Malta

Article 6A(1) of the Malta Digital Innovation Authority Act gives the Authority, for functions where it is designated as market surveillance authority, the powers listed in Regulation (EU) 2019/1020 and other European Union legislation.

Those powers include requiring economic operators to provide documents, technical specifications, data or information on compliance, including access to embedded software where that is necessary to assess a product's compliance with European Union harmonisation legislation. They also include carrying out unannounced on-site inspections and physical verifications and entering premises, land or means of transport that the operator used for its trade or business.

Where an operator fails to take corrective action, the Authority may prohibit or restrict making a product available on the market, or order that it is withdrawn or recalled. The Authority may also impose administrative penalties in accordance with Article 41 of Regulation (EU) 2019/1020. Article 6A was added to the Act by Act XIX of 2024. Act XIX of 2024 was assented to on 14 June 2024.

Article 208A(1) of the Criminal Code makes it an offence for a citizen or permanent resident of Malta, or any person in Malta, to make, produce, distribute, import, export, offer, sell, supply, transmit, make available, procure or show indecent material involving or showing persons under age, punishable by imprisonment of twelve months to five years.

Article 208A(1B) makes it an offence to acquire, knowingly obtain access through information and communication technologies to, or possess such material, punishable by imprisonment not exceeding three years. Article 208A(7) defines indecent material to include digitally created or electronic images, drawings, cartoons, text, simulated representations and realistic images of a minor, and any material that visually depicts a person appearing to be a child, even if the minor is non-existent.

Legal Notice 227 of 2025 designates the Information and Data Protection Commissioner (IDPC) as a second market surveillance authority under the EU AI Act, for the Annex III high-risk categories of biometric systems used for law enforcement, border management, or justice and democracy purposes; emergency-call evaluation and emergency-response dispatching; law enforcement generally; migration, asylum and border control management; and the administration of justice and democratic processes, each insofar as its use is permitted by law.

Published in Government Gazette of Malta No. 21,519 of 10 October 2025. Each use of a real-time remote biometric identification system in a publicly accessible space for law enforcement is subject to prior authorisation granted by a Magistrate, or, in a duly justified urgency, may begin if authorisation is requested within twenty-four hours, and must be notified to the Commissioner with the Article 5(6) information, excluding sensitive operational data.

The deployer of a high-risk post-remote biometric identification system must request the Magistrate's authorisation ex ante, or without undue delay and within forty-eight hours, except for the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence. Regulations 5 to 7 and 9 to 12 came into force on 2 August 2026 under regulation 1(3).

Where the Commissioner finds an infringement of Regulation (EU) 2024/1689 by a public authority or body within this jurisdiction, an administrative penalty of up to EUR 50,000 per infringement plus a daily penalty of up to EUR 50 for each day the infringement persists may follow.

Legal Notice 226 of 2025 was published in Government Gazette of Malta No. 21,519 of 10 October 2025. It designates the Malta Digital Innovation Authority (MDIA) as Malta's lead market surveillance authority, single point of contact, and national competent authority for establishing and operating Malta's AI regulatory sandbox under the EU AI Act.

It also designates the MDIA as the notifying authority, with the National Accreditation Board (Malta) carrying out the assessment and monitoring referred to in Article 28(1) of the EU AI Act. The MDIA's market-surveillance and enforcement powers become exercisable from 2 August 2026, in line with the AI Act's own Article 113 application timeline. Under regulation 1(3), regulations 4, 5, 6, 8, 9 and 10 came into force on 2 August 2026; the other regulations are not deferred.

An operator that infringes the Artificial Intelligence Regulations or Regulation (EU) 2024/1689 is liable to an administrative penalty of up to EUR 350,000 for each infringement or, for an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher. The MDIA may impose a daily penalty of EUR 12,000 for each day an infringement persists, instead of or in addition to that penalty.

