Regolamenti dwar Data Governance

DATA GOVERNANCE

LEĠISLAZZJONI SUSSIDJARJA 591.03

REGOLAMENTI DWAR DATA GOVERNANCE

9 ta’ Awwissu, 2024

L-AVVIŻ LEGALI 191 tal-2024.

Dawn ir regolamenti ġew ippubblikati bl-Ilslien Ingliż biss.

(1)

The title of these regulations is the Data

Governance Regulations.

(2)

These regulations implement the requirements of

Regulation (EU) 2022/868 of the European Parliament and of the

Council of 30 May 2022 on European data governance and amending

Regulation (EU) 2018/1724 (Data Governance Act).

(1)

In these regulations, unless the context otherwise

requires

"Act" means the Malta Digital Innovation Authority Act;

"Data Governance Council" means the Data Governance

Council established by virtue of regulation 25 of the

Organisational Structures for Data Sharing and Re-Use

Regulations;

"Malta Digital Innovation Authority" means the Malta

Digital Innovation Authority established by virtue of article 5

of the Malta Digital Innovation Authority Act;

"Regulation (EU) 2022/868" means Regulation (EU)

2022/868 of the European Parliament and of the Council of 30

May 2022 on European data governance and amending

Regulation (EU) 2018/1724 (Data Governance Act).

(2)

Any words and expressions which are not defined in

these regulations shall have the same meaning as assigned to them in

Regulation (EU) 2022/868

Provided that unless the context otherwise requires,

words and phrases used in these regulations, which are not defined in

Regulation (EU) 2022/868 and which are not herein defined, shall

have the same meaning as that assigned to them in the Act.

The Data Governance Council shall be the national

competent body designated for the purpose of carrying out the tasks

referred to in Article 7 of Regulation (EU) 2022/868

Provided that where any other competent body is

designated under national law to carry out tasks referred to in Article 7

of Regulation (EU) 2022/868 in relation to a particular sector, such

other competent body shall be deemed to be the competent body

designated for the purpose of carrying out the tasks referred to in

Article 7 of Regulation (EU) 2022/868 in relation to that particular

sector.

(1)

An appeal shall lie to the Administrative Review

Tribunal established in the Administrative Justice Act from any

decision taken by a competent public sector body in relation to

requests for the re-use of the categories of data referred to in Article

3(1) of Regulation (EU) 2022/868.

(2)

The provisions of the Administrative Justice Act, in so

far as they apply to the Administrative Review Tribunal, shall apply to

any proceedings before the said Tribunal.

(3)

For the purposes of these regulations

(a) the definition "public administration" in the

Administrative Justice Act shall be construed as a reference to

such competent public sector bodies which grant or refuse

access for the re-use of the categories of data referred to in

Article 3(1) of Regulation 2022/868;

(b)

the word "decision" shall have the same meaning

attributed to it in the definition "administrative act" in the

Administrative Justice Act.

(4)

There shall be a right of appeal from decisions of the

Tribunal to the Court of Appeal in accordance with the provisions of

Part IV of the Administrative Justice Act.

For the purposes of Article 8 of Regulation (EU) 2022/

868, the Data Governance Council shall be the body designated as the

single information point.

(1)

For the purposes of Regulation (EU) 2022/868,

the Malta Digital Innovation Authority shall be the national authority

designated as the competent authority for data intermediation services

and for the registration of data altruism organisations and to this end,

shall have all the powers stipulated by Regulation (EU) 2022/868.

(2)

Without prejudice to the provisions of the Act, for the

purpose of monitoring compliance of data intermediation services

providers and recognised data altruism organisations with the

requirements of Regulation (EU) 2022/868, the Malta Digital

Innovation Authority shall have all the powers referred to in Article 14

and 24 of Regulation (EU) 2022/868 respectively.

Natural and legal persons may file a complaint in relation

to any matter falling within the scope of Regulation (EU) 2022/868

individually or, where relevant collectively, with the Malta Digital

Innovation Authority against a data intermediation services provider

or against a recognised data altruism organisation.

The provisions of Part IX of the Act shall apply to

(a)

legally binding decisions referred to in Article 14

of Regulation (EU) 2022/868 in the management, control and

enforcement of the notification regime for data intermediation

services providers;

(b)

legally binding decisions referred to in Articles 19

and 24 of Regulation (EU) 2022/868 for the registration of data

altruism organisations in the monitoring of recognised data

altruism organisations; and

(c) a failure of the Malta

Digital

Innovation

Authority to act on a complaint filed with it in accordance with

regulation 7 of these regulations.

(1)

Articles 42, 43, 44 and Part IX of the Act shall

apply to infringements of the obligations regarding transfers of non-

personal data to third countries pursuant to Article 5(14) and Article

31 of Regulation (EU) 2022/868, the notification obligation of data

intermediation services providers pursuant to Article 11 of Regulation

(EU) 2022/868, the conditions for providing data intermediation

services pursuant to Article 12 of Regulation (EU) 2022/868 and the

conditions for the registration as a recognised data altruism

organisation pursuant to Articles 18, 20, 21 and 22 of Regulation (EU)

2022/868

(2)

Without prejudice to the provisions of the Act, due

regard shall be made to the following non-exhaustive and indicative

criteria for the imposition of administrative penalties on data

intermediation services providers and recognised data altruism

organisations for infringements of the obligations referred to in this

regulation, where appropriate

(a)

the nature, gravity, scale and duration of the

infringement;

(b)

any action taken by the data intermediation

services provider or recognised data altruism organisation to

mitigate or remedy the damage caused by the infringement;

(c)

any previous infringements by the data

intermediation services provider or recognised data altruism

organisation;

(d)

the financial benefits gained or losses avoided by

the data intermediation services provider or recognised data

altruism organisation due to the infringement, insofar as such

benefits or losses can be reliably established;

(e)

any other aggravating or mitigating factors

applicable to the circumstances of the case.

(3)

The Malta Digital Innovation Authority may, at its

discretion, prior to initiating any proceedings in relation to an

infringement of the obligations regarding transfers of non-personal

data to third countries pursuant to Article 5(14) of Regulation (EU)

2022/868 consult with the Data Governance Council and, or any other

relevant person.