L.S. 546.03 Regolamenti dwar Reġistru ta’ Persuni u Tqassim ta’ Data Personali fi ħdan is-Settur Pubbliku

(1)The title of these regulations is the Person Register and Personal Data Sharing within the Public Sector Regulations. Citation, scope and applicability.

(2)These regulations shall establish a Person Register and provide for measures, which are necessary for facilitating personal data sharing between public sector bodies.

(3)These regulations provide for establishing a core person details record and authorize links between the core person details record and other records held in other official registers containing equivalent personal data in relation to the same person as well as enable the sharing of personal data within the public sector, under necessary safeguards.

(4)These regulations also provide for: (

1. a)the establishment of a central record containing personal data to enable the sharing and re-use of data within the public sector, including the assignment of a unique machine readable identifier for every natural person whose details are recorded in an official register through any of the processes listed in the Fourth Schedule; and (
2. b)the establishment of consistent and standard mechanisms across the public administration to create a single person view in compliance with the General Data Protection Regulation.

(5)The provisions of these regulations shall not apply to the sharing of open data, which is not of a personal nature.

1. requires: In these regulations, unless the context otherwise Interpretation. Amended by: L.N. 262 of
2. "Act" means the Re-Use of Public Sector Information Act; Cap.
3. "Agency" means the Identity Malta Agency established by article 3 of the Identity Malta Agency (Establishment) Order which shall be the controller for the purposes of these regulations;   S.L. 595.
4. 2 [ S.L. 546.03 PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR "common database" means an existing public sector data repository containing details of persons derived from civil acts and other person identity documents; "controller" shall have the same meaning as in Article 4 of the General Data Protection Regulation; "core person record" means the minimum set of person details as included in the First Schedule;   S.L.
6. "Data Governance Council" shall have the same meaning and functions as in Part XI of the Organisational Structures for Data Sharing and Re-Use Regulations;   S.L. 546.
7. "data owner" shall have the same meaning as assigned to it in regulation 2 of the Organisational Structures for Data Sharing and ReUse Regulations; "extended person details" means the personal data listed in the Second Schedule; "General Data Protection Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); "life event" means a process listed in the Fourth Schedule which may create an entry, or change the core person details listed in the First Schedule, in any official register;   S.L. 546.
8. "official record" shall have the same meaning as assigned to it in regulation 2 of the Organisational Structures for Data Sharing and Re-Use Regulations;   S.L. 546.
9. "official register" shall have the same meaning as assigned to it in regulation 2 of the Organisational Structures for Data Sharing and Re-Use Regulations; "personal data" shall have the same meaning as assigned to it in Article 4 of the General Data Protection Regulation; "person status identifier" means the person status derived from the applicable law as included in the Third Schedule; "professional warrant" means an indicator or counter added as part of the Second Schedule which is derived from the relevant official registers to recognize a person as the holder of one or more professional warrants issued by a competent authority in Malta; PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR [ S.L. 546.03 "public employee" shall have the same meaning as assigned to it in article 2

(1)of the Public Administration Act;   Cap.

1. "public sector body" shall have the same meaning as assigned to it in article 2 of the Act; "regulatory authority" shall have the same meaning, powers and functions as established by the Act and by Part III of the Organisational Structures for Data Sharing and Re-Use Regulations;    S.L. 546.
2. "Register" means the Person Register established by regulation 3; "Registrar" or "Registrar of Persons" means the authorized official function within the agency which shall be designated as the administrator in respect of the Register; "uniform resource identifier" or "URI" shall have the same meaning as assigned to it in regulation 2 of the Organisational Structures for Data Sharing and Re-Use Regulations; and   S.L. 546.
3. "user" shall have the same meaning as assigned to it in regulation 2 of the Organisational Structures for Data Sharing and Re-Use Regulations.   S.L. 546.
4. 3.

(1)There shall be established a Person Register to be kept by the Agency which shall contain therein the core person record and, where applicable, the extended person details. The Person Register.

(2)The Agency shall maintain the quality and accuracy of the personal data within the Register in so far as the personal data falls within the remit of the Agency and shall ensure that access to the Register is limited to categories of personal data, listed in the Fifth Schedule, as required for each public sector body to fulfil their obligations under these regulations. In so doing, the Agency shall use appropriate security safeguards and role-based access control mechanisms to ensure that each public sector body shall only have access to the personal data that is strictly required to facilitate the sharing of personal data under the Act.

