ORGANISATIONAL STRUCTURES FOR DATA SHARING AND RE-USE REGULATIONS

AND RE-USE

SUBSIDIARY LEGISLATION 546.01

ORGANISATIONAL STRUCTURES FOR DATA

SHARING AND RE-USE REGULATIONS

8th January, 2021

LEGAL NOTICE 429 of 2020, as amended by Legal Notice 20 of

2025. Part I - Preliminary

(1)

The title of these regulations is the

Organisational Structures for Data Sharing and Re-Use Regulations.

(2)

These regulations provide for

(a)

the establishment of a regulatory authority for

the purposes of the Re-use of Public Sector Information Act;

(b)

the establishment of an implementation

authority for the purposes of the Re-use of Public Sector

Information Act;

(c)

the establishment, maintenance and publication

of a Register of Registers published on the national data portal;

(d)

the publication of a Data Classification Scheme

to be applied by the data owners to official registers and

published as part of the Register of Registers;

(e)

the legal basis for a standard format and

structure for a Uniform Resource Identifier to be used for the

identification of official records and for a standard metadata

record;

(f)

the legal basis for a set of Administrative and

Data Governance Registers;

(g)

the establishment of a Data Governance

Council; and

(h)

the implementation of regulatory measures

emanating from Directive (EU) 2019/1024 of the European

Parliament and of the Council of 20 June 2019 on open data

and the re-use of public sector information (recast) and any

related Directives and Regulations.

In these regulations, unless the context otherwise

requires

"Act" means the Re-Use of Public Sector Information Act;

AND RE-USE

"Administrative Register" means an official register which is

designed to hold records of an administrative nature mainly dealing

with the organisational structures of the public administration;

"application program interface" or "API" is a set of automated

functions and protocols that enable machine-to-machine

communications for the exchange and consumption of data in a

dynamic environment. Such APIs shall follow a registration process

prior to be authorised and included in the national data portal;

"controller" has the same meaning as in Article 4 of the General

Data Protection Regulation;

"Council" or "the Council" or "the Data Governance Council"

mean the Data Governance Council as established by Part XI;

"data discovery service" means the aggregation of metadata

from various sources within the public administration into a single

centralised repository to enable a comprehensive web-based search

for official registers and datasets including also the pertinent legal

basis and the data owner of each official register; it includes also the

visualisation of the information provided from such searches;

"data owner" means the person or entity responsible for the

processing, security, quality and access permissions of an official

register; when identifiable information relating to a person is

processed, the obligations of a data controller in terms of the General

Data Protection Regulation shall apply;

"dataset" means an aggregation or filtering of selected data

elements from one or more official registers into an identified and

persistent list of records which can be used by other automated

information services;

"Data Classification Scheme" means the Data Classification

Scheme as established in Part VI;

"Data Governance Register" means an official register

published on the national data portal which is intended to maintain

records holding information relating to the technical and other details

describing information assets and the automated systems used by the

public administration;

"General Data Protection Regulation" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the

processing of personal data and on the free movement of such data,

and repealing Directive 95/46/EC (General Data Protection

Regulation);

AND RE-USE

"information system" means a defined set of automated

processes and user interfaces designed to collect, store and

disseminate data for the purpose of providing useful information;

"national data portal" or "Malta Data Portal" or "national open

data portal" means the web-based system and data repository which

shall enable the management and publishing directly by the data

owners of the data sharing permissions and the controlled lists and

vocabularies as reference data, including also the functionality for the

discovery of all official registers and the consumption of open data;

"official record" means an identifiable and distinct entry in an

official register having the necessary qualities to be admissible as

evidence in a court of law;

"official register" means a collection of official records

mandated by Maltese legislation, which is included in the Register of

Registers;

"open data" means and refers to a concept that is generally

understood to denote data in an open format that can be freely used,

re-used and shared by anyone for any purpose;

"open data policies" means policies which encourage the wide

availability and re-use of public sector information for private or

commercial purposes, with minimal or no legal, technical or financial

constraints;

"personal data" has the same meaning as in Article 4 of the

General Data Protection Regulation;

"public employee" shall have the same meaning as that

provided in article 2(1) of the Public Administration Act;

"public sector body" shall have the same meaning as assigned

to it by article 2 of the Act;

"reference data" means the lists of controlled vocabularies and

descriptions which are managed by the data owner of the specific

official register in order to provide additional meaning and

classification information to the records held in such registers;

"Register of Registers" shall mean the Register of Registers

established by Part V;

"uniform resource identifier" or "URI" is a web-compliant

format for the allocation of a machine-readable persistent identifier

for every entry in an official register, including the different

identifiers assigned to the different versions of each record; and

"user" mean public employees and, or data subjects having

AND RE-USE

access to an official register.

