1. Relevant Legislation and Competent Authorities

1.1 What is the principal data protection legislation?

From 25 May 2018, the principal data protection legislation in the EU will be Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR"). The GDPR repeals Directive 95/46/EC (the "Data Protection Directive") and leads to increased (though not total) harmonisation of data protection law across the EU Member States.

The provisions of the GDPR will be transposed directly into Data Protection Act ("DPA"), Chapter 440 of the Laws of Malta.

1.2 Is there any other general legislation that impacts data protection?

General legislation which currently impacts data protection includes:

  • Notification and Fees (Data Protection Act) Regulations (Subsidiary Legislation 440.02).
  • Third Country (Data Protection Act) Regulations (Subsidiary Legislation 440.03).
  • Processing of Personal Data (Protection of Minors) Regulations (Subsidiary Legislation 440.04).
  • Transfer of Personal Data to Third Countries Order (S.L. 440.07).

1.3 Is there any sector-specific legislation that impacts data protection?

Current sector-specific legislation relating to data protection includes:

  • Processing of Personal Data Electronic Communications Sector) Regulations (Subsidiary Legislation 440.01).
  • Data Protection (Processing of Personal Data in the Police Sector) Regulations (Subsidiary Legislation 440.05).
  • Processing of Personal Data (Police and Judicial Cooperation in Criminal Matters) Regulations (Subsidiary Legislation 440.06).
  • Processing of Personal Data for the purposes of the General Elections Act and the Local Councils Act Regulations (Subsidiary Legislation 440.08).
  • Processing of Personal Data (Education Sector) Regulations (Subsidiary Legislation 440.09).

Please note that these may be amended and/or repealed upon entry into force of the GDPR.

1.4 What authority(ies) are responsible for data protection?

The relevant data protection regulatory authority is the Information and Data Protection Commissioner ("IDPC").

2. Definitions

2.1 Please provide the key definitions used in the relevant legislation:

The definitions contained in the GDPR are expected to be adopted in the DPA and therefore, the following definitions are expected to appear in the DPA upon entry into force of the GDPR:

  • "Personal Data"means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • "Processing"means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • "Controller"means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • "Processor"means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
  • "Data Subject" means an individual who is the subject of the relevant personal data.
  • "Sensitive Personal Data" / "Special categories of data" are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, data concerning health or sex life and sexual orientation, genetic data or biometric data.
  • "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

3. Territorial Scope

3.1 Do the data protection laws apply to businesses established in other jurisdictions? If so, in what circumstances would a business established in another jurisdiction be subject to those laws?

Maltese laws will not apply to businesses established in other Member States. However, where a business established outside the EU is processing data relating to individuals habitually resident in Malta, in accordance with the GDPR, these may be regulated by the Maltese data protection laws and fall under scrutiny of the IDPC.

The GDPR applies to businesses that are established in any EU Member State, and that process personal data (either as a controller or processor, and regardless of whether or not the processing takes place in the EU) in the context of that establishment.

A business that is not established in any Member State, but is subject to the laws of a Member State by virtue of public international law is also subject to the GDPR.

The GDPR applies to businesses outside the EU if they (either as controller or processor) process the personal data of EU residents in relation to: (i) the offering of goods or services (whether or not in return for payment) to EU residents; or (ii) the monitoring of the behaviour of EU residents (to the extent that such behaviour takes place in the EU).

Further, the GDPR applies to businesses established outside the EU if they monitor the behaviour of EU residents (to the extent such behaviour takes place in the EU).

4. Key Principles

4.1 What are the key principles that apply to the processing of personal data?

  • Transparency

    Personal data must be processed lawfully, fairly and in a transparent manner. Controllers must provide certain minimum information to data subjects regarding the collection and further processing of their personal data. Such information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
  • Lawful basis for processing

    Processing of personal data is lawful only if, and to the extent that, it is permitted under EU data protection law. The GDPR provides an exhaustive list of legal bases on which personal data may be processed, of which the following are the most relevant for businesses: (i) prior, freely given, specific, informed and unambiguous consent of the data subject; (ii) contractual necessity (i.e., the processing is necessary for the performance of a contract to which the data subject is a party, or for the purposes of pre-contractual measures taken at the data subject's request); (iii) compliance with legal obligations (i.e., the controller has a legal obligation, under the laws of the EU or an EU Member State, to perform the relevant processing); or (iv) legitimate interests (i.e., the processing is necessary for the purposes of legitimate interests pursued by the controller, except where the controller's interest are overridden by the interests, fundamental rights or freedoms of the affected data subjects).