An administrative penalty on a public authority or body may not exceed EUR 50,000 for each infringement, with a daily penalty of EUR 50 for each day the infringement persists. A provider testing an AI system inside the MDIA's sandbox remains liable for damage the system causes but is protected from administrative fines while acting in good faith.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.

Under Cap. 586's Article 7 (Consultation and prior authorisation), a controller must consult with, and obtain prior authorisation from, the Commissioner before processing genetic data, biometric data, or data concerning health for statistical or research purposes in the public interest, and where such data is required for research purposes the Commissioner must in turn consult a research ethics committee or an institution the Commissioner recognises for that purpose.

This duty is scoped to processing in the public interest for statistical or research purposes, so a commercial product capturing voiceprints or faceprints for authentication or identification outside a research context falls outside Article 7.

A controller must notify the IDPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Malta, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Malta's private-sector regime is the General Data Protection Regulation (GDPR) plus the Data Protection Act, Chapter 586 of the Laws of Malta, in force since 28 May 2018, three days after the GDPR began to apply, supplying domestic derogations and procedural rules. Subsidiary Legislation 586.11 sets the digital age of consent at 13 (regulation 4). The Minister's power under Chapter 586's Article 33(g) allows a lower age than sixteen, but not below thirteen.

The Information and Data Protection Commissioner (IDPC) is the supervisory authority; Legal Notice 227 of 2025 also designates it the market surveillance authority for high-risk biometric systems used for law enforcement, border management and justice and democracy (regulation 3).

Transferring personal data of a person in Malta outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

General Data Protection Regulation (GDPR) Article 22 gives a person in Malta the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Malta can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

Article 6 of the Data Protection Act lets a controller derogate from access, rectification, restriction and objection, and for archiving in the public interest also notification and portability, where those rights would make research, official statistics or archiving impossible or seriously impair it and the controller reasonably believes the derogation necessary.

Subsidiary Legislation 586.09 allows these rights to be restricted where necessary for the establishment, exercise or defence of a legal claim and for legal proceedings. Subsidiary Legislation 586.11 sets Malta's digital age of consent under GDPR Article 8 at 13.

The IDPC is the supervisory authority and enforces General Data Protection Regulation (GDPR) fines up to EUR 20 million or 4 percent of global annual turnover for private-sector controllers and processors. Cap. 586's own Article 21 (Administrative fines on public authorities or bodies) sets a Malta-specific ceiling for the public sector, distinct from the private-sector maximum.

A public authority or body faces a EUR 25,000 per-violation cap plus a EUR 25 daily fine for infringements of the Article 83(4) tier, and a EUR 50,000 per-violation cap plus a EUR 50 daily fine for infringements of the Article 83(5) or 83(6) tier. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Article 337C of the Criminal Code makes it an offence for a person, without authorisation, to access, use, copy, output, prevent or hinder access to, install, alter, or otherwise deal with data, software, or supporting documentation held in a computer, among the acts the article enumerates in paragraphs (a) to (l). A person acts without authorisation if they are not duly authorised by an entitled person, and an entitled person is one entitled to control the activities the article defines.

Whether a use is authorised turns on whether the actor was permitted by whoever is entitled to control the resource. The general penalty for contravening this article is set out in Article 337F.

Article 337D makes it an offence for a person, without authorisation, to modify computer equipment or supplies used or intended for use in a computer, computer system, or computer network, or to take possession of, damage, destroy, or impair the operation of such a computer, computer system, computer network, or supplies. The general penalty for contravening this article is set out in Article 337F.

Article 337F sets the general penalty for contravening any provision of the Criminal Code's computer-misuse subtitle at a fine not exceeding €23,293.73 or imprisonment not exceeding four years, or both.

The penalty rises to a fine of not less than €500 and not exceeding €150,000 or imprisonment from twelve months to ten years, or both, where the offence is detrimental to a government function or public utility, causes serious damage, targets a critical infrastructure facility, is committed within an organised-crime framework, or is committed through misuse of another person's personal data to gain a third party's trust.

