ENFORCEMENT OF THE RIGHTS OF DATA SUBJECTS IN RELATION TO TRANSFERS OF PERSONAL DATA TO A THIRD COUNTRY OR AN

ENFORCEMENT OF THE RIGHTS OF DATA SUBJECTS

IN RELATION TO TRANSFERS OF PERSONAL DATA TO

A THIRD COUNTRY OR AN INTERNATIONAL

ORGANISATION

SUBSIDIARY LEGISLATION 586.12

ENFORCEMENT OF THE RIGHTS OF DATA

SUBJECTS IN RELATION TO TRANSFERS OF

PERSONAL DATA TO A THIRD COUNTRY OR AN

INTERNATIONAL ORGANISATION REGULATIONS

18th August, 2023

LEGAL NOTICE 204 of 2023.

(1)

The title of these regulations is the Enforcement

of Rights of the Data Subjects in relation to Transfers of Personal Data

to a Third Country or an International Organisation Regulations.

(2)

These regulations implement the Council Implementing

Decision (EU) 2021/914 of 4 June 2021 on standard contractual

clauses for the transfer of personal data to third countries pursuant to

Regulation (EU) 2016/679 of the European Parliament and of the

Council.

(3)

The scope of these regulations is to establish rights in

Maltese law for third party beneficiaries with respect to transfers of

personal data to a third country or an international organisation.

In these regulations, unless the context otherwise

requires

"Act" means the Data Protection Act;

"identifiable natural person" means a person who can be

identified, directly or indirectly, in particular by reference to an

identifier such as a name, an identification number, location

data, an online identifier or to one or more factors specific to

the physical, physiological, genetic, mental, economic, cultural

or social identity of that natural person;

"Minister" means the Minister responsible for data

protection;

"Regulation" means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and

repealing Directive 95/46/EC (General Data Protection

Regulation);

"personal data" means any information relating to an

ENFORCEMENT OF THE RIGHTS OF DATA SUBJECTS

IN RELATION TO TRANSFERS OF PERSONAL DATA TO

A THIRD COUNTRY OR AN INTERNATIONAL

ORGANISATION

identified or identifiable natural person and the said person is

known as "data subject".

Without prejudice to any other remedy available to the

data subject pursuant to the Act and the Regulation, a data subject

whose personal data is transferred by a controller or a processor to a

third country or to an international organisation pursuant to Article 46

of the Regulation shall be entitled to enforce third party beneficiary

rights conferred on data subjects by the instrument concerned, or by

any clauses or rules expressed to be for the benefit of data subjects in

the said instrument.

(1)

The relevant instruments for providing

appropriate safeguards pursuant to Article 46 of the Regulation and

that shall entitle the data subject to third party beneficiary rights, are

(a)

standard data protection clauses adopted by the

European Commission in accordance with the examination

procedure referred to in Article 93(2) of the Regulation; or

(b)

any other instrument granting third party

beneficiary rights to the data subjects which is recognised under

Chapter V of the Regulation as an appropriate safeguard

utilised to regulate the international transfer of personal data.

(2)

Any action by the data subject to enforce rights granted

to him and any clauses expressed to be for the benefit of the data

subject shall be deemed to give rise to an action founded on contract.