (Establishment) S.L. 595.07.

Order, hereinafter referred to as the "principal order".

Immediately after article 3 of the principal order there shall Adds new

be added the following new article

" Personal data

(1) In the performance of its functions and

other entities. duties, the Agency shall have the right to access and, or

request from any person, public authority, agency, body or

private entity, information including personal data

pertaining to any applicant or any third party, which is

limited to the extent necessary for the purposes of these

regulations or any other law which are applicable to the

functions and duties of the Agency, and to what is

necessary and proportionate to the objectives pursued by

the Agency.

(2) When making a request in accordance with

sub-article (1), the Agency shall provide the purpose for

such a request and the function being exercised by the

Agency.

(3) Any personal data processed by the Agency

shall fully comply with the provisions of Regulation (EU)

2016/679 of the European Parliament and of the Council

of 27 April 2016 on the protection of natural persons with

regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC

(General Data Protection Regulation) and the Data

Protection Act, including the regulations made thereunder

and the fundamental rights and freedoms of the data

subjects.

(4) Whilst taking into account the nature, scope,

context and reason for processing, as well as the risks of

varying likelihood and severity for the rights and

freedoms of the data subjects, the Agency shall

implement appropriate technical and organisational

measures in an effective manner in order to ensure a level

of security appropriate to the risk.

(5) The access to personal data shall be reserved

exclusively to duly designated officers on the basis of a

role-base access control mechanism and subject to

confidentiality and, or professional secrecy obligations, in

order to prevent abuse or unlawful access to, or disclosure

of personal data.

(6) For the purpose of ensuring and to be able to

demonstrate compliance with the principles relating to the

processing of personal data, the Agency shall implement

the appropriate data protection policies, which policies

shall be periodically reviewed and updated where

necessary.

(7) The data protection officer designated by the

Agency in accordance with Article 37 of Regulation

2016/679/EC of the European Parliament and of the

Council of 27 April 2016 on the protection of natural

persons with regard to the processing of personal data and

on the free movement of such data, and repealing

Directive 95/46/EC (General Data Protection Regulation)

shall be involved and duly consulted and in a timely

manner on all issues relating to the protection of personal

data processed for the purposes of these regulations or

any other laws which are applicable to the functions and

duties of the Agency.".

€0.18