The same increased penalty applies where an employee used that position to commit the offence against the employer or a third party, and where the offence is a second or subsequent one. A person who prepares for or is an accomplice in an offence under the subtitle is liable to the same penalty as the completed offence, and the burden of proving any authorisation the accused claims to have had lies with the accused. The provisions this entry describes came into force on different days.

Article 9 of the Electronic Commerce Act provides that an electronic contract is not denied legal effect, validity, or enforceability solely because it is wholly or partly in electronic form or was concluded wholly or partly by electronic communications.

Article 10 provides that, unless otherwise agreed by parties who are not consumers, an electronic contract concluded by a recipient placing an order through technological means is formed when the recipient receives the service provider's acknowledgement of receipt of that order. The sections this entry groups came into force on different days.

The Copyright and Related Rights in the Digital Single Market Regulations (Subsidiary Legislation 415.08, Legal Notice 261 of 2021) transpose Directive (EU) 2019/790. Regulation 4 excepts reproductions and extractions made by research organisations or cultural heritage institutions to carry out text-and-data-mining, for scientific research, of works to which they have lawful access, with no opt-out for rightholders.

Regulation 5 excepts reproductions and extractions of any lawfully accessible work for the purposes of text and data mining, including for commercial purposes. That exception applies on condition that the rightholder has not expressly reserved the use of the work for mining in an appropriate manner, such as machine-readable means for content made publicly available online.

Article 25 of the Copyright Act grants the maker of a database who has made a qualitatively or quantitatively substantial investment in obtaining, verifying, or presenting its contents the right to authorise or prohibit extraction or re-utilization of the whole or a substantial part of its contents, irrespective of whether the database or its contents are eligible for copyright protection.

Article 27 sets the term of this sui generis right at fifteen years from the first of January of the year following the database's completion or, if it was made available to the public before that period expires, from the first of January of the year following its first making available.

The Malta Financial Services Authority Act (Digital Operational Resilience Act (DORA)) Regulations, 2024 (Legal Notice 166 of 2024) implement Regulation (EU) 2022/2554 (DORA) in Malta, apply to the financial entities listed in Article 2(1) of DORA, and give way to DORA in any conflict. The regulations were published in Government Gazette Supplement No. 21,285 on 16 July 2024 and came into force on 17 January 2025.

Regulation 4 designates the Malta Financial Services Authority as Malta's competent authority under DORA Article 46 and the recipient of major ICT-related incident reports and voluntary notifications of significant cyber threats under DORA Article 19, without prejudice to the European Central Bank for significant credit institutions and the European Securities and Markets Authority for trade repositories, credit rating agencies and critical benchmark administrators.

Regulation 7 lets the Authority access documents and data, carry out on-site inspections and investigations, summon representatives of financial entities for explanations and require corrective and remedial measures for breaches of DORA and the implementing regulations or rules, and regulation 6 lets it issue Rules.

Regulation 8(1) lets the Authority impose administrative measures and penalties of up to EUR 150,000 for each infringement or failure to comply, and regulation 8(2) adds cease-and-desist orders, public notices naming the person, and the power to apply penalties and measures to members of the management body.

Regulation 11 makes it an offence to fail to comply with an Authority order, to conceal or refuse to produce a required document, to give false or misleading information, to obstruct the Authority, or to contravene a provision of DORA or the implementing regulations or rules, punishable on conviction by imprisonment for up to one year, a fine of up to EUR 150,000, or both.

Article 19 requires an essential entity or important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its operations or services, and to prevent or minimise the impact of incidents on the recipients of its services and on other services.

The measures must follow an all-hazards approach and cover at least the areas article 19(2) lists, which include incident handling, supply chain security and security in the acquisition, development and maintenance of systems including vulnerability handling and disclosure. The entity must also appoint a security liaison officer. It must receive monitoring services from an internal or an autonomous computer security incident response team (computer security incident response team (CSIRT)).

