MaltaProcessing of Personal Data (Education Sector) Regulations, anonymisation and pseudonymisation of student data for research and statistics
Processing of Personal Data (Education Sector) Regulations (Subsidiary Legislation 586.07), reg. 8
In force since .
A de-identification rule binding public and private bodies.
- Instrument type
- a regulation made under an act
What it requires
- When processing personal data for research and statistics purposes in the education sector, render all identifiable data anonymous, unless for research the identification of the data subject is required to fulfil the purposes of the research (S.L. 586.07, regulation 8(1)).
- Where research for a specific targeted policy would require students' identification details, replace personal identification data with pseudonymous data, and limit re-identification of students to the cases that specifically fall within the parameters of the targeted policy (S.L. 586.07, regulation 8(2)).
- When processing pseudonymous data under regulation 8, keep data enabling the attribution of information to an identified or identifiable data subject separately from the other data (S.L. 586.07, regulation 8(4)(b)).
- After the targeted policy or initiative has been implemented, render all identifiable details anonymous, delete them or destroy them, and do not retain personal data longer than necessary (S.L. 586.07, regulation 8(4)(d)).
These lines are LexLint's reading of the law's text.
What this law does
Regulation 8(1) of the Processing of Personal Data (Education Sector) Regulations (Subsidiary Legislation 586.07) requires all identifiable data to be rendered anonymous when personal data is processed for research and statistics purposes, unless in the case of research the identification of the data subject is required to fulfil the research purposes.
Regulation 8(2) of the Education Sector Regulations requires data controllers to replace students' personal identification data with pseudonymous data where research for a specific targeted policy would require students' identification details. Regulation 8(4)(b) of the Education Sector Regulations requires data enabling the attribution of information to an identified or identifiable data subject to be kept separately from the other data when pseudonymous data is processed.
Regulation 8(4)(d) of the Education Sector Regulations requires all identifiable details to be rendered anonymous, deleted or destroyed once the targeted policy or initiative has been implemented.
When LexLint raises it
When your app profile says your app processes de-identified data or serves schools or universities.
Back to the example · Lint your app
Page updated .