Part II - Sharing of Data between Public Sector Bodies

The sharing of data between public sector bodies shall be

allowed by the Regulator for the following reasons

(a)

to facilitate the re-use and exchange of

information between public entities in order to eliminate,

wherever possible, the need for an undertaking to provide the

same information to more than one public sector body;

(b)

to assist in the carrying out of a function of one

or more of the public sector bodies concerned by -

(i)

reducing the duplication of tasks carried

out by one or more public sector bodies;

(ii) increasing the efficiency of a public

sector body in carrying out that function;

(iii) facilitating an improvement in the quality

of services being delivered; and, or

(iv)

reducing service delivery time-frames to

clients;

(c)

to assist a public sector body in verifying the

identity of an undertaking being regulated or receiving a

service being delivered by the public entity;

(d)

to assist in the identification or correction of

any erroneous information held by one or more of the public

entities concerned;

(e)

to facilitate an analysis of the structure,

functions, resources and service delivery methods of a public

entity; and

(f)

to assist in the drafting of strategies and the

proposal of policies to Government or to implement

Government policies and strategies.

Part III - Establishment, Functions and Conduct of

Affairs of the Authority

In the exercise of his functions under article 25(b) of the

Act, the Minister is hereby appointing the Information and Data

Protection Commissioner as the regulatory authority which shall be

responsible for the monitoring of the implementation of the provisions

of the Act.

AND RE-USE

In the exercise of its functions under these regulations,

the regulatory authority shall act independently and shall not be

subject to the direction or control of any other person or authority.

It shall be the duty of the regulatory authority to promote

the observance of the requirements of these regulations.

The regulatory authority shall receive reports and claims

from any person or associations representing them on violations of

these regulations, to take such remedial action as it may deem

necessary or as may be prescribed under the Act, and to inform such

person or associations of the outcome of its decision.

(1)

In the exercise of the investigative powers the

regulatory authority may request the assistance of the Executive

Police in order to enter and search any premises.

(2) The regulatory authority shall be entitled to obtain on

request access to any system, metadata and any documentation or

copy thereof required in the course of exercising its duties.

(3) Without prejudice to any other provision of any other

law, any person who does not comply with any lawful request

relevant to an investigation by the regulatory authority shall be guilty

of an offence against this regulation.

(1)

Any applicant may apply to the regulatory

authority for a decision with regard to any request specified

hereunder where

(a)

a request for information made by the applicant

to a public sector body has been refused or has not been dealt

with in accordance with the requirements of the Act; or

(b)

a public sector body is not in compliance with

the requirements set out in these regulations.

(2) On receiving an application for a decision under this

regulation, the regulatory authority shall take a decision unless it

appears to it -

(a)

that the applicant has not exhausted any

complaints procedure which may be provided by the public

sector body;

(b)

that there has been undue delay in making the

application;

(c)

that the application is frivolous or vexatious; or

(d)

that the application has been withdrawn or

abandoned.

AND RE-USE

(3) Where the regulatory authority has received an

application under this regulation, it shall either -

(a)

notify the applicant that it has not taken any

decision under this regulation as a result of the application and

of its grounds for not doing so; or

(b)

serve notice of its decision on the applicant and

on the public sector body.

(4)

A decision notice shall contain particulars of the right of

appeal.

(5) Where a decision notice requires steps to be taken by the

public sector body within a specified period, the time specified in the

notice shall not expire before the end of the period within which an

appeal can be brought against the notice and, if such an appeal is

brought, no step which is affected by the appeal need be taken

pending the determination or withdrawal of the appeal.

(1)

If the regulatory authority has received an

application for a decision or reasonably requires any information for

the purpose of determining whether a public sector body has complied

or is complying with any of the requirements of these regulations, it

may serve the public sector body with an information notice requiring

it, within such time as is specified in the notice, to furnish the

regulatory authority, in such a manner as may be so specified, with

such information as is so specified relating to the application.

(2) An information notice shall specify the purpose for

which the regulatory authority requires the information and, where it

refers to information recorded in a document, shall include such

details as are reasonably necessary to enable a responsible officer of

the public sector body to identify that document.