Article 18 requires the entity's management body to approve the measures and oversee their implementation, and the natural persons composing the body may be held liable for an infringement of article 19. The Order applies to a public or private entity of a type listed in its First or Second Schedule that is at least medium-sized.

Regardless of size it also applies to providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registries and DNS service providers. The Second Schedule names online marketplace, online search engine and social networking services platform providers as digital providers.

The First Schedule names cloud computing, data centre and content delivery network providers as digital infrastructure and managed service and managed security service providers under ICT services management. A cloud computing, data centre, content delivery network, managed service, DNS, online marketplace, online search engine or social networking services platform provider must also register with the CIP Department by the prescribed date.

Regulation 3(16) disapplies the relevant provisions of this Order, including supervision and enforcement under Part VII, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify the CSIRT of significant incidents with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

Regulation 3(17) measures that equivalence against the risk-management measures of article 19(1) to (3) and the notification duties of article 20(1) to (6), so the registration under article 7(1)(c) and article 24(1) that this row names still binds such an entity.

Regulation 28(2) of the Electronic Communications Networks and Services (General) Regulations requires a provider of public electronic communications networks or of publicly available electronic communications services, or a gateway operator, to notify the Authority without undue delay of any security incident that has a significant impact on the operation of networks or services.

A gateway operator must also notify the Authority without undue delay of a failure or serious degradation of the connectivity it provides. The Authority is the Malta Communications Authority. A security incident is an event having an actual adverse effect on the security of electronic communications networks and, or services.

A gateway operator is an undertaking providing or authorised to provide a public network or service that includes a submarine connection between the Maltese islands, an international connection between Malta and other countries, or both.

In judging whether an incident has a significant impact, the provider takes into account, where available, the number of users affected, the duration of the incident, its geographical spread, the extent to which the network or service is affected and the extent of its impact on economic and societal activities.

Where there is a particular and significant threat of a security incident, the provider must inform its users who may be potentially affected of any possible protective measures or remedies they can take. The Regulations came into force on 1 October 2021. They revoked the Electronic Communications Networks and Services (General) Regulations, 2011.

Article 37(2) of the Gaming Authorisations and Compliance Directive requires a licensee to notify the Malta Gaming Authority of any breach of its information security that adversely affects the confidentiality of information relating to players, and of any such breach that precludes players from accessing their accounts for a period exceeding twelve hours. The notice is due forthwith and in any case no later than three working days after the breach.

A licensee is a business-to-consumer licensee providing a gaming service or a business-to-business licensee providing a critical gaming supply. The Authority takes the notice as an incident report submitted through its Licensee Portal.

Article 20 requires an essential entity or important entity to notify the national computer security incident response team (CSIRT) immediately of any incident that has a significant impact on the provision of its services. A significant incident is one that has caused or is capable of causing severe operational disruption of the service or financial loss for the entity, or that has affected or is capable of affecting other natural or juridical persons by causing considerable material or non-material damage.

The entity must submit an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours with an initial assessment of its severity and impact, an intermediate report if the national CSIRT asks for one, and a final report not later than one month after the 72-hour notification. A trust service provider notifies within 24 hours of becoming aware of a significant incident that affects its trust services.

Where appropriate the entity must also notify the recipients of its services, without undue delay, of significant incidents likely to adversely affect the provision of those services. Notifying does not itself subject the entity to increased liability. The national CSIRT is the team established within the Malta Information Technology Agency by article 8(1).

Regulation 3(16) disapplies the relevant provisions of this Order, including supervision and enforcement under Part VII, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify the CSIRT of significant incidents with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

Regulation 9, sub-regulation (1) of the Processing of Personal Data (Electronic Communications Sector) Regulations prohibits using, or causing to be used, a publicly available electronic communications service to make an unsolicited communication for direct marketing by an automatic calling machine, a facsimile machine or electronic mail to a subscriber or user, whether a natural or legal person, unless the subscriber or user has given prior consent in writing.

