FAIR ACCESS TO AND USE OF DATA REGULATIONS

SUBSIDIARY LEGISLATION 418.06

FAIR ACCESS TO AND USE OF DATA REGULATIONS

10th October, 2025

LEGAL NOTICE 222 of 2025.

(1)

The title of these regulations is the Fair Access to

and Use of Data Regulations.

(2)

These regulations implement the requirements of the

provisions of Regulation (EU) 2023/2854 of the European Parliament

and of the Council of 13 December 2023 on harmonised rules on fair

access to and use of data and amending Regulation (EU) 2017/2394

and Directive (EU) 2020/1828 (Data Act).

(1)

In these regulations, unless the context otherwise

requires

"Act" means the Malta Digital Innovation Authority Act;

"competent authorities" means the Malta Digital

Innovation Authority and the Malta Communications

Authority;

"Malta Communications Authority" means the Malta

Communications Authority established by virtue of article 3 of

the Malta Communications Authority Act;

"Malta Digital Innovation Authority" means the Malta

Digital Innovation Authority established by virtue of article 5

of the Malta Digital Innovation Authority Act; and

"Regulation (EU) 2023/2854" means Regulation (EU)

2023/2854 of the European Parliament and of the Council of 13

December 2023 on harmonised rules on fair access to and use

of data and amending Regulation (EU) 2017/2394 and

Directive (EU) 2020/1828 (Data Act).

(2)

Any terms which are not defined in these regulations

shall have the same meaning as assigned to them in Regulation (EU)

2023/2854

Provided that unless the context otherwise requires,

terms used in these regulations, which are not defined in Regulation

(EU) 2023/2854 and which are not herein defined, shall have the same

meaning as that assigned to them in the Act and in the Malta

Communications Authority Act.

For the purposes of Article 10 of Regulation (EU) 2023/

2854, the Malta Digital Innovation Authority shall certify a dispute

settlement body established in Malta, at the request of such body,

where it has been demonstrated that it meets all of the following

conditions

(a)

it is impartial and independent, and it determines

its decisions in accordance with clear, non-discriminatory and

fair rules of procedure;

(b)

it has the necessary expertise, in particular in

relation to fair, reasonable and non-discriminatory terms and

conditions, including compensation, and on making data

available in a transparent manner, allowing the body to

effectively determine those terms and conditions;

(c)

it is easily accessible

through

electronic

communication technology; and

(d)

it is capable of adopting its decisions in a swift,

efficient and cost-effective manner in at least one official

language of the Union.

(1)

The Malta Digital Innovation Authority shall be

designated as the competent authority responsible for the application

and enforcement of all the provisions of Regulation (EU) 2023/2854

with the exception of Articles 23, 24, 25, 26, 27, 28, 29, 30, 31, 34 and

35. (2)

The Malta Communications Authority shall be designated

as the competent authority responsible for the application and

enforcement of Articles 23, 24, 25, 26, 27, 28, 29, 30, 31, 34 and 35 of

Regulation (EU) 2023/2854.

(3)

For the purpose of enforcing the provisions of Regulation

(EU) 2023/2854, the Malta Digital Innovation Authority and the Malta

Communications Authority shall have all the powers conferred by the

provisions of Regulation (EU) 2023/2854 including those powers

conferred on the competent authorities by Articles 37(5) and 37(14) of

Regulation (EU) 2023/2854.

The Malta Digital Innovation Authority shall be

designated as data coordinator to facilitate cooperation between the

competent authorities and to assist entities within the scope of

Regulation (EU) 2023/2854 on all matters related to its application and

enforcement.

Without prejudice to any other administrative or judicial

remedy, natural or legal persons who have their habitual residence,

place of work or establishment in the territory of Malta shall have the

right to submit

(a)

a complaint with the Malta Digital Innovation

Authority individually or, where relevant collectively, if their

rights under Regulation (EU) 2023/2854 other than in relation

to Articles 23, 24, 25, 26, 27, 28, 29, 30, 31, 34 and 35 have

been infringed; and

(b)

a complaint with the Malta Communications

Authority individually or, where relevant collectively, if their

rights under Articles 23, 24, 25, 26, 27, 28, 29, 30, 31, 34 and

35 of Regulation (EU) 2023/2854 have been infringed.

(1)

An appeal shall lie before the Administrative

Review Tribunal from any decision taken by the competent authorities,

respectively in accordance with these regulations, in their application

and enforcement of Regulation (EU) 2023/2854 or pursuant to their

respective failure to act on a complaint submitted in accordance with

regulation 6.

(2)

The provisions of the Administrative Justice Act, in so

far as they apply to the Administrative Review Tribunal, shall apply to

any proceedings before the said Tribunal.

(3)

For the purposes of these regulations the word "decision"

shall have the same meaning attributed to it in the definition

"administrative act" in the Administrative Justice Act.

(4)

There shall be a right of appeal from decisions of the

Administrative Review Tribunal to the Court of Appeal in accordance

with the provisions of Part IV of the Administrative Justice Act.

(1)

In relation to the enforcement of Regulation (EU)

2023/2854 by the Malta Digital Innovation Authority, articles 42, 43,

44 and Part IX of the Act shall apply to any infringement of the

provisions of Regulation (EU) 2023/2854 with the exception of

Articles 23, 24, 25, 26, 27, 28, 29, 30, 31, 34 and 35 thereof.

(2)

In relation to the enforcement of Regulation (EU) 2023/

2854 by the Malta Communications Authority, Part VI of the Malta

Communications Authority Act shall apply in relation to any

infringement of Articles 23, 24, 25, 26, 27, 28, 29, 30, 31, 34 and 35 of

Regulation (EU) 2023/2854.

(3)

Without prejudice to the provisions of the Act and of the

Malta Communications Authority Act, due regard shall be had to the

recommendations of the European Data Innovation Board and the

following non-exhaustive criteria for the imposition of penalties for

infringements of Regulation (EU) 2023/2854

(a)

the nature, gravity, scale and duration of the

infringement;

(b)

any action taken by the infringing party to

mitigate or remedy the damage caused by the infringement;

(c)

any previous infringements by the infringing party;

(d)

the financial benefits gained or losses avoided by

the infringing party due to the infringement, insofar as such

benefits or losses may be reliably established;

(e)

any other aggravating or mitigating

factor

applicable to the circumstances of the case; and

(f)

the infringing party’s annual turnover in the

preceding financial year in the European Union.

(4)

The Malta Communications Authority may prior to

initiating any proceedings in relation to an infringement of Articles 23,

24, 25, 26, 27, 28, 29, 30, 31, 34 and 35 consult with the Malta Digital

Innovation Authority and, or any relevant person.