    Businesses require stronger grounds to process sensitive personal data (special categories of data). The processing of sensitive personal data is only permitted under certain conditions, of which the most relevant for businesses are: (i) explicit consent of the affected data subject; (ii) the processing is necessary in the context of employment law; (iii) the processing is in the vital interest of the data subject or third parties where the data subject is incapable of providing consent; (iv) the data has been publicly revealed by the data subject; or (v) the processing is necessary for the establishment, exercise or defence of legal claims.
  • Purpose limitation

    Personal data may only be collected for specified, explicit and legitimate purposes and must not be further processed in a manner that is incompatible with those purposes. If a controller wishes to use the relevant personal data in a manner that is incompatible with the purposes for which they were initially collected, it must: (i) inform the data subject of such new processing; and (ii) be able to rely on a lawful basis as set out above.
  • Data minimisation

    Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which the data is processed. A business should only process the personal data that it actually needs to process in order to achieve its processing purposes.
  • Accuracy

    Personal data must be accurate and, where necessary, kept up to date. A business must take every reasonable step to ensure that personal data that is inaccurate is either erased or rectified without delay.
  • Retention

    Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
  • Data security

    Personal data must be processed in a manner that ensures appropriate security of that data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
  • Accountability

    The controller is responsible for, and must be able to demonstrate, compliance with the data protection principles set out above.

5. Individual Rights

5.1 What are the key rights that individuals have in relation to the processing of their personal data?

  • Right of access to data/copies of data

    A data subject has the right to obtain from a controller the following information in respect of the data subject's personal data: (i) confirmation of whether, and where, the controller is processing the data subject's personal data; (ii) information about the purposes for which the data is being processed; (iii) information about the categories of data being processed; (iv) information about the categories of recipients with whom the data may be shared; (v) information about the period for which the data will be stored (or the criteria used to determine that period); (vi) information about the existence of the rights to erasure, to rectification, to restriction of processing and to object to processing; (vii) information about the existence of the right to complain to the relevant data protection authority; (viii) where the data was not collected from the data subject, information as to the source of the data; and (ix) information about the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on the data subject.

    Additionally, the data subject may request a copy of the personal data being processed.
  • Right to rectification of errors

    Controllers must ensure that inaccurate or incomplete data is erased or rectified. Data subjects have the right to rectification of inaccurate personal data.
  • Right to deletion/right to be forgotten

    Data subjects have the right to erasure of their personal data (the "right to be forgotten") if: (i) the data is no longer needed for the original purpose (and no new lawful purpose exists); (ii) in the event that the lawful basis for the processing is the data subject's consent, the data subject withdraws that consent, and no other lawful ground exists; (iii) the data subject exercises the right to object, and the controller has no overriding grounds for continuing the processing; (iv) the data has been processed unlawfully; or (v) erasure is necessary for compliance with EU law or national data protection law. This right is however limited in the cases expressly mentioned in Article 17(3) of the GDPR which are related, in the main, to public interest, the freedom of expression and information, legal obligations imposed on the controller to process the data, the exercising of official authority vested in the controller and the establishment, exercise or defence of legal claims.
  • Right to object to processing

    Data subjects have the right to object, on grounds relating to their particular situation, to the processing of personal data where the basis for that processing is either public interest or legitimate interest of the controller. The controller must cease such processing unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the relevant data subject or requires the data in order to establish, exercise or defend legal rights.
  • Right to restrict processing

    Data subjects have the right to restrict the processing of personal data, which means that the data may only be held by the controller, and may only be used for limited purposes if: (i) the accuracy of the data is contested (and only for as long as it takes to verify that accuracy); (ii) the processing is unlawful and the data subject requests restriction (as opposed to exercising the right to erasure); (iii) the controller no longer needs the data for the original purpose, but the data is still required by the controller to establish, exercise or defend legal rights; or (iv) verification of overriding grounds is pending, in the context of an erasure request.
  • Right to data portability

    Data subjects have a right to receive a copy of their personal data in a commonly used machine-readable format, and transfer their personal data from one controller to another or have the data transmitted directly between controllers.
  • Right to withdraw consent

    A data subject has the right to withdraw his consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject must be informed of the right to withdraw consent. It must be as easy to withdraw consent as to give it.
  • Right to object to marketing

    Data subjects have the right to object to the processing of personal data for the purpose of direct marketing, including profiling.
  • Right to complain to the relevant data protection authority(ies)

    Data subjects have the right to lodge complaints concerning the processing of their personal data with the IDPC, if the data subjects live in Malta or the alleged infringement occurred in Malta.
  • Right to basic information

    Data subjects have the right to be provided with information on the identity of the controller, the reasons for processing their personal data and other relevant information necessary to ensure the fair and transparent processing of personal data.