(3)Pursuant to the provisions of sub-regulation

(2), the public sector body shall be responsible for the manner in which the data from the Register is used within such public sector body and for the authorisations of users from within the public sector body.

(4)In line with its functions under sub-regulation

(1), the Agency shall conduct, where necessary, a data protection impact assessment and publish guidelines for the transfer of core person data from the Register to other official registers.

(5)The source for the initial loading of the records in the Register shall be derived from the existing records stored in the 3 4 [ S.L. 546.03 PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR Common Database.

(6)New person records or changes to existing details in respect of the core person record by the processes included in the Fourth Schedule shall be verified and certified in terms of completeness and correctness. Such verification shall be done by the data owner responsible for the process authorized to generate such changes and before such details can be accepted to form part of the Register by the Registrar.

(7)Pending the verification and certification of such data, which shall be completed within the shortest time possible but not later than thirty

(30)days, the new details shall remain suspended and shall be visible only to the data owner of the originating process and the Registrar: Provided that all records which remain suspended in excess of the first thirty

(30)days shall be reported to the Data Governance Council for a decision: Provided further that if the status remains unchanged for more than thirty

(30)days following the first escalation process, the matter shall be reported to the regulatory authority for a final decision and the required direction or order as applicable.

(8)The certification through a digital marker including the details of the public officer attesting to the completion of the verification process as described in sub-regulation

(6)shall be stored as part of the pertinent person record which shall then become an official record forming an integral part of the Register. Automated mechanisms and standards. 4. In order to be able to fulfil their obligations under these regulations, public sector bodies shall use automated mechanisms and standards. Record version control mechanisms. 5.

(1)A public sector body responsible for an official register shall ensure transparency in its processes by establishing a record version control mechanism through which each change to the record details shall be retained and kept distinct but linked to an identifiable record, with timestamps indicating the start and end of each version of the record that is kept.

(2)The public sector body responsible for an official register subject to an obligation to link shall also enable the recording of additional information to be stored and used in regard to the processing referred to in sub-regulation

(1). Where an entry in the person record is created or changed, the user and his authorized role for such process and other relevant information to enable a full audit trail of changes applied to official records shall be recorded: Provided that version control records containing PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR [ S.L. 546.03 identifiable details of persons or associated to person identifiable data, shall be deleted after the expiry of the retention period as established for the pertinent person record. 6.

(1)Personal data concerning the status headings listed in the Third Schedule shall only be accessed following approval pursuant to sub-regulation

(3)given by the public sector body responsible for such data: Provided that the information referred to in this subregulation shall be derived upon a request received from a public sector body who is the owner of a process or service and made available through the specific person view and the related process as authorized by the relevant public sector body responsible for such data, and published in the Fifth and Sixth Schedules respectively: Provided further that the public sector body responsible for an official register shall establish a mechanism that ensures that such person status information is not visible or accessible to the administrators of the Person Register as created by regulation 3.

(2)(a) Pursuant to the provisions of sub-regulation

(1), any permission enabling a role to use a specific person view as included in the Fifth Schedule in the context of a specific public administration process shall be published under the Sixth Schedule. (b) Any request for the publication of new data access permissions shall be addressed to the head of the public sector body who is the recognised data owner responsible for the relevant official register, or his delegate, in writing or by using the provided digital platform.

(3)The public sector body responsible for an official register shall ensure that permissions are designed in accordance with the principles of data minimization and purpose limitation and shall only authorise access to their official register after having evaluated the legal basis for the processing of such data, and after being satisfied that such processing meets any of the legal criteria as established in Article 6 of the General Data Protection Regulation. Such access shall be based on defined public administration roles, with public administration processes linked to a specific public administration role for data access authorisation purposes: Provided that a record of the request and granting of such permission shall be kept, and that such permission shall be immediately revoked when no longer required.

(4)The public sector body responsible for an official register shall also establish adequate technical measures to enable the publication and maintenance of the roles and permissions referred to in sub-regulation

(3)in a digital and machine-readable format and to Person status information. 5 6 [ S.L. 546.03 PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR provide for the request process for new permissions to add or delete roles and processes.

(5)Any permission under sub-regulation

(3)shall be authorised by the public sector body responsible for the official register in accordance with the law under which the official register is established: Provided that the permissions referred to in this regulation shall be made visible immediately through the appropriate web enabled forms of the national open data portal. Obligation to link to core person details. 7.

