Duty LXD-0981
Processes personal data, in Malta
Processing of Personal Data (Electronic Communications Sector) Regulations, erasure or anonymisation of traffic and location datasince 2 lines
Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 586.01), regs. 6(1) and 7(1) · Read the law's page
- Erase or make anonymous traffic data relating to subscribers and users, held by an undertaking providing publicly available electronic communications services or a public communications network, when it is no longer needed for the purpose of the transmission of a communication, subject to the billing, consent and dispute exceptions in regulation 6 (S.L. 586.01, regulation 6(1)).
- Process location data other than traffic data only when it is made anonymous, or with the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service (S.L. 586.01, regulation 7(1)).
Data Protection Act, Chapter 586 of the Laws of Maltasince 1 line
Data Protection Act, Cap. 586 · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Malta, including data collected by crawling.
GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in Maltasince 2 lines
Regulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586 · Read the law's page
- Consult with, and obtain prior authorization from, the IDPC before processing genetic, biometric, or health data of a person in Malta for statistical or research purposes in the public interest, under Cap. 586.
- Ground the processing of any biometric identifier captured for commercial authentication or identification purposes on a GDPR Article 9(2) condition such as explicit consent; Cap. 586's research-specific duty does not reach this use case.
GDPR Articles 12-21 and Cap. 586, Data Subject Rights in Maltasince 4 lines
Regulation (EU) 2016/679, Arts. 12-21; Data Protection Act, Cap. 586, art. 6; Subsidiary Legislation 586.09, reg. 4(e); Subsidiary Legislation 586.11 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Malta within one month of receipt.
- You need not complete an access, rectification, restriction or objection request, or, for archiving in the public interest, also a portability request, where doing so is likely to make that archiving, or scientific or historical research or official statistics, impossible or seriously impair it and you reasonably believe the derogation necessary, under Data Protection Act (Cap. 586) article 6.
- You may restrict a person's GDPR rights in Malta where that is a necessary measure to establish, exercise or defend a legal claim or for legal proceedings, under Subsidiary Legislation 586.09 regulation 4(e).
- Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Subsidiary Legislation 586.11.
GDPR Articles 33-34, Breach Notification in Maltasince 3 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify the IDPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Malta, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
GDPR Chapter V, Cross-Border Transfer of Personal Data from Maltasince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Malta outside the European Economic Area.
GDPR Articles 82-83 and IDPC Enforcement in Maltasince 1 line
Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Data Protection Act, pseudonymisation and identification-free processing for research, statistics and archivingsince 2 lines
Data Protection Act (Cap. 586), art. 6(4) · Read the law's page
- Where you process personal data for scientific or historical research, official statistics or archiving in the public interest, apply appropriate safeguards for the data subject's rights and freedoms, including pseudonymisation and other technical and organisational measures that respect data minimisation (Data Protection Act, article 6(4)).
- Where those research, statistics or archiving purposes can be fulfilled by processing that does not permit, or no longer permits, the identification of data subjects, fulfil them in that manner (Data Protection Act, article 6(4), proviso).