PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR REGULATIONS

DATA SHARING WITHIN THE PUBLIC SECTOR

SUBSIDIARY LEGISLATION 546.03

PERSON REGISTER AND PERSONAL DATA

SHARING WITHIN THE PUBLIC SECTOR

REGULATIONS

1st February, 2024

LEGAL NOTICE 439 of 2021, as amended by Legal Notice 262 of

2023.

(1)

The title of these regulations is the Person

Register and Personal Data Sharing within the Public Sector

Regulations.

(2) These regulations shall establish a Person Register and

provide for measures, which are necessary for facilitating personal

data sharing between public sector bodies.

(3) These regulations provide for establishing a core person

details record and authorize links between the core person details

record and other records held in other official registers containing

equivalent personal data in relation to the same person as well as

enable the sharing of personal data within the public sector, under

necessary safeguards.

(4)

These regulations also provide for

(a)

the establishment of a central record containing

personal data to enable the sharing and re-use of data within

the public sector, including the assignment of a unique

machine readable identifier for every natural person whose

details are recorded in an official register through any of the

processes listed in the Fourth Schedule; and

(b)

the establishment of consistent and standard

mechanisms across the public administration to create a single

person view in compliance with the General Data Protection

Regulation.

(5) The provisions of these regulations shall not apply to the

sharing of open data, which is not of a personal nature.

Core person details

The list of data elements is available from the following link

https://open.data.gov.mt/

search_all.html?id=13986&key=Subordinates

In these regulations, unless the context otherwise

requires

"Act" means the Re-Use of Public Sector Information Act;

"Agency" means the Identity Malta Agency established by

article 3 of the Identity Malta Agency (Establishment) Order which

shall be the controller for the purposes of these regulations;

DATA SHARING WITHIN THE PUBLIC SECTOR

"common database" means an existing public sector data

repository containing details of persons derived from civil acts and

other person identity documents;

"controller" shall have the same meaning as in Article 4 of the

General Data Protection Regulation;

"core person record" means the minimum set of person details

as included in the First Schedule;

"Data Governance Council" shall have the same meaning and

functions as in Part XI of the Organisational Structures for Data

Sharing and Re-Use Regulations;

"data owner" shall have the same meaning as assigned to it in

regulation 2 of the Organisational Structures for Data Sharing and Re-

Use Regulations;

"extended person details" means the personal data listed in the

Second Schedule;

"General Data Protection Regulation" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of persons with regard to the processing of

personal data and on the free movement of such data, and repealing

Directive 95/46/EC (General Data Protection Regulation);

"life event" means a process listed in the Fourth Schedule

which may create an entry, or change the core person details listed in

the First Schedule, in any official register;

"official record" shall have the same meaning as assigned to it

in regulation 2 of the Organisational Structures for Data Sharing and

Re-Use Regulations;

"official register" shall have the same meaning as assigned to it

in regulation 2 of the Organisational Structures for Data Sharing and

Re-Use Regulations;

"personal data" shall have the same meaning as assigned to it in

Article 4 of the General Data Protection Regulation;

"person status identifier" means the person status derived from

the applicable law as included in the Third Schedule;

"professional warrant" means an indicator or counter added as

part of the Second Schedule which is derived from the relevant

official registers to recognize a person as the holder of one or more

professional warrants issued by a competent authority in Malta;

DATA SHARING WITHIN THE PUBLIC SECTOR

"public employee" shall have the same meaning as assigned to

it in article 2(1) of the Public Administration Act;

"public sector body" shall have the same meaning as assigned

to it in article 2 of the Act;

"regulatory authority" shall have the same meaning, powers

and functions as established by the Act and by Part III of the

Organisational Structures for Data Sharing and Re-Use Regulations;

"Register" means the Person Register established by regulation

3;

"Registrar" or "Registrar of Persons" means the authorized

official function within the agency which shall be designated as the

administrator in respect of the Register;

"uniform resource identifier" or "URI" shall have the same

meaning as assigned to it in regulation 2 of the Organisational

Structures for Data Sharing and Re-Use Regulations; and

"user" shall have the same meaning as assigned to it in

regulation 2 of the Organisational Structures for Data Sharing and

Re-Use Regulations.

Part I

CdB person details

DATA SHARING WITHIN THE PUBLIC SECTOR

The list of data elements is available from the following link

https://open.data.gov.mt/search_all.html?id=5962&key=Subordinates

Part II

Extended Person Details

The list of data elements is available from the following link

https://open.data.gov.mt/

search_all.html?id=52775&key=Subordinates

The data elements marked with a (Art. 8) suffix shall be stored

and provided only if explicit consent is given by the person concerned

in accordance with the provisions of regulation 8 and the General Data

Protection Regulation. The data subject shall be responsible for the

veracity and completeness of these details all times.