Regulation 9, sub-regulation (2) lets a person who obtained customers' electronic mail contact details in relation to the sale of a product or service use them for direct marketing of its own similar products or services, if customers are given the opportunity to object, free of charge and in an easy and simple manner, when the details are collected and on each message where the customer has not initially refused.

Regulation 9, sub-regulation (3) requires a person who uses any other means of communication for direct marketing to ensure, at no charge to the subscriber or user, that such communications are not sent if the subscriber or user requests that they cease.

Regulation 9, sub-regulation (4) prohibits direct marketing electronic mail that disguises or conceals the identity of the sender on whose behalf it is made, that contravenes regulation 6 of the Electronic Commerce (General) Regulations, that has no valid address to which the recipient may send a request that the communications cease, or that encourages recipients to visit websites that contravene that regulation.

Regulation 11 entitles a person who suffers loss or damage because of a contravention of the regulations to take action before the competent court seeking compensation. Regulation 12 requires the Commissioner to ensure compliance with the regulations. Regulation 13 makes a person who contravenes the regulations liable to an administrative fine of up to EUR 23,293.73 for each violation and EUR 2,329.37 for each day the violation persists, determined and imposed by the Commissioner.

Regulation 5, sub-regulation (1) of the Processing of Personal Data (Electronic Communications Sector) Regulations allows the storing of information, or the gaining of access to information stored, in the terminal equipment of a subscriber or user only on condition that the subscriber or user has given consent, having been provided by the controller with clear and comprehensive information in terms of article 19 of the Data Protection Act.

Regulation 5, sub-regulation (2) provides that the requirements do not prevent technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as may be strictly necessary for the service provider to provide an information society service explicitly requested by the subscriber or user. Regulation 5 was substituted by Legal Notice 239 of 2011.

Legal Notice 239 of 2011 provides that it comes into force on such date as the Minister responsible for data protection may establish by notice in the Gazette. Regulation 11 entitles a person who suffers loss or damage because of a contravention of the regulations to take action before the competent court seeking compensation. Regulation 12 requires the Commissioner to ensure compliance with the regulations.

Regulation 13 makes a person who contravenes the regulations liable to an administrative fine of up to EUR 23,293.73 for each violation and EUR 2,329.37 for each day the violation persists, determined and imposed by the Commissioner.

Regulation 4, sub-regulation (1) of the Processing of Personal Data (Electronic Communications Sector) Regulations provides that, without prejudice to regulation 10, no person other than the user shall listen, tap, store or undertake any other form of interception or surveillance of communications and any related traffic data without the consent of the user concerned.

Regulation 4, sub-regulation (2) provides that the regulation does not affect any legally authorised recording of communications and the related traffic data in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other business communication.

Regulation 10 provides that regulations 4, 5, 6 and 7 do not apply when a law specifically provides for the provision of information as a necessary measure in the interest of listed purposes, among them national security, defence, public security and the prevention, investigation, detection and prosecution of offences. Regulation 11 entitles a person who suffers loss or damage because of a contravention of the regulations to take action before the competent court seeking compensation.

Regulation 12 requires the Commissioner to ensure compliance with the regulations. Regulation 13 makes a person who contravenes the regulations liable to an administrative fine of up to EUR 23,293.73 for each violation and EUR 2,329.37 for each day the violation persists, determined and imposed by the Commissioner.

Article 3 designates the Malta Communications Authority as the Digital Services Coordinator for Malta under Article 49(1) and (2) of the Digital Services Act. Article 5(1) requires a judicial or administrative authority that issues an order to take action against illegal content to ensure that the order complies with the conditions in Article 9(2) of the Digital Services Act, and treats an order that does not as null and void for the purposes of that Act.

Article 8 requires a provider of intermediary services in Malta whose service consists of the storage of information by recipients of the service to notify the Authority in writing within seven days, counted from 17 February 2024 for a provider already offering the service and from the start of the service for any other provider.

