Duty LXD-1360
Processes biometric data, in Malta
GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in Maltasince 2 lines
Regulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586 · Read the law's page
- Consult with, and obtain prior authorization from, the IDPC before processing genetic, biometric, or health data of a person in Malta for statistical or research purposes in the public interest, under Cap. 586.
- Ground the processing of any biometric identifier captured for commercial authentication or identification purposes on a GDPR Article 9(2) condition such as explicit consent; Cap. 586's research-specific duty does not reach this use case.
Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)since 1 line
Legal Notice 227 of 2025, Government Gazette of Malta No. 21,519 () · Read the law's page
- Obtain prior authorisation from a Magistrate for each use of a real-time remote biometric identification system in a publicly accessible space in Malta for law enforcement purposes (or request it within twenty-four hours where urgency justifies starting without it), and notify the Commissioner of each such use with the Regulation (EU) 2024/1689 Article 5(6) information excluding sensitive operational data; if you deploy a high-risk post-remote biometric identification system, request the Magistrate's authorisation ex ante or without undue delay and within forty-eight hours, except for the initial identification of a potential suspect, under regulations 6 and 7 of Legal Notice 227 of 2025.for a public body
- Where you are a public authority or body, expect an administrative penalty of up to EUR 50,000 per infringement plus a daily penalty of up to EUR 50 per day of continuing infringement for a breach of Regulation (EU) 2024/1689 within the Commissioner's Annex III jurisdiction, under the same Legal Notice.