6. Registration Formalities and Prior Approval

6.1 Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities?

Currently, article 29 of the DPA provides that the controller shall notify the IDPC before carrying out any wholly or partially automated or manual processing operation. The IDPC shall maintain a register of processing obligations so notified. Notification is also required where there is a change in the processing activities that a controller conducts.

In accordance with the Third Country (Data Protection) Regulations (Subsidiary Legislation 440.03), data controllers must also notify the Commission prior to transferring personal data to a third country and obtain authorisation.

Other notification requirements include:

(a) notification by the data controller to the IDPC on the appointment or removal of a data representative ("PDR"); and

(b) notification by the data controller to the IDPC where the processing of personal data involves particular risks of improper interference with the rights and freedoms of the data subject.

The above notification obligations will no longer be applicable once the GDPR comes into force. This said, in accordance with the GDPR, the IDPC will need to be notified of the appointment of a Data Protection Officer (DPO) wherever this is required by the law. Other instances where the IDPC may need to be informed of data processing activities include those where the activities are deemed to be of high risk and not easily mitigated through technological means, as well as where third-country transfers are to rely on binding corporate rules.

6.2 If such registration/notification is needed, must it be specific (e.g., listing all processing activities, categories of data, etc.) or can it be general (e.g., providing a broad description of the relevant processing activities)?

The notification to the IDPC, currently in place as referred to above, must specify:

(a) the name and address of the data controller and of any other person authorised by him in that regard, where applicable;

(b) the purpose(s) of the processing;

(c) a description of the category or categories of data subject and of the data or categories of data relating to them;

(d) the recipients or categories of recipients to whom the data might be disclosed;

(e) proposed transfers of data to third countries; and

(f) a general description allowing a preliminary assessment to be made of the adequacy of the measures taken to ensure the security of processing.

6.3 On what basis are registrations/notifications made (e.g., per legal entity, per processing purpose, per data category, per system or database)?

Notifications are made per legal entity.

6.4 Who must register with/notify the data protection authority (e.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation)?

As the law currently stands, every controller of data must notify the IDPC where the DPA is applicable to them, e.g., where the controller is established in a third country but the equipment used for the processing of personal data is situated in Malta, a person established in Malta must be appointed to act as representative. In such a case, this representative is subject to the requirement of notification.

6.5 What information must be included in the registration/notification (e.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes)?

The notification to the IDPC referred to above must specify:

(a) the name and address of the data controller and of any other person authorised by him in that regard, where applicable;

(b) the purpose(s) of the processing;

(c) a description of the category or categories of data subject and of the data or categories of data relating to them;

(d) the recipients or categories of recipients to whom the data might be disclosed;

(e) proposed transfers of data to third countries; and

(f) a general description allowing a preliminary assessment to be made of the adequacy of the measures taken to ensure the security of processing.

6.6 What are the sanctions for failure to register/notify where required?

Currently, the failure to notify the IDPC of a processing operation prior to its commencement is punishable by an administrative fine of not less than €120 but not more than €600, and a daily fine of not less than €20 but not more than €60.

The failure to notify the IDPC of a processing obligation that involves risks of improper interference with the rights and freedoms of the data subject is subject to a fine of between €250 and €2,500 and a daily fine ranging from €25 to €250.

The failure to notify the IDPC of transfers of personal data to a third country is liable to an administrative fine not exceeding €23,293.73 for each violation and €2,329.37 for each day during which the violation persists.

This may change once the GDPR enters into force; however, guidance from the IDPC in this respect has not yet been made available.

6.7 What is the fee per registration/notification (if applicable)?

Currently, a fee of €23.29 is payable upon the lodging of a notification in respect of the commencement of processing activities. In certain cases, there is an exemption from the payment of the fee. Upon entry into force of the GDPR, this will no longer be payable.

6.8 How frequently must registrations/notifications be renewed (if applicable)?

Annually. Upon entry into force of the GDPR, this will no longer be applicable.

6.9 Is any prior approval required from the data protection regulator?

Currently, prior approval from the IDPC is required for the processing of sensitive personal data for research and statistics purposes.

Approval is also required in the case of transfers of data to third countries.

6.10 Can the registration/notification be completed online?

No, registration/notification cannot be completed online.

