BUSINESS REGISTER AND INFORMATION SHARING REGULATIONS

SUBSIDIARY LEGISLATION 546.02

BUSINESS REGISTER AND INFORMATION

SHARING REGULATIONS

8th January, 2021

LEGAL NOTICE 430 of 2020.

(1)

The title of these regulations is the Business

Register and Information Sharing Regulations.

(2)

These regulations establish

(a)

a Registrar for Business whose responsibility

shall be the administration of the Business Register;

(b)

a Business Register which records all

businesses established in Malta and the assignment of a unique

machine-readable identifier for every business whose details

are recorded in the Business Register; and

(c)

a Business Portal which will facilitate sharing

of business information between public sector bodies and

between public sector bodies and businesses.

(3) These regulations provide for measures which are

necessary for giving full effect to the Act by facilitating the sharing

of commonly used business data between public sector bodies.

(4) These regulations also provide for the establishment and

maintenance of a business profile within which businesses may store

information relative to their activities and share them with public

sector bodies as may be necessary from time to time.

In these regulations, unless the context otherwise

requires

"Act" means the Re-Use of Public Sector Information Act;

"data generator" means any person, undertaking or public body

responsible for generating and updating business-related information

and data which is to be shared with other public entities;

"data manager" means a natural person appointed by the

owners of an undertaking, by board resolution in the case of a

company, to manage the daily affairs of the undertaking and who is

made responsible for the updating of the particulars of the

undertaking in the Register; in the case of a sole trader, the data

manager shall be the sole proprietor himself, and in the case of a

partnership, the data manager shall be one of the partners, unless, in

both cases, a person is specifically appointed to fulfil such function;

"data owner" shall have the same meaning as is assigned to it in

the Organisational Structures for Data Sharing and Re-Use

Regulations;

"data-sharing" shall have the same meaning as is assigned to it

in the Organisational Structures for Data Sharing and Re-Use

Regulations;

"director" includes any person occupying the position of

director of a company by whatever name that position may be called

carrying out substantially the same functions in relation to the running

of the company as those carried out by a director;

"established in Malta" means the head office, agency, or branch

or part of a business;

"General Data Protection Regulation" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the

processing of personal data and on the free movement of such data,

and repealing Directive 95/46/EC (General Data Protection

Regulation);

"information" shall also include data;

"information system" shall have the same meaning as is

assigned to it in the Organisational Structures for Data Sharing and

Re-Use Regulations;

"limited liability company" means a company duly formed and

registered under Part V of the Companies Act;

"name", in relation to an individual, means that individual’s

first name or names and surname;

"official record" shall have the same meaning as is assigned to

it in the Organisational Structures for Data Sharing and Re-Use

Regulations;

"official register" shall have the same meaning as is assigned to

it in the Organisational Structures for Data Sharing and Re-Use

Regulations;

"open data" shall have the same meaning as is assigned to it in

the Organisational Structures for Data Sharing and Re-Use

Regulations 2020;

"owner" means the ultimate beneficiary natural person who,

directly or indirectly, has a shareholding or other interest in a

business;

"partnership" means a partnership en nom collectif or

partnership en commandite duly formed and registered in terms of

Part III and Part V of the Companies Act;

"public limited company" means a company duly formed and

registered under Part V of the Companies Act;

"public sector body" shall have the same meaning as is

assigned to it in the Organisational Structures for Data Sharing and

Re-Use Regulations;

"prescribed" means prescribed by regulations made or deemed

to have been made under the Act, and where no regulation is in force

in respect of a matter which may or is to be prescribed, means

determined, approved or allowed by the Minister;

"Register of Registers" means the Register established under

Part V of the Organisational Structures for Data Sharing and Re-Use

Regulations;

"the Registrar" means a person who is appointed to assign the

unique identifier to each undertaking and to administer the Register

of Businesses according to these regulations and appointed by virtue

of regulation 3;

"the Regulator" means the regulatory authority for the

purposes of the Act as defined in the Organisational Structures for

Data Sharing and Re-use Regulations;

"undertaking" or "business" means any entity engaged in an

economic activity, that is an activity consisting in offering goods or

services on a given market, regardless of its legal status and the way

in which it is financed; an undertaking listed in the Register can be

either -

(a)

a commercial partnership formed and

registered under the Companies Act or formed and registered

under the Commercial Partnerships Ordinance where

applicable; or

(b)

a self employed person as defined in the

Employment and Industrial Relations Act; or

(c)

a co-operative society as defined in the Co-

operatives Societies Act; or

(d)

any other economic activity

Provided that "undertaking" or "business" shall also include

entrepreneurs and, or business entities that may apply for certain

incentives, although not yet incorporated in Malta, but who may be

taxed in Malta on the basis of their operation, in accordance with the

relative legislation then in force;

"unique identifier" shall have the same meaning as is assigned

to it in the Organisational Structures for Data Sharing and Re-Use

Regulations.