Article 13 caps an administrative penalty for each infringement at six per cent of the provider's annual worldwide turnover in the preceding financial year, or one per cent where the infringement relates to incorrect, incomplete or misleading information, a failure to reply or rectify, or a failure to submit to an inspection.

Article 13 also caps a periodic administrative penalty payment at five per cent of the provider's average daily worldwide turnover or income in the preceding financial year per day. Article 15 requires a provider of intermediary services that becomes aware of any alleged illegal activity undertaken or information provided by a recipient of its service to immediately inform the competent public authority.

Article 56 defines a product as any movable, and includes any movable incorporated into another product or into an immovable, electricity, gas and primary agricultural products. Article 56 defines the producer to include the manufacturer of a finished or processed product, the manufacturer of a component part and the producer of any raw material.

Article 56 also treats as the producer any person who presents himself as the producer by putting his name, trade mark or other distinguishing feature on the product. Article 56 also treats as the producer any person who imports into an EEA State, for sale, hire, leasing or any other form of distribution, a product manufactured or produced outside a Member State. Article 57 makes the producer liable for the damage caused wholly or partly by a defect in his product.

Article 58 gives the injured party the onus of proving the damage, the defect and the causal relationship between the defect and the damage, and not the onus of proving the fault of the producer.

Article 59(1) treats the supplier of a product as the producer if the producer, or for an imported product the importer, cannot be identified and the supplier fails, within thirty days of the injured party's request, to give the identity and full address of that person or of the person who supplied the supplier. Article 59(2) requires the supplier's request to be in writing and sent by registered mail or official letter to the supplier's place of trade or business.

Article 59(3) puts on the supplier the burden of proving that it gave the injured party the information required. Article 60(1) makes a product defective if it fails to provide the safety which a person is entitled to expect, taking all circumstances into account, including its presentation and marketing, the use it could reasonably be expected to be put to, and the time when it was put into circulation.

Article 60(2) provides that a product is not considered defective only because a better product is subsequently put into circulation. Article 60(3) makes a product defective if it does not provide for the safety which is usually provided for by other models of the same type.

Article 61(a) and (b) allow damages for death or personal injury, and for loss of, damage to or destruction of property other than the defective product itself, having a value of at least five hundred euro or such other value as the Minister may prescribe. Article 61 limits the property to an item of a type ordinarily intended for private use or consumption that the injured party used mainly for his own private use or consumption.

Article 62(a) frees the producer who proves that he did not put the product into circulation. Article 62(b) frees the producer who proves that, having regard to the circumstances, it is probable that the defect did not exist when he put the product into circulation or came into being afterwards.

Article 62(c) frees the producer who proves that the product was neither manufactured by him for sale or for any form of distribution for an economic purpose nor manufactured or distributed by him in the course of his business or trade. Article 62(d) frees the producer who proves that the defect is due to compliance with a mandatory requirement imposed by law or by a public authority.

Article 62(e) frees the producer who proves that the state of scientific and technical knowledge when he put the product into circulation was not such as to enable the existence of the defect to be discovered. Article 62(f) frees the manufacturer of a component or the producer of a raw material who proves that the defect is attributable to the design of the product in which it was fitted or to the instruction given by the manufacturer of that product.

Article 63 lets the court order that a referee's fees be provisionally paid or deposited by the producer if there is prima facie evidence that the damage was caused by a defect in the product. Article 64 makes two or more persons liable for the same damage jointly and severally. Article 65 applies article 1051 of the Civil Code where the damage is caused by a defect in the product and by the fault of the injured person or of a person for whom he is responsible.

Article 66 provides that the liability of the producer is not reduced when the damage is caused both by a defect in the product and by the act or omission of a third party. Article 67(1) bars the action for damages three years from the day the injured party became aware, or should reasonably have become aware, of the damage, the defect and the identity of the producer.

