L.S. 465.52(R) Ordni dwar l-Applikazzjoni tal-Mowbajl ta’ Traċċar ta’ Kuntatti u Twissija Imħassar bl-Avviż Legali 256 tal-2024

(1)Nothing in this order shall prejudice the application of Regulation 2016/679/EU. Scope and purpose.

(2)This order shall apply to the processing of data by the Superintendent of Public Health by means of a contact tracing and alerting mobile application which supports contact tracing through the use of proximity tracing technology and alerts users to take appropriate voluntary action, including testing or self-isolation, if potentially exposed to the COVID-19 virus.

(3)The purpose of this order is to establish the legal basis in cases where personal data is processed by means of a contact tracing and alerting mobile application, designed to facilitate quick and efficient tracing of contacts of COVID-19 virus carriers, and which shall be a complementary tool to existing manual contact tracing techniques, in order to provide an effective response in limiting the COVID-19 virus while protecting the fundamental rights and freedoms of users of the application.

1. For the purpose of these regulations and unless the context otherwise requires: "application" means the Mobile Contact Tracing and Alerting Application; "authorisation code" means a unique code provided by a public health authority from the field of care, used to authorise a person who had a positive result for the COVID-19 virus to upload the temporary exposure keys stored on his user terminal to the central server; "central server" means a central database towards which the application communicates and which stores the temporary exposure keys of virus carriers; "contact" means the process where users are notified through the application that their user terminal has been in *This order has been repealed by Legal Notice 256 of
2. Interpretation. Amended by: L.N. 128 of
3. 2 [ S.L. 465.52 CONTACT TRACING AND ALERTING MOBILE APPLICATION significant proximity to another user terminal belonging to a virus carrier who consented to the voluntary recording of his infection on the application; "contact tracing" means the disease control methodology that attempts to list all users who have been in significant proximity to a person infected by the COVID-19 virus so as to check whether such persons are at risk of infection and take the appropriate measures towards them; "controller" means the same as the meaning as assigned to it in Regulation 2016/679/EU; "eHealth Network" means a voluntary network set up under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare, and that provides a platform of Member States' competent authorities dealing with digital health; "European Federation Gateway Service" means a service provided and managed by the eHealth Network, which accepts and temporarily stores data detailed in sub-article

(1)of article 10 and uploaded by a participating country, for download to the other participating countries; "rotating proximity identifiers" means ephemeral, pseudo-random identifiers generated by temporary exposure keys representing a user terminal which are broadcast through proximity tracing technology; "Participating country" means a country authorised by the eHealth Network to participate in cross-border data exchange between national contact tracing and warning mobile applications based on Commission Implementing Decision (EU) 2020/1023 of 15 July 2020 amending Implementing Decision (EU) 2019/1765 on cross-border data exchange between national contact tracing and warning mobile applications in connection with combating the COVID-19 pandemic;  Cap.

1. "Superintendent" means the same as the meaning as assigned to it in the Public Health Act; "temporary exposure keys" means anonymous keys that are randomly and independently generated using a cryptographic random number generator; "user" means a person in possession of a user terminal who has voluntarily downloaded and runs the approved application; CONTACT TRACING AND ALERTING MOBILE APPLICATION [ S.L. 465.52 3 "user terminal" means the device on which the application is installed; "virus carrier" means a user who has tested positive for the COVID-19 virus and whose infection was verified pursuant to article
3. The controller for the purposes of this order shall be the Superintendent. Controller. 5.

(1)The processing of data by means of the application shall be necessary for reasons of public interest in the area of public health and based on Articles 6

(1)(e) and 9

(2)(i) of Regulation 2016/679/EU. Legal basis for processing of data.

(2)No personal data of users shall be ulteriorly processed by the controller for a purpose that goes beyond the scope of this order. 6.

(1)The use of the application shall be on a voluntary basis and no person shall suffer from any form of disadvantage or discriminatory action for refusing or for being unable to use the application. Voluntary basis.

(2)A user shall have the right to exercise his data protection rights over any personal data concerning him processed by the controller. In the event that the controller is able to demonstrate that it is not in a position to identify the user, the controller shall inform the data subject about the restriction of the rights afforded to him under Articles 15 to 20 of Regulation 2016/679/EU: Provided that, the above restrictions to the rights of data subjects shall not apply to the data of identifiable users processed by the controller following tests carried out by the public health authorities. 7.

(1)When a user is diagnosed as a person who is infected with the COVID-19 virus by the public health authorities, such user may voluntarily record this information in the application by means of an authorisation code. Verification of infection.

