RESTRICTION OF THE DATA PROTECTION (OBLIGATIONS AND RIGHTS) [ S.L. 586.09 1 SUBSIDIARY LEGISLATION 586.09 RESTRICTION OF THE DATA PROTECTION (OBLIGATIONS AND RIGHTS) REGULATIONS 1st June, 2018 LEGAL NOTICE 177 of 2018. 1. The title of these regulations is the Restriction of the Data Protection (Obligations and Rights) Regulations. Citation. 2. requires: Interpretation. In these regulations, unless the context otherwise "Act" means the Data Protection Act; Cap. 586 "Commissioner" shall have the same meaning as is assigned to it in article 3 of the Act; and "Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. 3. The scope and purpose of these regulations is to apply restrictions to certain obligations and rights provided for in Article 23 of the Regulation. Scope and purpose. 4. Any restriction to the rights of the data subject referred to in Article 23 of the Regulation shall only apply where such restrictions are a necessary measure required: Restrictions. (
- a)for the safeguarding and maintaining of national security, public security, defence and the international relations of Malta; (
- b)for the prevention, detection, investigation and prosecution of criminal offences, including measures to combat any money laundering activity, and the execution of criminal penalties; (
- c)for the administration of any tax, duty, fines, fees or other money due or owing to the State, under the Income Tax Act, the Income Tax Management Act, the Value Added Tax Act, the Customs Ordinance, the Excise Duty Act and the Fees Ordinance, and any other law allowing for generating revenue in any manner for the Government of Malta; Cap.123. Cap. 372. Cap. 406. Cap. 37. Cap. 382. Cap. 35. 2 [ S.L. 586.09 Cap. 318. RESTRICTION OF THE DATA PROTECTION (OBLIGATIONS AND RIGHTS) (
- d)for the administration of social security benefits in accordance with the Social Security Act and where such data has been obtained in confidence when carrying out an investigation against fraud; (
- e)for the establishment, exercise or defence of a legal claim and for legal proceedings which may be instituted under any law; (
- f)for the performance of the functions of the Commissioner; (
- g)for the delivery of professional services in relation to the carrying out of social work or social assistance by a public authority, public body, a voluntary organisation or any other body delivering such services, and provided that such data shall have been obtained in confidence specifically for the purposes of delivering these services to the beneficiary; (
- h)for health data that is processed and where it would be likely that the application of the rights and obligations referred to in article 5
(1)of the Act would cause serious harm to the vital interests of the patient; or Cap.188. Safeguards and retention periods. (i) for matters relating to Maltese citizenship where the Minister responsible for citizenship or any person authorised to act on his behalf, refuses an application for the acquisition of Maltese citizenship under the Maltese Citizenship Act. 5.
(1)Personal data that is subject to a restriction referred to in regulation 4 shall not be subject to processing that is incompatible with the purposes for which such data was collected, unless provided for by law or with the explicit consent of the data subject.
(2)The data controller shall, pursuant to Article 32 of the Regulation, implement appropriate technical and organisational measures to protect personal data processed pursuant to these regulations against accidental destruction or loss or unlawful forms of processing.
(3)The retention period to be applied for personal data that are processed pursuant to these regulations, shall not be longer than what is necessary for the purpose of the processing of such personal data or shall not be longer than the period required to achieve the aim of the restriction, or as provided by law. Information to data subjects.
- The data controller shall inform the data subject about any restriction provided for under these regulations: RESTRICTION OF THE DATA PROTECTION (OBLIGATIONS AND RIGHTS) [ S.L. 586.09 3 Provided that such a disclosure will not be prejudicial to the purposes of the restriction applied pursuant to these regulations.
- Any restriction applied under these regulations shall respect the essence of the fundamental rights and freedoms of the data subject and shall be a necessary and proportionate measure. Proportionality and necessity.