(3) A public sector body shall not be required by virtue of

this regulation to make available to the regulatory authority any

information in respect of

(a)

any communication between a professional

legal adviser and his client in connection with the giving of

legal advice to the client with respect to his obligations,

liabilities or rights under this regulation; or

(b)

any communication between a professional

legal adviser and his client, or between such an adviser or his

client and any other person, made in connection with or in

contemplation of proceedings under or arising out of this

regulation (including proceedings before the Tribunal) and for

the purposes of such proceedings.

AND RE-USE

(4) In sub-regulation (3) references to the client of a

professional legal adviser include references to any person

representing such a client.

(5) The regulatory authority may cancel an information

notice by written notice to the public sector body on which it was

served.

(1)

If the regulatory authority is satisfied that a

public sector body has failed to comply with any of its obligations

under these regulations, the Commissioner may serve the authority

with an enforcement notice requiring the authority to take, within

such a time as may be specified in the notice, such steps as may be so

specified for complying with those obligations.

(2) An enforcement notice shall contain a statement of the

requirement or requirements of these regulations with which the

public sector body has, in the regulatory authority’s opinion, failed to

comply, and its reasons for reaching that conclusion.

(3) The regulatory authority may cancel an enforcement

notice by written notice to the public sector body on which it was

served.

Where a public sector body or an officer of such public

sector body refuses or, without a good reason, fails to comply with -

(a)

so much of a decision notice as requires steps

to be taken;

(b)

an information notice; or

(c)

an enforcement notice,

the regulatory authority may levy an administrative fine against the

defaulting public sector body or officer thereof.

(1)

Where the regulatory authority imposes an

administrative fine, it shall by order in writing require the public

sector body to pay such administrative fine, which shall be due to the

regulatory authority as a civil debt

Provided that such order shall be subject to the appeal

procedure.

(2) In the absence of an appeal, the decision of the

regulatory authority shall become final and shall constitute an

executive title for the purposes of Title VII of the Code of

Organization and Civil Procedure as if the decision had been ordered

by a judgement of a court of civil jurisdiction.

(3)

Where a notice imposing an administrative fine is served

AND RE-USE

on a public sector body and -

(a)

such public sector body fails to appeal within

such time as an appeal may be entered and fails to pay the fine

so imposed; or

(b)

such public sector body appeals within such

time to the Administrative Review Tribunal and the appeal is

withdrawn or the Tribunal confirms the fine in the amount

fixed by the Commissioner or in an amount reduced by it and

no further appeal is filed with the Court of Appeal, or if an

appeal is filed with the Court of Appeal and such Court either

confirms the decision taken or decides that a penalty is due in

another amount, or the imposed penalty is not paid within

fifteen days from the date of the decision or the withdrawal of

the appeal, or the date when the Tribunal or the Court of

Appeal confirms or varies the penalty as aforesaid,

the regulatory authority shall be entitled to take civil action to recover

the amount due.

(4) Such a fine shall not be less than two thousand five

hundred euro (€2,500) and shall not exceed ten thousand euro

(€10,000) for each violation, and or a daily fine not less than twenty-

five euro (€25) and not more than fifty euro (€50).

(5) Without prejudice to the preceding provisions of this

regulation, the regulatory authority may, after giving due regard to the

circumstances of the case, impose an administrative fine on any public

sector body that -

(a)

knowingly provides false information to the

regulatory authority when so requested by the regulatory

authority pursuant to its investigative powers; or

(b)

does not comply with any lawful request

pursuant to an investigation by the regulatory authority

Provided that such a fine shall not be less than two

thousand five hundred euro (€2,500) and shall not exceed ten

thousand euro (€10,000) for each violation.

(1)

Where the regulatory authority exercises its

powers pursuant to these regulations, its decision shall forthwith be

served on the public sector body and the person to whom the decision

is addressed, which decision shall be served either personally, by

registered post to the person’s last known business or private address,

or by electronic means that provide a reliable record of when service

took place.

(2)

In the case of service by electronic means, the decision

AND RE-USE

shall be deemed to have been served upon each person to whom the

decision is addressed when the regulatory authority has received

(a)

an electronic receipt automatically generated

by the e-mail server when the communication is read;

(b)

a written confirmation by return electronic mail

from the person to whom the decision is addressed; or

(c)

a verbal confirmation from the person to whom

the decision is addressed that the electronic mail was received.

