RESTRICTION OF THE DATA PROTECTION (OBLIGATIONS AND RIGHTS) REGULATIONS (obligationsandrights)

RESTRICTION OF THE DATA PROTECTION

(OBLIGATIONS AND RIGHTS)

SUBSIDIARY LEGISLATION 586.09

RESTRICTION OF THE DATA PROTECTION

(OBLIGATIONS AND RIGHTS) REGULATIONS

1st June, 2018

LEGAL NOTICE 177 of 2018.

The title of these regulations is the Restriction of the

Data Protection (Obligations and Rights) Regulations.

In these regulations, unless the context otherwise

requires

"Act" means the Data Protection Act;

"Commissioner" shall have the same meaning as is assigned to

it in article 3 of the Act; and

"Regulation" means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and repealing

Directive 95/46/EC.

The scope and purpose of these regulations is to apply

restrictions to certain obligations and rights provided for in Article 23

of the Regulation.

Any restriction to the rights of the data subject referred

to in Article 23 of the Regulation shall only apply where such

restrictions are a necessary measure required

(a)

for the safeguarding and maintaining of

national security, public security, defence and the international

relations of Malta;

(b)

for the prevention, detection, investigation and

prosecution of criminal offences, including measures to

combat any money laundering activity, and the execution of

criminal penalties;

(c)

for the administration of any tax, duty, fines,

fees or other money due or owing to the State, under the

Income Tax Act, the Income Tax Management Act, the Value

Added Tax Act, the Customs Ordinance, the Excise Duty Act

and the Fees Ordinance, and any other law allowing for

generating revenue in any manner for the Government of

Malta;

RESTRICTION OF THE DATA PROTECTION

(OBLIGATIONS AND RIGHTS)

(d)

for the administration of social security benefits

in accordance with the Social Security Act and where such data

has been obtained in confidence when carrying out an

investigation against fraud;

(e)

for the establishment, exercise or defence of a

legal claim and for legal proceedings which may be instituted

under any law;

(f)

for the performance of the functions of the

Commissioner;

(g)

for the delivery of professional services in

relation to the carrying out of social work or social assistance

by a public authority, public body, a voluntary organisation or

any other body delivering such services, and provided that such

data shall have been obtained in confidence specifically for the

purposes of delivering these services to the beneficiary;

(h)

for health data that is processed and where it

would be likely that the application of the rights and

obligations referred to in article 5(1) of the Act would cause

serious harm to the vital interests of the patient; or

(i)

for matters relating to Maltese citizenship

where the Minister responsible for citizenship or any person

authorised to act on his behalf, refuses an application for the

acquisition of Maltese citizenship under the Maltese

Citizenship Act.

(1)

Personal data that is subject to a restriction

referred to in regulation 4 shall not be subject to processing that is

incompatible with the purposes for which such data was collected,

unless provided for by law or with the explicit consent of the data

subject.

(2) The data controller shall, pursuant to Article 32 of the

Regulation, implement appropriate technical and organisational

measures to protect personal data processed pursuant to these

regulations against accidental destruction or loss or unlawful forms of

processing.

(3) The retention period to be applied for personal data that

are processed pursuant to these regulations, shall not be longer than

what is necessary for the purpose of the processing of such personal

data or shall not be longer than the period required to achieve the aim

of the restriction, or as provided by law.

The data controller shall inform the data subject about

any restriction provided for under these regulations

RESTRICTION OF THE DATA PROTECTION

(OBLIGATIONS AND RIGHTS)

Provided that such a disclosure will not be prejudicial to

the purposes of the restriction applied pursuant to these regulations.

Any restriction applied under these regulations shall

respect the essence of the fundamental rights and freedoms of the

data subject and shall be a necessary and proportionate measure.