National Identity Management System Regulations, 2025

L.N. 162 of 2025

IDENTITY CARD AND OTHER

IDENTITY DOCUMENTS ACT

(CAP. 258)

National Identity Management System Regulations, 2025

IN EXERCISE of the powers conferred by article 23 of the

Identity Card and other Identity Documents Act, the Prime Minister

has made the following regulations:-

(1) The title of these regulations is the National Identity Citation and

scope.

Management System Regulations, 2025.

(2) The scope of these regulations is to provide for the

establishment of the National Identity Management System which

shall contain electronic records of data related to the processing and

issuance of identity cards and residence documents.

In these regulations, unless the context otherwise requires

Interpretation.

"Act" means the Identity Card and other Identity Cap. 258.

Documents Act;

"Agency" means the Identity Malta Agency established by

article 3 of the Identity Malta (Establishment) Order;

"authorised officer" shall have the same meaning as

assigned to in the Act;

"biometric identifiers" means personal data resulting from

specific technical processing of the facial image and fingerprints

of a natural person that allows or confirms the unique

identification of the said natural person;

"controller" shall have the same meaning as assigned to

it in Article 4(7) of Regulation (EU) 2016/679;

"facial image" means an image captured by the authorised

officer during the registration phase;

"identification document" shall have the same meaning

as assigned to it in the Act;

"identity card" means a document issued in accordance

with Part A of the Act;

"identity document" shall have the same meaning as

assigned to it in the Act;

"NIDMS" means the National Identity Management

System;

"personal data" shall have the same meaning as assigned

to it in Article 4(1) of Regulation (EU) 2016/679;

"Regulation (EU) 2016/679" means Regulation (EU) 2016/

679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the

processing of personal data and on the free movement of such

data, and repealing Directive 95/46/EC (General Data Protection

Regulation);

"residence document" means a document issued in

accordance with Part B of the Act.

There shall be a centralised electronic identity database

known as NIDMS, which shall have the following functions

(a) electronically record personal data which is captured

during the registration phase;

(b) process an application and the issuance of an identity

document, excluding an identification document; and

(c) provide a secure source of identification of the holder

of the document referred in paragraph (b).

The Agency shall be responsible for the technical and

operational management of NIDMS as referred to in regulation 3.

(1)

These regulations shall not prejudice the

applicability of Regulation (EU) 2016/679 and of the Data Protection

Act, including the regulations made thereunder and the fundamental

rights and freedoms of the data subjects.

(2) The Agency acting in its capacity of a controller in

accordance with Article 4(7) of the Regulation (EU) 2016/679 shall

perform the relevant data processing operations which are limited to

the extent needed for the purposes of these regulations and to what is

necessary and proportionate to the objectives pursued by the Agency.

(3) For the purposes of these regulations, the processing of

personal data, including the processing of special categories of

personal data, shall fully comply with the principles relating to the

processing of personal data pursuant to Article 5 of Regulation (EU)

2016/679.

In addition to the data prescribed in Part A and Part B of the Data stored in

Act, there shall also be stored in NIDMS the biometric identifiers of NIDMS.

each person applying for an identity document excluding an

identification document

Provided that the authorised officer may exempt an

applicant from having his fingerprints captured where this is

specifically provided for by law.

The biometric identifiers shall be captured in accordance Capture and

with the applicable mandatory technical specifications established storage

biometric

by law and shall be stored in a highly secure manner in the NIDMS.

identifiers.

The biometric identifiers shall be captured for the purpose Purpose of

capture of

of personalisation of an identity card or a residence document.

biometric

identifiers.

The biometric identifiers captured for the purpose of being Retention of

included in a registration certificate, a residence card, a permanent biometric

identifiers.

residence certificate or a permanent residence card as defined in the

Free Movement of European Nationals and their Family Members S.L. 460.17.

Order shall only be retained in the NIDMS until the date of collection

of the document by the holder

Provided that the said period shall not be longer than

ninety (90) days from the date of issue of such document.

Upon the lapse of the date or of the period established in Deletion of

regulation 9, biometric identifiers stored in the NIDMS shall be biometric

identifiers.

immediately erased or destroyed

Provided that prior to erasing or destroying the biometric

identifiers of an identity document referred to in regulation 9, the

facial images shall be retained in the NIDMS beyond such date or

period for identification purposes

Provided further that the said facial images shall not qualify

as biometric identifiers and are not processed through specific means

allowing the technical unique identification or authentication of a

natural person.

(1) The controller, taking into account the nature, scope, Appropriate

context and purposes of processing as well as the risks of varying safeguards.

likelihood and severity for the rights and freedoms of the data subjects,

both at the time of the determination of the means for processing and

at the time of the processing itself, shall implement appropriate

technical and organisational measures, in an effective manner and to

integrate the necessary safeguards into the processing, in order to

protect the rights of the data subjects and to ensure a level of security

appropriate to the risk.

(2) The data protection officer designated by the controller in

accordance with Article 37 of Regulation (EU) 2016/679 shall be

involved and consulted properly and in a timely manner on all issues in

relation to the protection of personal data processed for the purposes of

these regulations.

(3) For the purposes of ensuring and to be able to demonstrate

that the processing of personal data is performed in accordance with

the provisions of Regulation (EU) 2016/679, the controller shall

implement the appropriate data protection policies, which policies

shall be periodically reviewed and updated where necessary.

€0.36