(3) If service is not effected within a week of issuing the

decision, because the person to whom the decision refers could not be

found or for any other reason attributable to the person to whom the

decision is addressed, the regulatory authority shall publish a notice

in the Gazette and in one or more daily newspapers, stating that a

decision has been taken in respect of the person to whom the decision

is addressed and inviting him to collect the decision from the

regulatory authority’s office. In any such case, service shall be

deemed to have been effected on the third day after the date of

publication of the last notice.

(1)

Where a decision notice has been served, the

applicant or the public sector body may appeal to the Tribunal against

the notice within twenty working days.

(2) If, on an appeal under this regulation, the Tribunal

considers that -

(a)

the notice against which the appeal is brought

is not in accordance with the law; or

(b)

to the extent that the notice involved an

exercise of discretion by the regulatory authority, it ought to

have exercised its discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as

could have been served by the regulatory authority; and in any other

case the Tribunal shall dismiss the appeal.

(3) Where the Tribunal substitutes a notice as aforesaid, the

regulatory authority shall take action to secure compliance as if that

notice had been issued by the regulatory authority.

Part IV - Implementation of the Act

(1)

In the exercise of his functions under article

25(c) of the Act, the Minister is hereby appointing the the Data

Governance Council as the implementing entity which shall be

responsible for the implementation of the provisions of the Act.

AND RE-USE

(2) In the exercise of its functions, the implementing entity

shall be responsible for the implementation of the objectives of the

Act and, without prejudice to the generality of the foregoing, the

implementing entity shall -

(a)

serve as the main co-ordinator and first line of

call for any of the obligations arising from the Act

Provided that the implementing entity shall, at

all times, seek the instructions of, and execute any directions

received from, the data owner when observing its

responsibilities listed in this sub-regulation;

(b)

publish a standard and format for the

management of communications between the public

administration and natural persons and, or organisations; and

(c)

establish the national data portal through which

the data discovery and data consumption services, as may be

applicable and authorised by the data owner, shall be provided.

(3) The implementing entity shall provide the information

system platform for the Register of Registers as well as the

Administrative Registers and shall supervise and co-ordinate with the

data owners to ensure that the classification and other metadata as

provided for in these regulations are being maintained by the relevant

data owner.

(4) Any refused request for data or disagreement in regard to

the classifications or other decisions taken by the data owner, and

arising from within the public administration, shall in the first

instance be dealt with through an escalation procedure which refers

the relevant facts for the consideration of the Data Governance

Council as established and regulated by Part XI.

(5) Any other dispute concerning a refused request for data

or any challenge in regard to the details as published on the national

data portal shall follow the process as established in regulation 7.

In order to ensure adherence, by the implementing entity,

of its responsibilities set out in regulation 16(2), data owners shall be

responsible to

(a)

directly maintain and ensure that the

classification and other metadata as published on the national

data portal reflects the true information in respect of the

specific register or registers which fall within their legal

responsibilities; and

(b)

provide to the implementing entity the required

software products and tools that shall be used to enable the

AND RE-USE

‘machine to machine’ communication of contents that may be

allowed to be shared or re-used on the basis of the

classifications assigned and published by the data owner on

the national data portal;

(c)

data owners shall be obliged to maintain and

publish on the national data portal a list of datasets and their

respective API’s. Each dataset thus published should also be

linked to an official register as previously included in the

Register of Registers; and

(d)

data owners shall be obliged to maintain on the

national data portal the relevant data governance details which

may be authorised by the Data Governance Council so that the

relevant data flows and data dependencies can be effectively

managed at the national level.

Part V - Register of Registers

(1)

The implementing entity shall publish a list of

official registers for the data catalogue of the national open data

portal known as the Register of Registers, which shall include

therein

(a)

the name of the official register;

(b)

the law applicable to the official register;

(c)

the public sector body or function responsible

for the official register;

(d)

the relevant classification indicators as

applicable and according to the the Data Classification Scheme

as published on the national data portal; and

(e)

the uniform resource identifier (‘URI’) to serve

as the persistent internal identifier of an official register.

(2) The implementing entity shall ensure transparency in its

processes relating to the Register of Registers by adhering to the rules

as applicable to any official register and as indicated in these

regulations.

Part VI - Data Classification Scheme

(1)

The implementing entity shall co-ordinate with

the identified data owner of each register so that such data owner

shall use the values and criteria as published on the national data

portal in order to add the applicable classification indicators to the

information maintained pertinent to the register. Such information

shall also be made available as part of the Open Data publications

AND RE-USE

from the national data portal.

Part VII - Uniform Resource Identifier

(1)

The implementing entity shall publish a

standard and format for the management of a persistent identifier to be

applied to all official records.

