Provides telecom services, in Malta

Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 586.01), regs. 6(1) and 7(1) · Read the law's page

• Erase or make anonymous traffic data relating to subscribers and users, held by an undertaking providing publicly available electronic communications services or a public communications network, when it is no longer needed for the purpose of the transmission of a communication, subject to the billing, consent and dispute exceptions in regulation 6 (S.L. 586.01, regulation 6(1)).
• Process location data other than traffic data only when it is made anonymous, or with the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service (S.L. 586.01, regulation 7(1)).

L.N. 379 of 2021, reg. 28, Electronic Communications Networks and Services (General) Regulations · Read the law's page

• This binds a provider of public electronic communications networks or of publicly available electronic communications services, including a gateway operator, which is such a provider whose network or service includes a submarine connection between the Maltese islands or an international connection between Malta and other countries. Read it by hand if you provide a network or service of that kind in Malta.
• Notify the Authority, the Malta Communications Authority, without undue delay of any security incident that has a significant impact on the operation of your networks or services (regulation 28(2)(a)).
• If you are a gateway operator, notify the Authority without undue delay of any failure or serious degradation of the connectivity you provide (regulation 28(2)(b)).
• Take account, where available, of the number of users affected, the duration of the incident, its geographical spread, the extent to which the network or service is affected and the extent of its impact on economic and societal activities when judging whether an incident has a significant impact (regulation 28(4)).
• Where there is a particular and significant threat of a security incident, inform the users who may be potentially affected of any possible protective measures or remedies they can take and, where appropriate, of the threat itself (regulation 28(7)).

S.L. 399.48, regs. 87(2), 87(3), 88(1), 96(1), Eighth Schedule Part B and Ninth Schedule (L.N. 379 of 2021), Electronic Communications Networks and Services (General) Regulations · Read the law's page

• If you provide publicly available electronic communications services (other than transmission services used for the provision of machine-to-machine services), give a consumer the information the Regulations require before the consumer is bound by a contract or corresponding offer, upon request, in an accessible format for end-users with disabilities in accordance with European Union legislation harmonising accessibility requirements for products and services (Reg. 87(1) and (2), proviso).
• Identify in the concise contract summary you give a consumer the extent to which your products and services are designed for end-users with disabilities (Reg. 87(3)(e)).
• If you provide internet access services or publicly available interpersonal communications services, include in the pre-contract information details on products and services designed for end-users with disabilities and how updates on this information can be obtained (Reg. 87(1); Eighth Schedule, Part B, point I(5)).
• If you provide internet access services or publicly available interpersonal communications services subject to terms and conditions, publish the Ninth Schedule information in a clear, comprehensive, machine-readable manner and in an accessible format for end-users with disabilities in accordance with European Union legislation harmonising accessibility requirements for products and services, and update it regularly (Reg. 88(1)).
• Include in that published information details of products and services, including functions, practices, policies and procedures and alterations in the operation of the service, specifically designed for end-users with disabilities (Reg. 88(1); Ninth Schedule, point 2(f)).
• Meet any additional requirements the Authority specifies on the form in which that information is published, and supply the information to the Authority before publication when it asks (Reg. 88(1), second proviso).
• Publish that information, as a minimum, on your website, accessible on or from the same webpage where the service, offer or package is publicised (Malta Communications Authority Decision Notice on Contracts, Transparency and Termination of Services, Decision 10, applicable from 1 September 2023).
• If you offer a bundle that comprises at least an internet access service or a publicly available number-based interpersonal communications service, apply regulations 87(3) and 88(1) to every element of the bundle (Reg. 96(1)).
• Provide the information to end-users that are micro-enterprises, small enterprises or not-for-profit organisations as well, unless they have explicitly agreed to waive all or parts of those provisions (Reg. 87(9) and 96(4)).
• Comply with any decision the Authority issues under the Regulations, whatever dispute, appeal or legal proceedings has been started against it (Reg. 114(2)).
• If you are a microenterprise that provides number-independent interpersonal communications services and no other electronic communications service, regulations 87, 88 and 96 do not apply to you; tell end-users of that exemption through a durable medium before concluding a contract with them (Reg. 84).

Malta Communications Authority, Decision Notice, Review of 'Must Carry' Obligations (MCA/D/23-4884), sections 2.2 and 5 · Read the law's page

• If you provide Melita's Cable TV platform or GO's IPTV platform, on which the Authority keeps 'must carry' obligations, reserve sufficient network capacity for the transmission of the identified General Interest TV broadcast channels and the related complementary services (Decision Notice MCA/D/23-4884, section 5, point i).
• Transmit alongside each General Interest TV broadcast channel the accessibility services that the Broadcasting Authority defines from time to time for those channels (Decision Notice MCA/D/23-4884, section 2.2).
• Comply with the Authority's decision whatever dispute, appeal or legal proceedings has been started against it (General Regulations, reg. 114(2)).