Article 67(2) extinguishes the action ten years after the producer put the actual product into circulation, unless the injured party has meanwhile instituted legal proceedings against the producer. Article 67(4) puts on the producer the burden of proving when the actual product was put into circulation. Article 68 provides that the liability of a producer may not be limited or excluded by any term of contract, by any notice or in any other manner.

Article 69 provides that Part IX does not exclude or limit any rights or remedies available to the injured person under the Civil Code or any other law. Article 70 excludes injury or damage arising from nuclear accidents which are governed by an international agreement to which Malta is a party. Article 71 applies Part IX to products which are put into circulation in any Member State as from 1 May 2004.

Article 71A states that the purpose of Part IX is to implement Council Directive 85/374/EEC of 25 July 1985. Article 71A also provides that Part IX is to be applied and interpreted accordingly. Legal Notice 46 of 2003 brought articles 56 to 71 of the Consumer Affairs Act into force on 28 January 2003.

Article 16S requires a video-sharing platform provider under the jurisdiction of Malta to take the necessary measures to protect minors from programmes, user-generated videos and audiovisual commercial communications which may impair their physical, mental or moral development. Those measures include establishing and operating age verification systems for users of video-sharing platforms with respect to such content.

They also include providing for parental control systems that are under the control of the end-user with respect to such content. Personal data of minors collected or otherwise generated through those age-verification or parental-control measures may not be processed for commercial purposes such as direct marketing, profiling and behaviourally targeted advertising. The Broadcasting Authority ensures that all video-sharing platform providers under its jurisdiction apply such measures.

The Act was passed by the House of Representatives on 2 December 2020. It received presidential assent on 7 December 2020. It was published in the Government Gazette of Malta on 7 December 2020. Under article 72(4) of the Constitution of Malta, a law does not come into operation until it has been published in the Gazette, and Parliament may postpone its coming into operation. The Act contains no commencement clause.

Publishers of press publications have the exclusive right to authorize or prohibit the reproduction of their press publications by information society service providers for any online use. They also have the exclusive right to authorize or prohibit making their press publications available to the public so that members of the public may access them from a place and at a time individually chosen by them.

The rights do not extend to mere facts reported in a press publication and do not include private or non-commercial uses by individual users or acts of hyperlinking. They also do not include the use of individual words or very short extracts of a press publication.

A press publication is a collection composed mainly of literary works of a journalistic nature that forms an individual item within a periodical under a single title and is published under the editorial responsibility and control of a service provider. The rights last two years from the end of the year following the date on which the press publication is published. They do not apply to press publications first published before 6 June 2019.

The regulations were published as Legal Notice 261 of 2021 in the Government Gazette of Malta number 20,647 of 18 June 2021.

Article 9(1) of the Copyright Act lists the acts that copyright in an audiovisual work, database, literary work other than a computer programme, musical work, or artistic work does not extend to.

Among them, reproduction, translation, distribution, or communication to the public by the press of published articles on current economic, political, or religious topics, or of broadcast works or subject matter of the same character, is excepted from copyright control where such use is not expressly reserved and the source, including the author's name, is indicated.

The same item also excepts the use of works or other subject-matter in connection with the reporting of current events, to the extent justified by the informatory purpose, as long as the source, including the author's name, is indicated unless that is impossible.

A separate item in the same list excepts reproduction, translation, distribution, or communication to the public of quotations for purposes such as criticism or review, of a work already lawfully made available to the public, where the source and author's name are indicated and the use accords with fair practice, to the extent required by the specific purpose. Article 9 was substituted by Act IX of 2003 and last amended by Act IX of 2009.

Section 4 of Act IX of 2009 amended paragraph (c) of Article 9(1), correcting one word of the English text and deleting a cross-reference to article 42(3) and (4). Section 95 of Act IX of 2003, which made the substitution, falls in Part XVIII of that Act. Parts XVIII to XX of that Act came into force on 1 January 2004.