Processes de-identified data, in Malta

Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 586.01), regs. 6(1) and 7(1) · Read the law's page

• Erase or make anonymous traffic data relating to subscribers and users, held by an undertaking providing publicly available electronic communications services or a public communications network, when it is no longer needed for the purpose of the transmission of a communication, subject to the billing, consent and dispute exceptions in regulation 6 (S.L. 586.01, regulation 6(1)).
• Process location data other than traffic data only when it is made anonymous, or with the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service (S.L. 586.01, regulation 7(1)).

Processing of Personal Data (Education Sector) Regulations (Subsidiary Legislation 586.07), reg. 8 · Read the law's page

• When processing personal data for research and statistics purposes in the education sector, render all identifiable data anonymous, unless for research the identification of the data subject is required to fulfil the purposes of the research (S.L. 586.07, regulation 8(1)).
• Where research for a specific targeted policy would require students' identification details, replace personal identification data with pseudonymous data, and limit re-identification of students to the cases that specifically fall within the parameters of the targeted policy (S.L. 586.07, regulation 8(2)).
• When processing pseudonymous data under regulation 8, keep data enabling the attribution of information to an identified or identifiable data subject separately from the other data (S.L. 586.07, regulation 8(4)(b)).
• After the targeted policy or initiative has been implemented, render all identifiable details anonymous, delete them or destroy them, and do not retain personal data longer than necessary (S.L. 586.07, regulation 8(4)(d)).

Data Protection Act (Cap. 586), art. 6(4) · Read the law's page

• Where you process personal data for scientific or historical research, official statistics or archiving in the public interest, apply appropriate safeguards for the data subject's rights and freedoms, including pseudonymisation and other technical and organisational measures that respect data minimisation (Data Protection Act, article 6(4)).
• Where those research, statistics or archiving purposes can be fulfilled by processing that does not permit, or no longer permits, the identification of data subjects, fulfil them in that manner (Data Protection Act, article 6(4), proviso).