Part III

Derived Person Details

The list of data elements is available from the following link

https://open.data.gov.mt/

search_all.html?id=36800&key=Subordinates

(1)

There shall be established a Person Register to

be kept by the Agency which shall contain therein the core person

record and, where applicable, the extended person details.

(2) The Agency shall maintain the quality and accuracy of

the personal data within the Register in so far as the personal data

falls within the remit of the Agency and shall ensure that access to the

Register is limited to categories of personal data, listed in the Fifth

Schedule, as required for each public sector body to fulfil their

obligations under these regulations. In so doing, the Agency shall use

appropriate security safeguards and role-based access control

mechanisms to ensure that each public sector body shall only have

access to the personal data that is strictly required to facilitate the

sharing of personal data under the Act.

(3) Pursuant to the provisions of sub-regulation (2), the

public sector body shall be responsible for the manner in which the

data from the Register is used within such public sector body and for

the authorisations of users from within the public sector body.

(4) In line with its functions under sub-regulation (1), the

Agency shall conduct, where necessary, a data protection impact

assessment and publish guidelines for the transfer of core person data

from the Register to other official registers.

(5) The source for the initial loading of the records in the

Register shall be derived from the existing records stored in the

DATA SHARING WITHIN THE PUBLIC SECTOR

Common Database.

(6) New person records or changes to existing details in

respect of the core person record by the processes included in the

Fourth Schedule shall be verified and certified in terms of

completeness and correctness. Such verification shall be done by the

data owner responsible for the process authorized to generate such

changes and before such details can be accepted to form part of the

Register by the Registrar.

(7) Pending the verification and certification of such data,

which shall be completed within the shortest time possible but not

later than thirty (30) days, the new details shall remain suspended and

shall be visible only to the data owner of the originating process and

the Registrar

Provided that all records which remain suspended in

excess of the first thirty (30) days shall be reported to the Data

Governance Council for a decision

Provided further that if the status remains unchanged for

more than thirty (30) days following the first escalation process, the

matter shall be reported to the regulatory authority for a final decision

and the required direction or order as applicable.

(8) The certification through a digital marker including the

details of the public officer attesting to the completion of the

verification process as described in sub-regulation (6) shall be stored

as part of the pertinent person record which shall then become an

official record forming an integral part of the Register.

Part I

Person status headings and values of person details held in the First

and Second Schedules

1. Death indicator

Burial Status

2. Gender Identity

3. Marital Status

4. Sex (physical body characteristics) marker

Part II

Person status headings and values of person records

held only in other official registers

DATA SHARING WITHIN THE PUBLIC SECTOR

1. Contracting Status

(a)

contracting capacity

(b)

non-contracting state

2. Residency status

(a)

alien (non-Maltese person)

(b)

Maltese citizen

In order to be able to fulfil their obligations under these

regulations, public sector bodies shall use automated mechanisms and

standards.

Life events

The list of life events (contributing processes) is available

from the following link

https://open.data.gov.mt/

search_all.html?id=36650&key=Subordinates

(1)

A public sector body responsible for an official

register shall ensure transparency in its processes by establishing a

record version control mechanism through which each change to the

record details shall be retained and kept distinct but linked to an

identifiable record, with timestamps indicating the start and end of

each version of the record that is kept.

(2) The public sector body responsible for an official register

subject to an obligation to link shall also enable the recording of

additional information to be stored and used in regard to the

processing referred to in sub-regulation (1). Where an entry in the

person record is created or changed, the user and his authorized role

for such process and other relevant information to enable a full audit

trail of changes applied to official records shall be recorded

Provided

that

version

control

records

containing

DATA SHARING WITHIN THE PUBLIC SECTOR

identifiable details of persons or associated to person identifiable

data, shall be deleted after the expiry of the retention period as

established for the pertinent person record.

Categories of person views (datasets) to be provided from the

Person Register. The following categories of data shall be provided as

required to deliver public services, if justified in accordance with

these regulations, and may be found from the following link

https://open.data.gov.mt/

search_all.html?id=36651&key=Subordinateshttps://

open.data.gov.mt/search_all.html?id=36651&key=Subordinates

(1)

Personal data concerning the status headings

listed in the Third Schedule shall only be accessed following

approval pursuant to sub-regulation (3) given by the public sector

body responsible for such data

Provided that the information referred to in this sub-

regulation shall be derived upon a request received from a public

sector body who is the owner of a process or service and made

available through the specific person view and the related process as

authorized by the relevant public sector body responsible for such

data, and published in the Fifth and Sixth Schedules respectively

Provided further that the public sector body responsible

for an official register shall establish a mechanism that ensures that

such person status information is not visible or accessible to the

administrators of the Person Register as created by regulation 3.