6.11 Is there a publicly available list of completed registrations/notifications?

Yes, however, one must physically attend the office of the IDPC or, alternatively send an email request for a registration form in respect of a particular entity.

6.12 How long does a typical registration/notification process take?

Registration/notification usually takes two to three working days.

7. Appointment of a Data Protection Officer

7.1 Is the appointment of a Data Protection Officer mandatory or optional? If the appointment of a Data Protection Officer is only mandatory in some circumstances, please identify those circumstances.

The appointment of a Data Protection Officer for controllers or processors is only mandatory in some circumstances including where there is: (i) large-scale regular and systematic monitoring of individuals; or (ii) large-scale processing of sensitive personal data.

7.2 What are the sanctions for failing to appoint a Data Protection Officer where required?

In the circumstances where appointment of a Data Protection Officer is mandatory, failure to comply may result in the wide range of penalties available under the GDPR.

7.3 Is the Data Protection Officer protected from disciplinary measures, or other employment consequences, in respect to his or her role as a Data Protection Officer?

The appointed Data Protection Officer should not be dismissed or penalised for performing their tasks and should report directly to the highest management level of the controller or processor.

7.4 Can a business appoint a single Data Protection Officer to cover multiple entities?

A single Data Protection Officer is permitted by a group of undertakings provided that the Data Protection Officer is easily accessible from each establishment.

7.5 Please describe any specific qualifications for the Data Protection Officer required by law.

The Data Protection Officer should be appointed on the basis of professional qualities and should have an expert knowledge of data protection law and practices. While this is not strictly defined, it is clear that the level of expertise required will depend on the circumstances. For example, the involvement of large volumes of sensitive personal data will require a higher level of knowledge.

7.6 What are the responsibilities of the Data Protection Officer as required by law or best practice?

A Data Protection Officer should be involved in all issues which relate to the protection of personal data. The GDPR outlines the minimum tasks required by the Data Protection Officer which include: (i) informing the controller, processor and their relevant employees who process data of their obligations under the GDPR; (ii) monitoring compliance with the GDPR, national data protection legislation and internal policies in relation to the processing of personal data including internal audits; (iii) advising on data protection impact assessments ("DPIAs") and the training of staff; and (iv) co-operating with the data protection authority and acting as the authority's primary contact point for issues related to data processing.

7.7 Must the appointment of a Data Protection Officer be registered/notified to the relevant data protection authority(ies)?

Yes, the controller or processor must notify the data protection authority of the contact details of the designated Data Protection Officer.

7.8 Must the Data Protection Officer be named in a public-facing privacy notice or equivalent document?

The details of the Data Protection Officer must be published although not necessarily named in the public-facing privacy notice. However, the contact details of the Data Protection Officer must be notified to the data subject when personal data relating to that data subject are collected. As a matter of good practice, the Article 29 Working Party (the "WP29") recommends that both the data protection authority and employees should be notified of the name and contact details of the Data Protection Officer.

8. Appointment of Processors

8.1 If a business appoints a processor to process personal data on its behalf, must the business enter into any form of agreement with that processor?

Yes. The business that appoints a processor to process personal data on its behalf is required to enter into an agreement with the processor which sets out the subject matter for processing, the duration of processing, the nature and purpose of processing and the obligations and rights of the controller (i.e., the business).

It is essential that the processor appointed by the business complies with the GDPR.

8.2 If it is necessary to enter into an agreement, what are the formalities of that agreement (e.g., in writing, signed, etc.) and what issues must it address (e.g., only processing personal data in accordance with relevant instructions, keeping personal data secure, etc.)?

The processor must be appointed under a binding agreement in writing. The contractual terms must stipulate that the processor: (i) only acts on the documented instructions of the controller; (ii) imposes confidentiality obligations on all employees; (iii) ensures the security of personal data that it processes; (iv) abides by the obligations imposed on the controller in relation to the appointment of processors when, in turn, appointing sub-processors; (v) implements measures to assist the controller with guaranteeing the rights of data subjects; (vi) assists the controller in obtaining approval from the Data Protection Officer; (vii) either returns or destroys the personal data at the end of the relationship (except as required by EU or Member State law); and (viii) provides the controller with all information necessary to demonstrate compliance with the GDPR.

9. Marketing

9.1 Please describe any legislative restrictions on the sending of electronic direct marketing. (e.g., for marketing by email or SMS, is there a requirement to obtain prior opt-in consent of the recipient?)

The controller must inform the data subject of his right to object at no cost to the processing of his personal data for direct marketing purposes.

