L.S. 465.65 Ordni dwar iċ-Ċertifikat tat-Tilqima kontra l-COVID-19

(1)The title of this order is the Vaccination against COVID-19 Certificate Order. Citation and scope.

(2)The scope of this order is to set out the legal basis for the processing of personal data by the Superintendent of Public Health during the COVID-19 pandemic when: (

1. a)an interoperable certificate on vaccination is issued for persons who have been vaccinated in Malta and who require such vaccination certificate to travel to a third country; and (
2. b)verifying and accepting recognised interoperable certificates on vaccination issued by competent authorities in a third country for persons arriving in Malta from such third country.

(3)The provisions of this order shall be read in conformity with and shall be without prejudice to the provisions of the Data Protection Act and the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. 2. In this order, unless the context otherwise requires: "booster" means additional vaccine dose or doses following a full primary course of vaccination; "fully vaccinated person" means a person who has received all applicable doses of an approved vaccine medicinal product according to instructions published by its manufacturer, which vaccine shall become effective fourteen

(14)days after the last dose has been received; "General Data Protection Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC; "interoperability" or "interoperable" means that a vaccination Cap.

1. Interpretation. Amended by: L.N. 7 of
2. 2 [ S.L. 465.65 VACCINATION AGAINST COVID-19 CERTIFICATE certificate and a recognised vaccination certificate are able of being verified in Malta and in the third country party to a bilateral agreement in terms of article 4; "recognised vaccination certificate" means an interoperable certificate recording that a person has been fully vaccinated and which certificate is issued in a third country which has a bilateral agreement with Malta; "third country" means any country outside the European Economic Area; "trust framework" means the rules, policies, specifications, protocols, data formats and digital infrastructure regulating and allowing for the reliable and secure issuance and verification of certificates to guarantee the certificates’ trustworthiness by confirming their authenticity, validity and integrity; "unique certificate identifier" means a set of numbers and letters given to each vaccination certificate issued in accordance with this order and which shall be specific to each certificate; "vaccination certificate" means an interoperable certificate generated in Malta upon the request of a person which includes the information listed in the Schedule; "vaccine" means an immunological medicinal product to prevent COVID-
3. Issuance of vaccination certificates. Amended by: L.N. 7 of
4. 3.

(1)For the purposes of this order, the Superintendent of Public Health shall be the health authority competent to issue a vaccination certificate in Malta and shall be considered as the controller for the purposes of the General Data Protection Regulation.

(2)A person who has been vaccinated in Malta may request the Superintendent of Public Health to issue a vaccination certificate: Provided that a vaccination certificate shall only be issued to a fully vaccinated person who requires such a certificate to enter a third country.

(3)A vaccination certificate shall be made available to the person in digital or paper-based format.

(4)A vaccination certificate shall be valid for such period as specified in standards issued by the Superintendent.

(5)The holder of a vaccination certificate shall be entitled to request the issuance of a new vaccination certificate if the personal data contained in the certificate is no longer accurate or up to date, or the certificate is either no longer available to the holder or otherwise no longer valid. VACCINATION AGAINST COVID-19 CERTIFICATE [ S.L. 465.65 3

(6)For statistics, research and audit purposes, the Superintendent of Public Health may retain a record containing the unique certificate identifier as reference of a vaccination certificate and without including any identifiable details in relation to the holder. 4.

(1)The Government of Malta, after consultation with the Superintendent of Public Health may enter into a bilateral agreement with a third country with the scope of mutually recognising vaccination certificates issued by Malta and such third country: Bilateral agreement. Amended by: L.N. 227 of 2021. Provided further that the provisions of this order shall also apply to vaccination certificates issued by third countries with which Malta does not have a bilateral agreement. Provided that any bilateral agreement shall be drawn up in line with the requirements of the General Data Protection Regulation and any international obligations in place.

(2)The Superintendent of Public Health shall publish a notice in the Gazette listing the third countries that are party to any bilateral agreement pursuant to sub-article

(1). 4A. The provisions of this order shall also apply to vaccination certificates issued by EU and EEA countries, including in cases where there is no bilateral agreement in place. Applicability. Added by: L.N. 227 of 2021. 5.

(1)The processing of data pursuant to article 3, shall be necessary for reasons of public interest in the area of public health and based on articles 6

(1)(e) and 9

(2)(i) of the General Data Protection Regulation. Legal basis.

(2)No personal data in relation to vaccination certificates and recognized vaccination certificates shall be further processed by the controller for a purpose that goes beyond the scope of these regulations. 6.

(1)Appropriate technical means based on a trust framework shall be used for the issuance and verification of vaccine certificates and recognized vaccine certificates, providing for the interoperability, integrity and authenticity of such certificates.

(2)The technical means and the trust framework pursuant to sub-article

(1), may be defined in the bilateral agreement signed with the third country, including data protection by design and default.

(3)The trust framework shall provide for appropriate technical and organisational measures to ensure adequate security to safeguard the confidentiality, integrity, availability and resilience of personal data being processed for the purpose of these regulations.

(4)When a vaccine certificate is issued and verified, the only data that may be requested shall be that data which is necessary to Trust framework. 4 [ S.L. 465.65 VACCINATION AGAINST COVID-19 CERTIFICATE avoid the use of forged vaccination certificates and to confirm its authenticity. SCHEDULE Data to be included in the vaccination certificate: (

1. a)name: surname(
2. s)and forename(s), in that order; (
3. b)date of birth; (
4. c)disease or agent targeted; (
5. d)vaccine/prophylaxis; (
6. e)vaccine medicinal product; (
7. f)vaccine marketing manufacturer; (
8. g)number in a series of vaccinations/doses; (
9. h)date of vaccination, indicating the date of the latest dose received; (
10. i)country of vaccination; (
11. j)certificate issuer; (
12. k)a unique certificate identifier; (
13. l)passport number or other identification document number of the person. authorization holder or