Malta Communications Authority, Decision Notice, Universal Service Obligations on Electronic Communications Services (MCA/D/23-4920(26)), Decisions 6 and 7 · Read the law's page

• If you provide fixed or mobile voice communications services, provide each eligible visually impaired person included in the list supplied by the responsible Ministry or Government entity with one free-of-charge call per week to a directory enquiry service number (Decisions 6 and 7).
• If the number of eligible persons using the free call becomes excessive, to the extent that you need funding to sustain it, inform the Authority, which decides whether to cap the list (Decision Notice, section 4.2.2.1.2).
• Comply with the Authority's decision whatever dispute, appeal or legal proceedings has been started against it (General Regulations, reg. 114(2)).

S.L. 627.03, regs. 1(3), 3(2), 3(4), 4(3), 4(5), 5, 13, 14 and Annexes I, V (L.N. 214 of 2022), Accessibility Measures (European Accessibility Act) Regulations · Read the law's page

• If you provide to consumers after 28 June 2025 an electronic communications service (other than a transmission service used for machine-to-machine services), a service providing access to audiovisual media services, the websites, mobile applications, electronic tickets and ticketing, transport information and self-service terminals of an air, bus, rail or waterborne passenger transport service, a consumer banking service, e-books and dedicated software, or an e-commerce service, make the service comply with Section III of Annex I (not for urban, suburban and regional transport services) and Section IV of Annex I, subject to regulation 14 (regs. 3(2), 4(1) and 4(3)); this implements Articles 4 and 13 of Directive (EU) 2019/882.
• Make websites, including the related online applications, and mobile device-based services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Annex I, Section III, paragraph (c)).
• Make the products you use to provide the service accessible under Section I of Annex I and, where applicable, Section II, and give information about how the service works, its link to those products and their accessibility characteristics and interoperability with assistive devices, through more than one sensory channel, in an understandable and perceivable way, in text formats that can generate alternative assistive formats, in fonts of adequate size and suitable shape with sufficient contrast and adjustable spacing, with non-textual content supplemented by an alternative presentation (Annex I, Section III, paragraphs (a) and (b)).
• Where you offer support services such as help desks, call centres, technical support, relay services or training, give information on the accessibility of the service and its compatibility with assistive technologies in accessible modes of communication (Annex I, Section III, paragraph (d)).
• For electronic communications services, provide real time text in addition to voice, total conversation where video is provided in addition to voice, and synchronised emergency communications by voice and text (including real time text) and, where video is provided, total conversation, transmitted to the most appropriate public safety answering point (Annex I, Section IV, paragraph (a)).
• For services providing access to audiovisual media services, provide electronic programme guides that are perceivable, operable, understandable and robust and give information about the availability of accessibility, and transmit subtitles for the deaf and hard of hearing, audio descriptions, spoken subtitles and sign language interpretation with adequate quality, synchronised with sound and video and under user control (Annex I, Section IV, paragraph (b)).
• For air, bus, rail and waterborne passenger transport services other than urban, suburban and regional transport services, give information on the accessibility of vehicles, the surrounding infrastructure and the built environment and on assistance for persons with disabilities, and information about smart ticketing, real-time travel information and additional service information; for urban, suburban and regional transport services, make the self-service terminals you use accessible under Section I of Annex I (Annex I, Section IV, paragraphs (c) and (d)).
• For consumer banking services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and keep information understandable without exceeding level B2 (upper intermediate) of the Council of Europe Common European Framework of Reference for Languages (Annex I, Section IV, paragraph (e)).
• For e-books, provide synchronised text and audio where an e-book contains audio, do not prevent assistive technology from operating properly, ensure access to the content, navigation and layout, allow alternative renditions interoperable with assistive technologies, make e-books discoverable through accessibility metadata, and ensure that digital rights management does not block accessibility features (Annex I, Section IV, paragraph (f)).
• For e-commerce services, give the information on the accessibility of the products and services being sold when you are the responsible economic operator and it is provided, and make the identification, security and payment functions, identification methods, electronic signatures and payment services perceivable, operable, understandable and robust (Annex I, Section IV, paragraph (g)).
• Where Sections I to VI of Annex I do not address a function of the service, make that function accessible by meeting the functional performance criteria of Section VII, which include at least one mode of operation that does not require vision, hearing, vocal input, perception of colour or fine motor control (Annex I, Section VII).
• Design and provide the service in accordance with the accessibility requirements of the Regulations (reg. 13(1)).
• Prepare the information required by Annex V on how the service meets the accessibility requirements, include it in the general terms and conditions or an equivalent document, make it available to the public in written and oral format, including in a manner accessible to persons with disabilities, and keep it for as long as the service is in operation (reg. 13(2); Annex V).
• Provide information demonstrating that the service delivery process and its monitoring ensure compliance of the service with point 1 of Annex V and with the applicable requirements of the Regulations (Annex V, point 3).
• Keep procedures in place so that the service stays in conformity, taking into account changes in the characteristics of the service, in the accessibility requirements and in the harmonised standards or technical specifications by which the service is declared to meet them (reg. 13(3)).
• If the service does not conform, take the corrective measures necessary and immediately inform the competent national authorities of the Member States where the service is provided, with details of the non-compliance and the corrective measures; on a reasoned request, give a competent national authority all the information needed to demonstrate conformity and cooperate on action to bring the service into compliance (regs. 13(4) and 13(5)).
• If you rely on the fundamental alteration or disproportionate burden ground in regulation 14(1), assess it against the criteria in Annex VI, document the assessment, keep the results for five years after the service was last provided and give the authority a copy on request; renew the assessment for each category or type of service when the service is altered, when the authorities responsible for checking compliance of services ask, and at least every five years (regs. 14(2), 14(3) and 14(5)).
• Do not rely on the disproportionate burden ground where you receive funding from other sources than your own resources for the purpose of improving accessibility, and send the market surveillance authority or the relevant competent authority information that you rely on regulation 14(1) for a specific service (regs. 14(6) and 14(7)); regulation 14(7) ends with the proviso that sub-regulation (1) shall not apply to microenterprises, while Article 14(8) of Directive (EU) 2019/882 exempts microenterprises only from sending that information.
• If you are a microenterprise providing services, regulation 4(5) exempts you from complying with the accessibility requirements referred to in regulation 4(3) and any obligations relating to the compliance with those requirements, and regulation 4(1) applies in accordance with regulation 4(5); regulation 2 defines a microenterprise as an enterprise which employs fewer than ten persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million (regs. 2, 4(1) and 4(5)).

