L.S. 591.03 Regolamenti dwar Data Governance

(1)The title of these regulations is the Data Governance Regulations. Citation and scope.

(2)These regulations implement the requirements of Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act). 2. requires:

(1)In these regulations, unless the context otherwise "Act" means the Malta Digital Innovation Authority Act; Interpretation.     Cap.

1. "Data Governance Council" means the Data Governance Council established by virtue of regulation 25 of the Organisational Structures for Data Sharing and Re-Use Regulations;    S.L. 546.
2. "Malta Digital Innovation Authority" means the Malta Digital Innovation Authority established by virtue of article 5 of the Malta Digital Innovation Authority Act;    Cap.
3. "Regulation (EU) 2022/868" means Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act).

(2)Any words and expressions which are not defined in these regulations shall have the same meaning as assigned to them in Regulation (EU) 2022/868: Provided that unless the context otherwise requires, words and phrases used in these regulations, which are not defined in Regulation (EU) 2022/868 and which are not herein defined, shall have the same meaning as that assigned to them in the Act.

1. The Data Governance Council shall be the national competent body designated for the purpose of carrying out the tasks referred to in Article 7 of Regulation (EU) 2022/868: Provided that where any other competent body is designated under national law to carry out tasks referred to in Article 7 of Regulation (EU) 2022/868 in relation to a particular sector, such other competent body shall be deemed to be the competent body Designation of national competent bodies for the purposes of Article 7 of Regulation (EU) 2022/
2. 2 [ S.L. 591.03 DATA GOVERNANCE designated for the purpose of carrying out the tasks referred to in Article 7 of Regulation (EU) 2022/868 in relation to that particular sector. Right of redress.   Cap.
3. 4.

(1)An appeal shall lie to the Administrative Review Tribunal established in the Administrative Justice Act from any decision taken by a competent public sector body in relation to requests for the re-use of the categories of data referred to in Article 3

(1)of Regulation (EU) 2022/868.  Cap. 490.

(2)The provisions of the Administrative Justice Act, in so far as they apply to the Administrative Review Tribunal, shall apply to any proceedings before the said Tribunal.

(3)For the purposes of these regulations:  Cap 490. (a) the definition "public administration" in the Administrative Justice Act shall be construed as a reference to such competent public sector bodies which grant or refuse access for the re-use of the categories of data referred to in Article 3

(1)of Regulation 2022/868;   Cap. 490.       Cap. 490. (b) the word "decision" shall have the same meaning attributed to it in the definition "administrative act" in the Administrative Justice Act.

(4)There shall be a right of appeal from decisions of the Tribunal to the Court of Appeal in accordance with the provisions of Part IV of the Administrative Justice Act. Designation of single information point. 5. For the purposes of Article 8 of Regulation (EU) 2022/ 868, the Data Governance Council shall be the body designated as the single information point. Designation of national competent authority for data intermediation services and data altruism organisations. 6.

(1)For the purposes of Regulation (EU) 2022/868, the Malta Digital Innovation Authority shall be the national authority designated as the competent authority for data intermediation services and for the registration of data altruism organisations and to this end, shall have all the powers stipulated by Regulation (EU) 2022/868.

(2)Without prejudice to the provisions of the Act, for the purpose of monitoring compliance of data intermediation services providers and recognised data altruism organisations with the requirements of Regulation (EU) 2022/868, the Malta Digital Innovation Authority shall have all the powers referred to in Article 14 and 24 of Regulation (EU) 2022/868 respectively. Right to file a complaint. 7. Natural and legal persons may file a complaint in relation to any matter falling within the scope of Regulation (EU) 2022/868 individually or, where relevant collectively, with the Malta Digital Innovation Authority against a data intermediation services provider DATA GOVERNANCE [ S.L. 591.03 or against a recognised data altruism organisation. 8. The provisions of Part IX of the Act shall apply to: (

1. a)legally binding decisions referred to in Article 14 of Regulation (EU) 2022/868 in the management, control and enforcement of the notification regime for data intermediation services providers; Right to an effective judicial remedy. (
2. b)legally binding decisions referred to in Articles 19 and 24 of Regulation (EU) 2022/868 for the registration of data altruism organisations in the monitoring of recognised data altruism organisations; and (
3. c)a failure of the Malta Digital Innovation Authority to act on a complaint filed with it in accordance with regulation 7 of these regulations. 9.

(1)Articles 42, 43, 44 and Part IX of the Act shall apply to infringements of the obligations regarding transfers of nonpersonal data to third countries pursuant to Article 5

(14)and Article 31 of Regulation (EU) 2022/868, the notification obligation of data intermediation services providers pursuant to Article 11 of Regulation (EU) 2022/868, the conditions for providing data intermediation services pursuant to Article 12 of Regulation (EU) 2022/868 and the conditions for the registration as a recognised data altruism organisation pursuant to Articles 18, 20, 21 and 22 of Regulation (EU) 2022/868:

(2)Without prejudice to the provisions of the Act, due regard shall be made to the following non-exhaustive and indicative criteria for the imposition of administrative penalties on data intermediation services providers and recognised data altruism organisations for infringements of the obligations referred to in this regulation, where appropriate: (

1. a)the nature, gravity, scale and duration of the infringement; (
2. b)any action taken by the data intermediation services provider or recognised data altruism organisation to mitigate or remedy the damage caused by the infringement; (
3. c)any previous infringements by the data intermediation services provider or recognised data altruism organisation; (
4. d)the financial benefits gained or losses avoided by the data intermediation services provider or recognised data altruism organisation due to the infringement, insofar as such benefits or losses can be reliably established; Infringements. 3 4 [ S.L. 591.03 DATA GOVERNANCE (
5. e)any other aggravating or mitigating factors applicable to the circumstances of the case.

(3)The Malta Digital Innovation Authority may, at its discretion, prior to initiating any proceedings in relation to an infringement of the obligations regarding transfers of non-personal data to third countries pursuant to Article 5

(14)of Regulation (EU) 2022/868 consult with the Data Governance Council and, or any other relevant person.