(1)

There shall be established a Business Register

which shall contain therein the business profile of every undertaking

operating in and from Malta; the details to be stored and maintained

for every business profile shall be in accordance with the list

contained in the Schedule 1.

(2) There shall be appointed, by the Minister responsible for

the registration of commercial partnerships, a Registrar for Business,

hereinafter referred to as "the Registrar", whose responsibility shall be

the drawing up, and regular updating, of the Business Register in

accordance with the provisions of these regulations.

(3) The functions and duties of the Registrar shall be

performed by the Registrar of Companies and Other Commercial

Partnerships appointed under the provisions of article 400 of the

Companies Act

Provided that the Registrar may, with the approval of the

Minister, delegate any or all of his administrative functions to an

authorised entity.

(1)

The Registrar shall assign a unique identifier to

every undertaking established in Malta and listed in the Register, for

the purpose of uniquely identifying the undertaking.

(2) The unique identifier shall be the identifier to be quoted

by an undertaking whenever it carries out any transaction with any

public sector body; and the public sector body shall use the same

identifier in any related activity.

(1)

The Register shall be accessed by authorised

users who are employees or contractors acting for and on behalf of a

public sector body, which body shall be responsible for the manner in

which the data from the Register is used within such public sector

body.

(2) Unless otherwise authorised by the Regulator, the

general public shall have access to the information as included in

Schedule 2, as this may be amended, substituted or updated by the

Registrar from time to time.

(3) Any interested party may, in writing, contest with the

Regulator, the information in the business profile.

(1)

There shall be established, by the Registrar or

his delegate, a business portal the function of which shall be the

facilitation of the management, updating and sharing of business

information across public sector bodies, as well as the regulation of

the access thereto, through the management of the business profile.

(2) There shall also be appointed, by the Minister

responsible for the registration of commercial partnerships, a person

whose responsibility shall be the administration of the business portal

in accordance with the provisions of these regulations.

(3) The portal shall be designed in such manner as to enable

undertakings, and owners of data related thereto, to interact; data

submitted through the portal to one stakeholder shall be deemed to

have been submitted to other users listed in Schedules 1 and 3.

(4) The information that may be shared through the business

portal and the data owners of each data field in the business portal is

listed in Schedule 3.

(1)

The undertakings have the responsibility to

ensure that the information in the business profile shall be kept

correct and updated.

(2) In the case where an undertaking has ceased operations,

or is otherwise in breach of these regulations, the data manager or

owner, as the case may be, of the undertaking shall be bound to

update the status of the business profile accordingly, within one

month of the date of such end of operations or the occurrence of such

breach.

(3) Where a public sector body has reasonable cause to

believe that the undertaking has actually ceased operations, or is

otherwise in breach of these regulations, the public sector body shall

inform the Regulator accordingly who shall have the right to update

the business profile accordingly

Provided that the data owner may contest the change by

submitting proof to the contrary; the data owner shall have the right,

once the change has been proved to be incorrect and the Regulator

has authorised it, to change the incorrect entry himself and inform the

public sector body accordingly.

(1)

Data owners of public sector bodies shall have

the responsibility to

(a)

maintain their records and, or data fields listed

in the Schedule 3 and ensure that the information they supply

through the business portal reflects the true and updated

information;

(b)

install software products and tools that shall be

used to enable the ‘machine to machine’ communication of

information that may be allowed to be shared or re-used on the

basis of these regulations; and

(c)

indicate in their correspondence with

undertakings listed in the Register, whether electronically or

otherwise, the unique identifier of every undertaking included

in the Register and in respect of which a record is required to be

kept.

(1)

Public sector bodies responsible for official

registers as included in the Register of Registers and which are

identified as having common business data as listed in Schedule 3

shall link to the business profile through the unique identifiers in order

to establish a connection between the locally stored records and the

centrally maintained business identifier

Provided that the links established between official

registers enabling interoperability and re-use of data shall remain

under the control and full visibility of the source data owner and

access to such data shall only be permitted as described under these

regulations or in any other relevant legislation.