(2)When a user voluntarily records that he is infected with the COVID-19 virus under sub-article

(1), temporary exposure keys held in his user terminal shall be uploaded to the central server.

(3)Following the processing of data referred to in paragraphs (b) and (c) of sub-article

(1)of article 10, other user terminals which have been in significant proximity pursuant to article 9 shall be anonymously notified of contact with the virus carrier’s user terminal through the application.

1. Rotating personal identifiers generated by state of the art cryptographic processes, shall be renewed regularly and at a frequency Rotating personal identifiers. 4 CONTACT TRACING AND ALERTING MOBILE APPLICATION [ S.L. 465.52 compatible with the purpose of containing the spread of the COVID-19 virus and at a sufficient rate to limit the risk of identification and of physical tracking of persons. Parameters for the duration of exposure.
2. Parameters and specifications for the duration of exposure and distance between user terminals shall be established by the Superintendent. Data that shall be processed.  Amended by: L.N. 128 of
3. order: 10.

(1)The following data shall be processed under this (

1. a)in a user terminal: (
2. i)rotating proximity identifiers; (
3. ii)approximate timestamps; and (iii) temporary exposure keys used to generate rotating proximity identifiers; and (
4. b)article 7: where a user voluntarily records an infection under (
5. i)infection; the authorisation code verifying the (
6. ii)the date on which the first symptoms of the COVID-19 virus appeared or in the event of an asymptomatic infection the date of the test; (iii) erased; the time period in which the data shall be (
7. iv)the transmission risk level according to the parameters and specifications pursuant to article 9; (
8. v)the temporary exposure keys of the infected user which were in place during the period which infection of other persons is likely to have occurred; and (
9. vi)the date of creation of each temporary exposure key; and (vii) A list of country codes in accordance to the user’s choices; and (
10. c)where there is contact between user terminals: (
11. i)the rotating proximity identifiers broadcast from one terminal to another. There is no direct link that identifies the users of the other terminals; CONTACT TRACING AND ALERTING MOBILE APPLICATION (
12. d)(
13. ii)the proximity between user terminals; (iii) approximate time window; and (
14. iv)the estimated duration of proximity. [ S.L. 465.52 5 in the European Federation Gateway Service: (
15. i)the temporary exposure keys, each key combined with the key date and list of countries of interest including the country of origin, of infected users who have carried out positive infection verification, and which keys were sent by the infected users’ national contact tracing and warning mobile applications and where the date of each key is fourteen

(14)days or less than the users’ infectivity date determined by the individual users’ national health authority;

(2)The data mentioned in paragraphs (a), (b) and (c) of subarticle

(1)shall be permanently deleted after the lapse of fourteen

(14)days from the date when such data is captured or uploaded, as the case may be, and the data mentioned in paragraph (d) of subarticle

(1)shall be permanently deleted after the lapse of seven

(7)days from the date when such data is uploaded to the European Federation Gateway Service: Provided that the data stored on the central server referred to in paragraph (b) and the data stored on the European Federation Gateway Service referred to in paragraph (d) of sub-article

(1)shall be retained for an additional seven

(7)days for backup purposes. 11.

(1)The Superintendent shall ensure that all organisational, physical, logical and technical security measures are implemented to protect users’ data. Security Measures.

(2)The application shall, by design and default, be implemented using a fully decentralized privacy-preserving proximity tracing software system and shall not process location data or use geolocation services.

(3)The Superintendent shall designate an entity to provide the necessary technical support for the security management of the application.

(4)The Superintendent shall ensure that all persons who are granted access to the data collected under this order are subject to confidentiality agreements. 12.

(1)The application and any data processed therein is designed to support cross-border interoperability within the countries Interoperability.  Substituted by: L.N. 128 of 2021. 6 CONTACT TRACING AND ALERTING MOBILE APPLICATION [ S.L. 465.52 participating in the European Federation Gateway Service.

(2)Information in the European Federation Gateway Service shall only be processed for purposes related to the promotion of interoperability between national contact tracing and warning mobile applications of participating countries for the COVID-19 pandemic and the continuity of cross-border contact tracing. Decommission of the application. 13. Whenever, after assessing the circumstances surrounding the COVID-19 virus, the Superintendent deems that the use of the application is no longer necessary, the Superintendent shall: (a) decommission the application; (b) cease to process any data under this order; (c) permanently erase any data that is stored on the central server; and (d) publish instructions for the uninstallation of the application.