VACCINATION AGAINST COVID-19 CERTIFICATE ORDER

SUBSIDIARY LEGISLATION 465.65

VACCINATION AGAINST COVID-19

CERTIFICATE ORDER

30th April 2021

LEGAL NOTICE 203 of 2021, as amended by Legal Notices 227 of

2021 and 7 of 2022.

(1)

The title of this order is the Vaccination against

COVID-19 Certificate Order.

(2)

The scope of this order is to set out the legal basis for the

processing of personal data by the Superintendent of Public Health

during the COVID-19 pandemic when

(a)

an interoperable certificate on vaccination is

issued for persons who have been vaccinated in Malta and who

require such vaccination certificate to travel to a third country;

and

(b)

verifying and accepting recognised interoperable

certificates on vaccination issued by competent authorities in a

third country for persons arriving in Malta from such third

country.

(3)

The provisions of this order shall be read in conformity

with and shall be without prejudice to the provisions of the Data

Protection Act and the provisions of Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal

data and on the free movement of such data, and repealing Directive

95/46/EC.

Data to be included in the vaccination certificate

(a)

name: surname(s) and forename(s), in that order;

(b)

date of birth;

(c)

disease or agent targeted;

(d)

vaccine/prophylaxis;

(e)

vaccine medicinal product;

(f)

vaccine marketing

authorization

holder

or

manufacturer;

(g)

number in a series of vaccinations/doses;

(h)

date of vaccination, indicating the date of the latest

dose received;

(i)

country of vaccination;

(j)

certificate issuer;

(k)

a unique certificate identifier;

(l)

passport number or other identification document

number of the person.

In this order, unless the context otherwise requires

"booster" means additional vaccine dose or doses following a

full primary course of vaccination;

"fully vaccinated person" means a person who has received all

applicable doses of an approved vaccine medicinal product according

to instructions published by its manufacturer, which vaccine shall

become effective fourteen (14) days after the last dose has been

received;

"General Data Protection Regulation" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the processing

of personal data and on the free movement of such data, and repealing

Directive 95/46/EC;

"interoperability" or "interoperable" means that a vaccination

certificate and a recognised vaccination certificate are able of being

verified in Malta and in the third country party to a bilateral agreement

in terms of article 4;

"recognised vaccination certificate" means an interoperable

certificate recording that a person has been fully vaccinated and which

certificate is issued in a third country which has a bilateral agreement

with Malta;

"third country" means any country outside the European

Economic Area;

"trust framework" means the rules, policies, specifications,

protocols, data formats and digital infrastructure regulating and

allowing for the reliable and secure issuance and verification of

certificates to guarantee the certificates’ trustworthiness by confirming

their authenticity, validity and integrity;

"unique certificate identifier" means a set of numbers and letters

given to each vaccination certificate issued in accordance with this

order and which shall be specific to each certificate;

"vaccination certificate" means an interoperable certificate

generated in Malta upon the request of a person which includes the

information listed in the Schedule;

"vaccine" means an immunological medicinal product to

prevent COVID-19.

(1)

For the purposes of this order, the Superintendent

of Public Health shall be the health authority competent to issue a

vaccination certificate in Malta and shall be considered as the

controller for the purposes of the General Data Protection Regulation.

(2)

A person who has been vaccinated in Malta may request

the Superintendent of Public Health to issue a vaccination certificate

Provided that a vaccination certificate shall only be

issued to a fully vaccinated person who requires such a certificate to

enter a third country.

(3)

A vaccination certificate shall be made available to the

person in digital or paper-based format.

(4)

A vaccination certificate shall be valid for such period as

specified in standards issued by the Superintendent.

(5)

The holder of a vaccination certificate shall be entitled to

request the issuance of a new vaccination certificate if the personal

data contained in the certificate is no longer accurate or up to date, or

the certificate is either no longer available to the holder or otherwise

no longer valid.

(6)

For statistics, research and audit purposes, the

Superintendent of Public Health may retain a record containing the

unique certificate identifier as reference of a vaccination certificate

and without including any identifiable details in relation to the holder.

(1)

The Government of Malta, after consultation with

the Superintendent of Public Health may enter into a bilateral

agreement with a third country with the scope of mutually recognising

vaccination certificates issued by Malta and such third country

Provided further that the provisions of this order shall

also apply to vaccination certificates issued by third countries with

which Malta does not have a bilateral agreement.

Provided that any bilateral agreement shall be drawn up

in line with the requirements of the General Data Protection

Regulation and any international obligations in place.

(2)

The Superintendent of Public Health shall publish a

notice in the Gazette listing the third countries that are party to any

bilateral agreement pursuant to sub-article (1).

The provisions of this order shall also apply to vaccination

certificates issued by EU and EEA countries, including in cases where

there is no bilateral agreement in place.

(1)

The processing of data pursuant to article 3, shall

be necessary for reasons of public interest in the area of public health

and based on articles 6(1)(e) and 9(2)(i) of the General Data Protection

Regulation.

(2)

No personal data in relation to vaccination certificates

and recognized vaccination certificates shall be further processed by

the controller for a purpose that goes beyond the scope of these

regulations.

(1)

Appropriate technical means based on a trust

framework shall be used for the issuance and verification of vaccine

certificates and recognized vaccine certificates, providing for the

interoperability, integrity and authenticity of such certificates.

(2) The technical means and the trust framework pursuant to

sub-article (1), may be defined in the bilateral agreement signed with

the third country, including data protection by design and default.

(3)

The trust framework shall provide for appropriate

technical and organisational measures to ensure adequate security to

safeguard the confidentiality, integrity, availability and resilience of

personal data being processed for the purpose of these regulations.

(4)

When a vaccine certificate is issued and verified, the

only data that may be requested shall be that data which is necessary to

VACCINATION AGAINST COVID-19 CERTIFICATE

avoid the use of forged vaccination certificates and to confirm its

authenticity.