S.L. 460.41, art. 20, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order · Read the law's page

• Notify the national CSIRT, which article 8(1) establishes within the Malta Information Technology Agency, immediately of any incident that has a significant impact on the provision of your services; treat an incident as significant where it has caused or is capable of causing severe operational disruption of the service or financial loss for you, or considerable material or non-material damage to another person.
• Submit an early warning to the national CSIRT, without undue delay and in any event within 24 hours of becoming aware of the significant incident, stating where applicable whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact.
• Follow with an incident notification within 72 hours of becoming aware of the incident, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, the indicators of compromise.
• Submit an intermediate report on relevant status updates if the national CSIRT asks for one, and a final report not later than one month after the incident notification, covering a detailed description of the incident, its likely root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing then, send a progress report at that point and a final report within one month of handling it.
• Where appropriate, notify the recipients of your services without undue delay of a significant incident likely to adversely affect those services, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.
• If you are a trust service provider, notify a significant incident that affects your trust services within 24 hours of becoming aware of it, without the 72-hour stage that applies to other entities.
• This binds an essential or important entity under articles 3 and 4 of the Order, reached as on this jurisdiction's companion risk-management row: an entity of a type listed in the First or Second Schedule that is at least medium-sized, or that the Order names regardless of size, and that falls under Malta's jurisdiction under article 23, including a social networking services platform, online marketplace or online search engine provider.

S.L. 460.41, arts. 18, 19 and 24, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of incidents on the recipients of your services and on other services (article 19(1)).
• Base those measures on an all-hazards approach and cover at least: policies on risk analysis and information system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies and procedures to assess the effectiveness of the measures; basic cyber hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; human resources security, insider risk management, access control and asset management; multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems where appropriate; and logging and traceability (article 19(2)).
• When choosing supply chain measures, take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of its products and cybersecurity practices, including its secure development procedures (article 19(3)).
• Appoint a security liaison officer with the necessary expertise, who develops and maintains your business continuity plans, ensures risk assessments are carried out, maintains and exercises your operator security plan and acts as your point of contact with the CIP Department or the designated competent authority (article 19(1)(c)).
• Receive CSIRT monitoring services from an internal CSIRT or an autonomous CSIRT that meets the requirements of article 9(1) (article 19(1)(d)).
• Have your management body approve the risk-management measures and oversee their implementation, have its members follow cybersecurity risk-management training, and offer similar training to your employees on a regular basis; the natural persons composing the management body may be held liable for an infringement of article 19 (article 18).
• Register on the national self-registration mechanism of the CIP Department with your name, the CSIRT providing monitoring services to you, your contact details and IP ranges, your sector and the Member States where you provide services, and notify it of any change without delay and within two weeks (article 7(4) and (5)); a DNS service provider, top-level domain name registry, domain name registration service, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider also submits the article 24(1) registry information by the prescribed date and notifies changes within three months.
• Where you find you do not comply with the measures in article 19(2), take, without undue delay, all necessary, appropriate and proportionate corrective measures (article 19(4)).
• This binds an essential or important entity under articles 3 and 4 of the Order that falls under Malta's jurisdiction under article 23: an entity established in Malta or, for a DNS service, top-level domain name registry, domain name registration, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider, one whose main establishment in the Union is in Malta or whose Union representative is established in Malta. It reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and are named in the First or Second Schedule, or where the Order names you regardless of size; the Second Schedule names online marketplace, online search engine and social networking services platform providers, and the wider sector classes it reaches (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT services management, public administration, space and others) are reached by declaring that you are an essential or important entity.