9.2 Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.).

With respect to other means of marketing including unsolicited communications by automated calling machines, fax or email, the subscriber (both a natural or legal person) must give their prior consent to their personal data being used for direct marketing purposes. If email contact details were given by the subscriber in relation to the sale of a product or service, these may be used for direct marketing; however, customers must be given the opportunity to object free of charge and in an easy manner to such use of their details at the time of their collection, as well as on each message sent to the customer.

Direct marketing carried out through any other means of communication requires a free means to opt out of such communications.

9.3 Do the restrictions noted above apply to marketing sent from other jurisdictions?

Yes, they do.

9.4 Is/are the relevant data protection authority(ies) active in enforcement of breaches of marketing restrictions?

Yes, the IDPC has dealt with cases involving breaches of marketing restrictions.

9.5 Is it lawful to purchase marketing lists from third parties? If so, are there any best practice recommendations on using such lists?

Yes, it is lawful; however, the entity making such marketing lists available should inform the data subject, on obtainment of consent to process personal data, that the list may be sold to third parties for the purposes of such third parties sending marketing communications and having the data subject signify specific consent in this respect.

Where the marketing list has been purchased, the purchaser should, when sending out marketing communications, indicate where the personal details where obtained from, together with the other information listed in article 14 of the GDPR.

9.6 What are the maximum penalties for sending marketing communications in breach of applicable restrictions?

Currently, the sending of marketing communications over automated calling machine, fax or email in breach of applicable restrictions is punishable by an administrative fine not exceeding €23,293.73 for each violation and €2,329.37 for each day during which such violation persists.

10. Cookies

10.1 Please describe any legislative restrictions on the use of cookies (or similar technologies).

Currently, Malta implements Article 5 of the ePrivacy Directive. Pursuant to Article 5 of the EU ePrivacy Directive, the storage of cookies (or other data) on an end user's device requires prior consent (the applicable standard of consent is derived from Directive 95/46/EC and, from 25 May 2018, the GDPR). For consent to be valid, it must be informed, specific, freely given and must constitute a real indication of the individual's wishes. This does not apply if: (i) the cookie is for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (ii) the cookie is strictly necessary to provide an "information society service" (e.g., a service over the internet) requested by the subscriber or user, which means that it must be essential to fulfil their request.

10.2 The EU Commission intends to pass a new ePrivacy Regulation that will replace the respective national legislation in the EU Member States. The regulation is planned to come into force May 25, 2018 and will provide amended requirements for the usage of cookies. Do the applicable restrictions (if any) distinguish between different types of cookies? If so, what are the relevant factors?

Currently, there is no distinction as regards different types of cookies.

10.3 To date, has/have the relevant data protection authority(ies) taken any enforcement action in relation to cookies?

To our knowledge, the IDPC has not taken any enforcement action in relation to cookies as yet.

10.4 What are the maximum penalties for breaches of applicable cookie restrictions?

Currently, breaches of applicable cookie restrictions are punishable by an administrative fine not exceeding €23,293.73 for each violation and €2,329.37 for each day during which such violation persists.

11. Restrictions on International Data Transfers

11.1 Please describe any restrictions on the transfer of personal data to other jurisdictions.

Data transfers to other jurisdictions that are not within the European Economic Area (the "EEA") can only take place if the transfer is to an "Adequate Jurisdiction" (as specified by the EU Commission) or the business has implemented one of the required safeguards as specified by the GDPR.

11.2 Please describe the mechanisms companies typically utilise to transfer personal data abroad in compliance with applicable transfer restrictions (e.g., consent of the data subject, performance of a contract with the data subject, approved contractual clauses, compliance with legal obligations, etc.).

When transferring personal data to a country other than an Adequate Jurisdiction, businesses must ensure that there are appropriate safeguards on the data transfer, as prescribed by the GDPR. The GDPR offers a number of ways to ensure compliance for international data transfers, of which one is consent of the relevant data subject. Other common options are the use of Standard Contractual Clauses or Binding Corporate Rules ("BCRs").

Businesses can adopt the Standard Contractual Clauses drafted by the EU Commission – these are available for transfers between controllers, and transfers between a controller (as data exporter) and a processor (as data importer). International data transfers may also take place on the basis of contracts agreed between the data exporter and data importer provided that they conform to the protections outlined in the GDPR, and they have prior approval by the relevant data protection authority.