(1)Public sector bodies responsible for official registers, found in the Register of Registers and containing personal data, shall link the personal data to the core person details referred to in the First Schedule in order to establish a connection between the locally stored records and the centrally maintained person identifier: Provided that the links established between official registers enabling interoperability and sharing of data shall remain under the control and full visibility of the source data owner and access to such data shall only be permitted as described under regulation 6: Provided further that the source data owner shall create a core data person in the First Schedule, only when the links are established in accordance with the Fourth Schedule.

(2)The public sector body responsible for an official register holding personal data shall be obliged to provide data to other registers if and as permitted by law and in accordance with the law regulating the official register concerned and in line with the links established under the Sixth Schedule. Protection of personal data. Cap. 586. 8.

(1)Nothing in these regulations shall prejudice the application of the General Data Protection Regulation and the Data Protection Act.

(2)The Agency and public sector bodies shall ensure that data protection principles, including purpose limitation, data minimisation, limited storage periods and measures to ensure personal data security are applied.

(3)Any public sector body responsible for official registers holding personal data may, following the verification of the identity of the data subject, provide or use a digital platform through which the data subject may exercise control over his personal data; in doing so, the public sector body shall also facilitate the data subject to give and, or to withdraw his consent for any processing of his personal data where applicable, in particular the data elements in the first part of the Second Schedule in a transparent and easy manner. PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR [ S.L. 546.03 7 The digital platform provided or used may also be used to enable the data subject to access and view records which contain personal details making reference to his identity.

(4)The extended person details as stored in the first part of the Second Schedule shall be verified by the Agency to ensure its accuracy and correctness and shall only be declared as an official record after such verification is confirmed by the Registrar and the verification information is digitally added to the record details. Such records as stored in the First and Second Schedule shall also be made visible and accessible to the data subject upon request.

(5)The person details as included in First Schedule and in Parts I and II of the Second Schedule may be used by official government processes to enable the automatic filling of the relevant details for the purpose of not requesting information from the data subject which is already held by the public administration: Provided that the relevant details to be auto-filled are as strictly necessary and in line with the legal obligations emanating from the process. 9. A transitory period of forty-eight

(48)months from the date of the coming into force of these regulations shall be allowed for public sector bodies responsible for official registers which hold personal data to develop and establish the required mechanisms to fulfil the obligations under these regulations and to continue to maintain the link between the person record as represented in the official register and the centrally stored person record as maintained in the Register in accordance with the First Schedule. FIRST SCHEDULE Core person details The list of data elements is available from the following link: https://open.data.gov.mt/ search_all.html?id=13986&key=Subordinates SECOND SCHEDULE Part I CdB person details Transitory period. 8 PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR [ S.L. 546.03 The list of data elements is available from the following link: https://open.data.gov.mt/search_all.html?id=5962&key=Subordinates Part II Extended Person Details The list of data elements is available from the following link: https://open.data.gov.mt/ search_all.html?id=52775&key=Subordinates The data elements marked with a (Art. 8) suffix shall be stored and provided only if explicit consent is given by the person concerned in accordance with the provisions of regulation 8 and the General Data Protection Regulation. The data subject shall be responsible for the veracity and completeness of these details all times. Part III Derived Person Details The list of data elements is available from the following link: https://open.data.gov.mt/ search_all.html?id=36800&key=Subordinates THIRD SCHEDULE Part I Person status headings and values of person details held in the First and Second Schedules

1. Death indicator Burial Status
2. Gender Identity
3. Marital Status
4. Sex (physical body characteristics) marker Part II Person status headings and values of person records held only in other official registers PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR
6. [ S.L. 546.03 Contracting Status: (a) contracting capacity: (b) non-contracting state: Residency status (a) alien (non-Maltese person): (b) Maltese citizen FOURTH SCHEDULE Life events The list of life events (contributing processes) is available from the following link: https://open.data.gov.mt/ search_all.html?id=36650&key=Subordinates FIFTH SCHEDULE Categories of person views (datasets) to be provided from the Person Register. The following categories of data shall be provided as required to deliver public services, if justified in accordance with these regulations, and may be found from the following link: https://open.data.gov.mt/ search_all.html?id=36651&key=Subordinateshttps:// open.data.gov.mt/search_all.html?id=36651&key=Subordinates SIXTH SCHEDULE Person views (Datasets) as authorized to processes and public services. The details pertinent to this Schedule may be found on the 9 10 [ S.L. 546.03 PERSON REGISTER AND PERSONAL DATA SHARING WITHIN THE PUBLIC SECTOR following link: https://open.data.gov.mt/ search_all.html?id=36652&key=Subordinates