(2) The public sector body responsible for an official register

holding business data shall be obliged to provide data to other

registers in accordance with the law regulating the official registers

concerned and in line with the links established under the Schedule 3.

(1)

For the purposes of the Act, and in accordance

with the Data Protection Act and the General Data Protection

Regulation, information relating to the undertakings listed and

contained in the business profile shall be shared through the business

portal on a ‘needs only’ basis at the discretion of the Regulator.

(2) Notwithstanding any other enactment, public sector

bodies shall share and use information relating to business amongst

themselves for the purpose of discharging their functions.

(3) No public sector body shall disclose to a third party any

information obtained pursuant to sub-regulations (1) or (2).

The sharing and re-use of data through the business

portal shall be based on the following Schedules and the pertinent

rules described hereunder

(a)

Schedule 1 shall contain the full list of data

elements that make up the Business Register and which are

stored and maintained by the Registrar;

(b)

Schedule 2 shall contain the list of data

elements from Schedule 1 which are to be made available as

open data; and

(c)

Schedule 3 shall contain the full list of data

elements maintained by any other public sector body and a list

of public administration processes with links between a

process and a dataset, and containing also a justification for

the access and re-use of such data.

(1)

For the purposes of these regulations all

undertakings listed in the Business Register shall be considered as

business undertakings for data protection reasons.

(2) For the avoidance of any doubt, an individual who is a

self- employed person and who is registered under these regulations

shall be considered a business undertaking and therefore all data

relating to the business may be shared and accessed by public entities

subject to the provisions of this regulation and regulation 10.

(1)

The Regulator shall receive reports and claims

from any public sector body on violations of these regulations, and

shall take such remedial action as he may deem necessary or as may

be prescribed under these regulations, and shall inform the persons

and undertaking concerned and the users of the Register of the

outcome of his decision.

(2) Any person aggrieved by the decision of the Regulator

under this regulation may appeal to the Administrative Review

Tribunal set up under article 5(1) of the Administrative Justice Act.

(1)

No action shall lie against the Registrar or any

of his officers or employees, or against any public sector body, or any

authorised entity delegated under regulation 3(3), providing

information under these regulations, in respect of any act done or

omitted to be done in good faith by the Registrar, any of his officers

or employees, public sector body or authorised entity in the execution

of their functions under these regulations.

(2) Where the Registrar furnishes, electronically or

otherwise, information relating to an undertaking registered under

these regulations to any other person, neither the Registrar nor any of

his officers or employees who are involved in the supply of such

information shall be liable for any loss or damage suffered by any

person, by reason of any error or omission, of whatever nature or

however caused, if the error or omission is made in good faith and in

the ordinary course of the discharge of the duties of the Registrar or

officer or employee, or has occurred or arisen as a result of any defect

or breakdown in the service or in any of the equipment used for the

service.

Any person or public sector entity aggrieved by the

decision of the Regulator under these regulations may appeal to the

Administrative Review Tribunal set up under article 5(1) of the

Administrative Justice Act.

Any person who contravenes any of the provisions of

these regulations shall be guilty of an offence and shall, on conviction,

be liable to such penalties as may be prescribed.

Where an infringement of any provision of these

regulations is committed by a body corporate and is proved to have

been committed with the consent or involvement of, or to be

attributable to any gross negligence on the part of, a person being a

director, manager, secretary or other officer howsoever described of

the body corporate or a person who was purporting to act in any such

capacity, that person, as well as the body corporate, shall be liable to

be proceeded against and liable to punishment as if he was responsible

for the said infringement.

Schedule 1

[(Regulations 3(1), 6(3) and 11(1)(a)]

Full list of data elements that make up the Business Register and

which are stored and maintained by the Registrar

https://open.data.gov.mt/

search_all.html?id=53042&key=Subordinates

Schedule 2

[(Regulations 5(2), 6(4), 8(1)(a) and 11(1)(b)]

List of data elements from Schedule 1

which are to be made available as open data

https://open.data.gov.mt/

search_all.html?id=53043&key=Subordinates

Schedule 3

[(Regulations 6(3), 9(1) and (2) and 11(1)(c)]

Full list of data elements maintained by any other public sector body

and list of public administration processes with links between a

process and a dataset

https://open.data.gov.mt/

search_all.html?id=53044&key=Subordinates