International data transfers within a group of businesses can be safeguarded by the implementation of BCRs. The BCRs will always need approval from the relevant data protection authority. Most importantly, the BCRs will need to include a mechanism to ensure they are legally binding and enforced by every member in the group of businesses. Among other things, the BCRs must set out the group structure of the businesses, the proposed data transfers and their purpose, the rights of data subjects, the mechanisms that will be implemented to ensure compliance with the GDPR and the relevant complainant procedures.

Transfer of personal data to the US is also possible if the data importer has signed up to the EU-US Privacy Shield Framework, which was designed by the US Department of Commerce and the EU Commission to provide businesses in the EU and the US with a mechanism to comply with data protection requirements when transferring personal data from the EU to the US.

11.3 Do transfers of personal data to other jurisdictions require registration/notification or prior approval from the relevant data protection authority(ies)? Please describe which types of transfers require approval or notification, what those steps involve, and how long they typically take.

Currently, transfers of data to third countries require approval from the Commissioner who determines whether the country ensures an adequate level of protection. This must be notified to the IDPC by means of the following International Data Transfer form: http://idpc.gov.mt/en/Documents/International%20Data%20Transfer%20Form.pdf.

If the data is transferred to a third country which does not ensure an adequate level of protection on any of the grounds contained in Article 28(2) of the DPA (outlined in the answer to question 8.1 above), such a transfer must also be authorised to the IDPC.

As regards Standard Contractual Clauses and Binding Corporate Rules, these must also be submitted to the IDPC for review.

There are no time limits established for these approval or notification procedures, however, they do not usually exceed one week.

Upon entry into force of the GDPR, it is likely that the international data transfer will require prior approval from the relevant data protection authority unless they have already established a GDPR-compliant mechanism as set out above for such transfers.

In any case, most of the safeguards outlined in the GDPR will need initial approval from the data protection authority, such as the establishment of BCRs.

12. Whistle-blower Hotlines

12.1 What is the permitted scope of corporate whistle-blower hotlines (e.g., restrictions on the types of issues that may be reported, the persons who may submit a report, the persons whom a report may concern, etc.)?

The Protection of the Whistleblower Act, (herein the "PWA") (Chapter 527 of the Laws of Malta) provides protection to employees in both the private sector and public administration to disclose information regarding improper practices.

The term "employee" is defined as:

(a) a person who has entered into or works under a contract of service with an employer and includes a contractor or subcontractor who performs work or supplies a service or undertakes to perform any work or to supply services;

(b) any person who has undertaken personally to execute any work or service for, and under the immediate direction and control of another person, including an outworker, but excluding work or service performed in a professional capacity to which an obligation of professional secrecy applies when such work or service is not regulated by a specific contract of service;

(c) any person in employment in the public administration;

(d) any former employee;

(e) any person who is or was seconded to an employer;

(f) any volunteer in terms of law; and

(g) any candidate for employment, but only where information concerning a serious threat to the public interest constituting an improper practice has been acquired during the recruitment process or at another pre-contractual negotiating stage.

The scope of a report made in terms of the PWA is "improper practice". This term includes an action or series of actions whereby:

(a) a person has failed, is failing or is likely to fail to comply with any law and/or legal obligation to which he is subject;

(b) the health or safety of any individual has been, is being or is likely to be endangered;

(c) the environment has been, is being or is likely to be damaged;

(d) a corrupt practice has occurred or is likely to occur or to have occurred;

(e) a criminal offence has been committed, is being committed or is likely to be committed;

(f) a miscarriage of justice has occurred, is occurring or is likely to occur;

(g) bribery occurred, is occurring or is likely to occur;

(h) a person is acting above his authority; or

(i) information tending to show any matter falling within any one of the preceding paragraphs has been, is being or is likely to be deliberately concealed.

The provisions of the PWA do not apply to members of a disciplined force, members of the Secret Service or persons employed in the foreign, consular or diplomatic service of the Government.

One should also take note of the WP29 Opinion 1/2006 on the application of EU data protection rules to internal whistle-blowing schemes. This is limited to the fields of accounting, internal accounting controls, auditing matters, fight against bribery, banking and financial crime. The scope of corporate whistle-blower hotlines, however, does not need to be limited to any particular issues. The WP29 recommends that the business responsible for the whistle-blowing scheme should carefully assess whether it might be appropriate to limit the number of persons eligible for reporting alleged misconduct through the whistle-blowing scheme and whether it might be appropriate to limit the number of persons who may be reported through the scheme, in particular in the light of the seriousness of the alleged offences reported.

