Makes employment decisions, in Malta

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act, Cap. 586 · Read the law's page

• Where a decision based solely on automated processing about a person in Malta rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• Do not subject a person in Malta to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Malta on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Malta of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Legal Notice 226 of 2025, Government Gazette of Malta No. 21,519 (10 October 2025) · Read the law's page

• Comply with the market-surveillance and enforcement decisions of the Malta Digital Innovation Authority (MDIA), which holds that jurisdiction from 2 August 2026 over a high-risk AI system you provide or deploy in Malta that falls outside the Information and Data Protection Commissioner's Annex III categories, under Legal Notice 226 of 2025.
• A provider testing an innovative AI system inside the MDIA's AI regulatory sandbox remains liable for damage the system causes, but is protected from administrative fines while acting in good faith, under the same Legal Notice.

Legal Notice 227 of 2025, Government Gazette of Malta No. 21,519 (10 October 2025) · Read the law's page

• Obtain prior authorisation from a Magistrate for each use of a real-time remote biometric identification system in a publicly accessible space in Malta for law enforcement purposes (or request it within twenty-four hours where urgency justifies starting without it), and notify the Commissioner of each such use with the Regulation (EU) 2024/1689 Article 5(6) information excluding sensitive operational data; if you deploy a high-risk post-remote biometric identification system, request the Magistrate's authorisation ex ante or without undue delay and within forty-eight hours, except for the initial identification of a potential suspect, under regulations 6 and 7 of Legal Notice 227 of 2025.for a public body
• Where you are a public authority or body, expect an administrative penalty of up to EUR 50,000 per infringement plus a daily penalty of up to EUR 50 per day of continuing infringement for a breach of Regulation (EU) 2024/1689 within the Commissioner's Annex III jurisdiction, under the same Legal Notice.

Malta Digital Innovation Authority Act (Cap. 591), art. 6A · Read the law's page

• If you are an economic operator whose product falls under European Union harmonisation legislation that the Malta Digital Innovation Authority enforces as market surveillance authority, provide the documents, technical specifications, data or information on compliance that it requires, including access to embedded software where needed to assess compliance (Article 6A(1)(a)).
• Allow the Authority's unannounced on-site inspections and its entry to premises, land or means of transport that you use for your business (Article 6A(1)(d) and (e)).