(2) The Uniform Resource Identifier shall be composed of

three main parts, namely the indication that this is a record which has

its legal authority from the Laws of Malta, a second part which

identifies the official register and the third part which shall identify

the individual record or a particular version of the same record

according to the record version control mechanism described in

regulation 21.

(1)

The implementing entity shall publish a

standard and format for the management of a record version control

mechanism.

(2) Every official record shall provide the facility to identify

the different versions resulting either from the original insertion into

the register and for any other change of any one of the elements that

constitute such a record from the business perspective.

(3) Each record version shall have its own unique Uniform

Resource Identifier which will enable the identification of all changes

to a specific record with time stamps indicating the start and the end

of such a record version.

(4) The obligation to achieve this version control mechanism

rests with the respective data owners and is applicable for information

systems introduced after the coming into force of these regulations.

Part VIII – Metadata Standards

(1)

The implementing entity shall publish a

standard and format for the management of a metadata record, also

referred to as the record label, to be applied to all official records.

(2) The owner of an official register shall be obliged to

follow such standards which are aimed at enabling interoperability of

records and information required for an audit of such records and for

the provenance and the process from which records originate in view

of the retention periods that may be applicable on the basis of such

information.

Part IX - Reference Data Management

(1)

The implementing entity shall provide a

repository and the necessary maintenance, discovery and publishing

AND RE-USE

facilities for the reference data as applicable to all official registers

included in the Register of Registers.

(2) The owner of an official register shall be obliged to use

such facilities to maintain and publish the reference data pertinent to

the specific register.

Part X - Administrative Registers

(1)

The implementing entity shall provide a

repository and the necessary maintenance, discovery and publishing

facilities for the administrative data as applicable to all official

registers included in the Register of Registers and which are

classified as administrative or data governance registers.

(2) Such registers shall follow the normal rules as

applicable to other official registers.

(3) Public administration systems and processes shall be

obliged to use the official records from the administrative registers

when such records are published and accessible through API’s from

the national data portal or other authorised portals as applicable. Such

data can be copied and stored as part of the local data repositories for

continuity and operational reasons provided it is not updated or in

any way maintained or changed at the line-of-business level.

Part XI - Data Governance Council

(1)

There shall be established a Data Governance

Council, hereinafter referred to as "the Council", which shall have the

functions referred to in the following provisions of this regulation.

(2) The Council shall serve as the focal point for co-

ordination and mediation, as may be required, in relation to the

management of official registers and official records within the

public administration functions as well as the focal point for any

other data-related matters as directed by the Minister responsible for

public sector information.

(3) The Council shall be the main consultative and advisory

body in respect of all matters relating to the governance of official

registers and high-level discussions, mediation and the formulation of

policy, direction and decisions relating to corporate and enterprise

(horizontally applicable) data within the public administration.

(4) The Council shall be involved in the discussions

between data owners and any third party requesting access to specific

registers or datasets before such requests are submitted for the

consideration of the regulatory authority. The proposals or decisions

of the Council shall be without prejudice to, and subject to, decisions

of the regulatory authority.

AND RE-USE

(5) The Council shall be composed of a chairperson and

members having the required credentials and academic background

necessary for an informed discussion on the subject of data

management in the context of the public administration processes and

requirements as appointed for a term of three (3) years by the

Principal Permanent Secretary.

(6) The core members of the Council shall be selected from

the main functions of the public administration which have the most

impact on the implementation of the information systems and the

related national strategies as may be applicable at the time. The

number of core members forming part of the Council shall not exceed

ten (10) persons.

(6a)

The chairperson may appoint a secretary to serve the

Council.

(7) The Council may also invite and involve other experts

and subject-matter specialists as may be required from time to time

and according to the issues and subjects then being dealt with at the

time.

(8) The Council shall, after due consideration and appraisal

of the information supplied, refer the disputed requests received,

conclusions and proposals agreed within the Council to the Principal

Permanent Secretary for authorisation or any other direction as may

be applicable.

First Schedule

Data Classification Scheme

Deleted by Legal Notice 20 of 2025.

Second Schedule

Register of Registers

Deleted by Legal Notice 20 of 2025.

AND RE-USE

Third Schedule

Metadata record structure

Deleted by Legal Notice 20 of 2025.

Fourth Schedule

Administrative Registers

Deleted by Legal Notice 20 of 2025.

Fifth Schedule

Data Governance Registers

Deleted by Legal Notice 20 of 2025.