12.2 Is anonymous reporting prohibited, or strongly discouraged, or generally permitted? If it is prohibited or discouraged, how do businesses typically address this issue?

No, it is not prohibited. However, anonymous reporting is not protected in terms of the PWA. Such an anonymous report may still be taken into account to determine whether an improper practice has occurred. If upon consideration of all circumstances, the report is deemed to be defamatory or libellous, it shall be discarded.

Additionally, anonymous reporting is not prohibited under the GDPR; however, it raises problems as regards the essential requirement that personal data should only be collected fairly. As a rule, the WP29 considers that only identified reports should be advertised in order to satisfy this requirement. Businesses should not encourage or advertise the fact that anonymous reports may be made through a whistle-blower scheme.

An individual who intends to report to a whistle-blowing system should be aware that he/she will not suffer due to his/her action. The whistle-blower, at the time of establishing the first contact with the scheme, should be informed that his/her identity will be kept confidential at all the stages of the process, and in particular will not be disclosed to third parties, such as the incriminated person or to the employee's line management. If, despite this information, the person reporting to the scheme still wants to remain anonymous, the report will be accepted into the scheme. Whistle-blowers should be informed that their identity may need to be disclosed to the relevant people involved in any further investigation or subsequent judicial proceedings instigated as a result of any enquiry conducted by the whistle-blowing scheme.

13. CCTV

13.1 Does the use of CCTV require separate registration/notification or prior approval from the relevant data protection authority(ies), and/or any specific form of public notice (e.g., a high-visibility sign)?

Yes, the data controller must notify the IDPC prior to physically installing CCTV cameras.

Furthermore, a DPIA must be undertaken with assistance from the Data Protection Officer when there is a systematic monitoring of a publicly accessible area on a large scale. If the DPIA suggests that the processing would result in a high risk to the rights and freedoms of individuals prior to any action being taken by the controller, the controller must consult the data protection authority.

During the course of a consultation, the controller must provide information on the responsibilities of the controller and/or processors involved, the purpose of the intended processing, a copy of the DPIA, the safeguards provided by the GDPR to protect the rights and freedoms of data subjects and where applicable, the contact details of the Data Protection Officer.

If the data protection authority is of the opinion that the CCTV monitoring would infringe the GDPR, it has to provide written advice to the controller within eight weeks of the request of a consultation and can use any of its wider investigative, advisory and corrective powers outlined in the GDPR.

13.2 Are there limits on the purposes for which CCTV data may be used?

The use of surveillance cameras must have a clearly defined specific purpose which is proportionate to the rights to privacy of individuals. The IDPC has also issued guidelines as to the use of biometric equipment at the workplace, establishing that this is only permissible in places demanding a high level of security and strict identification procedures.

13. Employee Monitoring

14.1 What types of employee monitoring are permitted (if any), and in what circumstances?

Please refer to question 14.2.

14.2 Is consent or notice required? Describe how employers typically obtain consent or provide notice.

Individuals have the right to be informed about the processing of their personal data by means of a surveillance camera. The general practice is to provide the information by way of notices affixed in prominent and easily visible places within the monitored area. In certain cases, notices are also required to be affixed even before approaching the monitored area. The notice should include the designation of the data controller, the purpose for processing and a clear sign indicating the camera.

14.3 To what extent do works councils/trade unions/employee representatives need to be notified or consulted?

As regards biometric scanning, the IDPC establishes that where employees are unionised, there should be prior and proper consultation with the respective union.

15. Data Security and Data Breach

15.1 Is there a general obligation to ensure the security of personal data? If so, which entities are responsible for ensuring that data are kept secure (e.g., controllers, processors, etc.)?

Yes. Personal data must be processed in a way which ensures security and safeguards against unauthorised
or unlawful processing, accidental loss, destruction and damage of the data.

Both controllers and processors must ensure they have appropriate technical and organisational measures to meet the requirements of the GDPR. Depending on the security risk this may include the encryption of personal data, the ability to ensure the ongoing confidentiality, integrity and resilience of processing systems, an ability to restore access to data following a technical or physical incident and a process for regularly testing and evaluating the technical and organisation measures for ensuring the security of processing.

15.2 Is there a legal requirement to report data breaches to the relevant data protection authority(ies)? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.

Upon entry into force of the GDPR, the controller will be responsible for reporting a personal data breach without undue delay (and in any case within 72 hours of first becoming aware of the breach) to the relevant data protection authority, unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject(s). A processor must notify any data breach to the controller without undue delay.