(2) (a)

Pursuant to the provisions of sub-regulation

(1), any permission enabling a role to use a specific person view as

included in the Fifth Schedule in the context of a specific public

administration process shall be published under the Sixth Schedule.

(b)

Any request for the publication of new data

access permissions shall be addressed to the head of the public sector

body who is the recognised data owner responsible for the relevant

official register, or his delegate, in writing or by using the provided

digital platform.

(3) The public sector body responsible for an official

register shall ensure that permissions are designed in accordance with

the principles of data minimization and purpose limitation and shall

only authorise access to their official register after having evaluated

the legal basis for the processing of such data, and after being

satisfied that such processing meets any of the legal criteria as

established in Article 6 of the General Data Protection Regulation.

Such access shall be based on defined public administration roles,

with public administration processes linked to a specific public

administration role for data access authorisation purposes

Provided that a record of the request and granting of

such permission shall be kept, and that such permission shall be

immediately revoked when no longer required.

(4) The public sector body responsible for an official

register shall also establish adequate technical measures to enable the

publication and maintenance of the roles and permissions referred to

in sub-regulation (3) in a digital and machine-readable format and to

DATA SHARING WITHIN THE PUBLIC SECTOR

provide for the request process for new permissions to add or delete

roles and processes.

(5) Any permission under sub-regulation (3) shall be

authorised by the public sector body responsible for the official

register in accordance with the law under which the official register is

established

Provided that the permissions referred to in this

regulation shall be made visible immediately through the appropriate

web enabled forms of the national open data portal.

Person views (Datasets) as authorized to processes and public

services. The details pertinent to this Schedule may be found on the

DATA SHARING WITHIN THE PUBLIC SECTOR

following link

https://open.data.gov.mt/

search_all.html?id=36652&key=Subordinates

(1)

Public sector bodies responsible for official

registers, found in the Register of Registers and containing personal

data, shall link the personal data to the core person details referred to

in the First Schedule in order to establish a connection between the

locally stored records and the centrally maintained person identifier

Provided that the links established between official

registers enabling interoperability and sharing of data shall remain

under the control and full visibility of the source data owner and

access to such data shall only be permitted as described under

regulation 6

Provided further that the source data owner shall create a

core data person in the First Schedule, only when the links are

established in accordance with the Fourth Schedule.

(2) The public sector body responsible for an official register

holding personal data shall be obliged to provide data to other

registers if and as permitted by law and in accordance with the law

regulating the official register concerned and in line with the links

established under the Sixth Schedule.

(1)

Nothing in these regulations shall prejudice the

application of the General Data Protection Regulation and the Data

Protection Act.

(2)

The Agency and public sector bodies shall ensure that

data protection principles, including purpose limitation, data

minimisation, limited storage periods and measures to ensure personal

data security are applied.

(3)

Any public sector body responsible for official registers

holding personal data may, following the verification of the identity of

the data subject, provide or use a digital platform through which the

data subject may exercise control over his personal data; in doing so,

the public sector body shall also facilitate the data subject to give and,

or to withdraw his consent for any processing of his personal data

where applicable, in particular the data elements in the first part of the

Second Schedule in a transparent and easy manner.

DATA SHARING WITHIN THE PUBLIC SECTOR

The digital platform provided or used may also be used

to enable the data subject to access and view records which contain

personal details making reference to his identity.

(4)

The extended person details as stored in the first part of

the Second Schedule shall be verified by the Agency to ensure its

accuracy and correctness and shall only be declared as an official

record after such verification is confirmed by the Registrar and the

verification information is digitally added to the record details. Such

records as stored in the First and Second Schedule shall also be made

visible and accessible to the data subject upon request.

(5)

The person details as included in First Schedule and in

Parts I and II of the Second Schedule may be used by official

government processes to enable the automatic filling of the relevant

details for the purpose of not requesting information from the data

subject which is already held by the public administration

Provided that the relevant details to be auto-filled are as

strictly necessary and in line with the legal obligations emanating

from the process.

A transitory period of forty-eight (48) months from the

date of the coming into force of these regulations shall be allowed for

public sector bodies responsible for official registers which hold

personal data to develop and establish the required mechanisms to

fulfil the obligations under these regulations and to continue to

maintain the link between the person record as represented in the

official register and the centrally stored person record as maintained

in the Register in accordance with the First Schedule.