Aġenzija SAPPORT (Establishment as an Agency)

L.N. 87 of 2025

PUBLIC ADMINISTRATION ACT

(CAP. 595)

Aġenzija SAPPORT (Establishment as an Agency)

(Amendment) Order, 2025

IN EXERCISE of the powers conferred by article 26(1) of the

Public Administration Act, the Prime Minister has made the following

order:-

The title of this order is the Aġenzija SAPPORT

(Establishment as an Agency) (Amendment) Order, 2025 and this

order shall be read and construed as one with the Aġenzija SAPPORT

(Establishment as an Agency) Order, hereinafter referred to as the

"principal order".

In article 2 of the principal order, in the definition of

"Permanent Secretary" the words "with disability." shall be substituted

by the words "with disability;" and immediately thereafter there shall

be added the following new definition

" "Regulation (EU) 2016/679" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to the

processing of personal data and on the free movement of such

data, and repealing Directive 95/46/EC (General Data Protection

Regulation).".

Immediately after article 4 of the principal Order there shall

be added the following new article

" Power of the

(1) In the performance of its functions,

Agency to

including but not limited to

request

information.

(a) assessing the suitability or eligibility of

any individual to commence or continue receiving

or benefiting from its services or schemes;

(b) verifying the completeness, accuracy or

truthfulness of any submitted information or

document;

(c) ensuring the provision of appropriate

and effective support, services or assistance to its

service users,

the Agency shall have the power to request the

relevant and necessary information, including but not

limited to, details regarding any financial or other

benefits, health status, or disability of any service user or

otherwise beneficiary and from any person, including but

not limited to, any ministry, department, authority,

agency, government entity, voluntary organisation or

other body.

(2) Any request or consultation referred to in sub-

article (1) shall be limited to the information that is

strictly necessary for the Agency to effectively fulfil its

functions.

(3) Any person, including but not limited to, any

ministry, department, authority, agency, government

entity, voluntary organisation or other body, that

communicates or otherwise makes available any

information to the Agency in reply to a request or

consultation as referred to in sub-article (1) shall be

deemed to act lawfully.".

4. Immediately after article 9 of the principal order there shall Adds new

be added the following new articles

" Processing of

(1) The applicability of Regulation (EU)

2016/679

and the Data Protection Act, including any

regulations made thereunder and the fundamental rights

and freedoms of the data subjects shall not be prejudiced

by this order.

(2) When the Agency is acting in its capacity of a

controller in terms of Article 4(7) of the Regulation (EU)

2016/679 shall perform the relevant data processing

operations which are strictly necessary for the purposes of

this order.

(3) Where the personal data communicated or

otherwise made available to the Agency by virtue of this

order or any other law in the performance of its functions,

includes data other than that required for the purposes for

which such data was communicated or otherwise made

available to, the Agency shall immediately erase such data

upon receipt.

(4) The processing of personal data, including

special categories of personal data, for the purposes of

this order shall be in conformity with the provisions of

Article 5 of Regulation (EU) 2016/679, and the said

personal data shall not be further processed in a manner

that is incompatible with the purposes of this order.

(5) The processing of personal data for research

and statistical purposes shall be subject to appropriate

safeguards pursuant to Regulation (EU) 2016/679 for the

rights and freedoms of the data subjects

Provided that the said safeguards shall ensure

that the appropriate technical and organisational measures

are implemented in particular to ensure compliance with

the principle of data minimisation as established in Article

5(1)(c) of Regulation (EU) 2016/679, which measures

may include pseudonymisation.

(1) The Agency, while taking into account

the nature, scope, context and purposes of processing, as

well as the risks of varying likelihood and severity for the

rights and freedoms of the data subjects, both at the time

of the determination of the means for processing as well

as at the time of the processing itself, shall implement

appropriate technical and organisational measures, in an

effective manner and integrate the necessary safeguards

into the processing in order to protect the rights of the

data subjects and to ensure a level of security appropriate

to the risk.

(2) The data protection officer designated by the

Agency in accordance with Article 37(1)(a) of Regulation

(EU) 2016/679 shall be involved and consulted properly

and in a timely manner on all matters in relation to the

protection of personal data processed for the purposes of

this order.

(3) For the purposes of ensuring and to be able to

demonstrate that the processing of personal data is

performed in accordance with the provisions of

Regulation (EU) 2016/679, the Agency shall implement

the appropriate data protection policies, which policies

shall be periodically reviewed and updated where

necessary.".

€0.27