The notification must include the nature of the personal data breach including the categories and number of data subjects concerned, the name and contact details of the Data Protection Officer or relevant point of contact, the likely consequences of the breach and the measures taken to address the breach including attempts to mitigate possible adverse effects.

15.3 Is there a legal requirement to report data breaches to affected data subjects? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.

Controllers have a legal requirement to communicate the breach to the data subject, without undue delay, if the breach is likely to result in a high risk to the rights and freedoms of the data subject.

The notification must include the name and contact details of the Data Protection Officer (or point of contact), the likely consequences of the breach and any measures taken to remedy or mitigate the breach.

The controller may be exempt from notifying the data subject if the risk of harm is remote (e.g., because the affected data is encrypted), the controller has taken measures to minimise the risk of harm (e.g., suspending affected accounts) or the notification requires a disproportionate effort (e.g., a public notice of the breach).

15.4 What are the maximum penalties for data security breaches?

Currently, the maximum administrative penalty that may be imposed is €23,300. Upon entry into force of the GDPR, the maximum penalty will be increased to the higher of €20 million or 4% of worldwide turnover, depending on the nature of the breach.

16. Enforcement and Sanctions

16.1 Describe the enforcement powers of the data protection authority(ies).

Investigatory Power

Civil/Administrative Sanction

Criminal Sanction

Investigative Powers The data protection authority has wide powers to order the controller and the processor to provide any information it requires for the performance of its tasks, to conduct investigations in the form of data protection audits, to carry out reviews on certificates issued pursuant to the GDPR, to notify the controller or processor of alleged infringement of the GDPR, to access all personal data and all information necessary for the performance of controllers' or processors' tasks and access to the premises of the data including any data processing equipment. N/A
Corrective Powers The data protection authority has a wide range of powers including to issue warnings or reprimands for non-compliance, to order the controller to disclose a personal data breach to the data subject, to impose a permanent or temporary ban on processing, to withdraw a certification and to impose an administrative fine (as below). N/A
Authorisation and Advisory Powers The data protection authority has a wide range of powers to advise the controller, accredit certification bodies and to authorise certificates, contractual clauses, administrative arrangements and binding corporate rules as outlined in the GDPR. N/A
Imposition of Administrative Fines for Infringements of Specified GDPR Provisions The GDPR provides for administrative fines which can be €20 million or up to 4% of the business' worldwide annual turnover of the proceeding financial year. N/A
Non-Compliance With a Data Protection Authority The GDPR provides for administrative fines which will be €20 million or up to 4% of the business' worldwide annual turnover of the proceeding financial year, whichever is higher. N/A

16.2 Does the data protection authority have the power to issue a ban on a particular processing activity? If so, does such a ban require a court order?

The GDPR entitles the relevant data protection authority to impose a temporary or definitive limitation including a ban on processing.

16.3 Describe the data protection authority's approach to exercising those powers, with examples of recent cases.

The IDPC carries out all these powers, in particular on-site inspections. (Please note that the Office of the IDPC has not issued Annual Reports since 2011 and recent information is limited.)

16.4 Does the data protection authority ever exercise its powers against businesses established in other jurisdictions? If so, how is this enforced?

To our knowledge, the IDPC has not exercised its powers against businesses established in other jurisdictions.

17. E-discovery / Disclosure to Foreign Law Enforcement Agencies

17.1 How do companies typically respond to foreign e-discovery requests, or requests for disclosure from foreign law enforcement agencies?

Transfers of personal data in the context of police and judicial cooperation may only take place upon a request submitted in writing to the body exercising police powers. Such a request shall include an indication of the person or body making the request and of the reason and purpose for which the request is made. The communication of personal data must follow the principles of good data processing referred to in the answer to question 4.1 above.

The Data Protection (Processing of Personal Data in the Police Sector) Regulations provide that such transfers of data may only be made if there exists a legal obligation to do so or the communication is necessary for the prevention of a serious and imminent danger, or is necessary for the suppression of a serious criminal offence.

17.2 What guidance has/have the data protection authority(ies) issued?

The IDPC has not issued any guidance on this point.

18. Trends and Developments

18.1 What enforcement trends have emerged during the previous 12 months? Describe any relevant case law.

None with respect to the IDPC.

18.2 What "hot topics" are currently a focus for the data protection regulator?

Implementation of the GDPR is high on the IDPC's agenda. This entails, amongst others, discussing the approval of guidelines for processing of personal data in respect to specific data processing – in sensitive industries, e.g. insurance.

Originally published by International Comparative Legal Guide to: Data Protection 2018.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.