Chapter 586

[ CAP. 586. DATA PROTECTION CHAPTER 586 DATA PROTECTION ACT AN ACT to repeal and to replace the Data Protection Act, Cap. 440. 28th May, 2018 ACT XX of 2018, as amended by Act XII of 2021 and Legal Notice 212 of 2023. ARRANGEMENT OF THE ACT Part I Part II Part III Part IV Part V Part VI Part VII Part VIII Preliminary Applicability Restrictions, Consultation and Prior Authorization Transborder data transfers The Information and Data Protection Commissioner Administrative fines and penalties Appeals General provisions First Schedule Second Schedule - Oath of Office Form A Articles 1-3 4 5-9 10 11 - 19 20 - 23 24 - 31 32 - 34 1 2 [ CAP. 586. DATA PROTECTION PART I Preliminary Short title. Purpose of the Act. Interpretation. 1. The short title of this Act is the Data Protection Act. 2. This Act implements and further specifies the relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 3. (1) In this Act unless the context otherwise requires "Commissioner" means the Information and Data Protection Commissioner appointed under article 11 and includes any officer or employee of the Commissioner authorised by him in that behalf;  Cap. 258. "identity document" means a legally valid identity document as provided in the Identity Card and other Identity Documents Act; "Minister" means the Minister responsible for data protection; "official statistics" shall mean information collected, analysed and produced for the benefit of the society to characterize collective phenomena in a considered population and produced by the National Statistics Office as provided for by law, or by other national authorities as designated by Eurostat following recommendation by the National Statistics Office; "the Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC; "Tribunal" means the Information and Data Protection Appeals Tribunal established under article 24. (2) The definitions in Article 4 of the Regulation shall apply to this Act. PART II Applicability Scope. 4. (1) Subject to the provisions of sub-article (2), the provisions of this Act shall apply to the processing of personal data, wholly or partly, by automated means and to such processing other than by automated means where such personal data forms part of a DATA PROTECTION [ CAP. 586. filing system or is intended to form part of a filing system: Provided that this Act shall not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Government of Malta when carrying out activities which fall within the scope of Chapter 2 of Title V of the Treaty on European Union; (c) by a natural person in the course of a purely personal or household activity; or (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security: Provided further that the Minister may by regulations, after consultation with the Commissioner and with the concurrence of the Minister responsible for the Police, make provisions on the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. (2) This Act shall apply to: (a) the processing of personal data in the context of the activities of an establishment of a controller or a processor in Malta or in a Maltese Embassy or High Commission abroad, regardless of whether the processing takes place in Malta or not; (b) the processing of personal data of data subjects who are in Malta by a controller or processor not established in the European Union, where the processing activities are related to: (i) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in Malta; or (ii) the monitoring of their behaviour in so far as their behaviour takes place within Malta; (c) the processing of personal data by a controller not established in the Union but in a place where the laws of Malta apply by virtue of public international law. 3 4 [ CAP. 586. DATA PROTECTION PART III Restrictions, Consultation and Prior Authorisation Restrictions. 5. The Minister may, after consultation with the Commissioner and with the concurrence of the Minister responsible for justice, by regulations provide for a restriction to the obligations to which the data controller or processor is subject pursuant to Article 23 of the Regulation. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. 6. (1) Subject to the provisions of sub-article (4), controllers and processors may derogate from the provisions of Articles 15, 16, 18 and 21 of the Regulation for the processing of personal data for scientific or historical research purposes or official statistics in so far as the exercise of the rights set out in those Articles: (a) is likely to render impossible or seriously impair the achievement of those purposes; and (b) the data controller reasonably believes that such derogations are necessary for the fulfilment of those purposes. (2) Subject to the provisions of sub-article (4), controllers and processors may derogate from the provisions of Articles 15, 16, 18, 19, 20 and 21 of the Regulation for the processing of personal data for archiving purposes in the public interest in so far as the exercise of the rights set out in those Articles: (a) is likely to render impossible or seriously impair the achievement of those purposes; and (b) the controller reasonably believes that such derogations are necessary for the fulfilment of those purposes. (3) Where data processing referred to in sub-articles (1) and (2) serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those subarticles. (4) Processing for the purposes referred to in sub-articles (1) and (2) shall be subject to appropriate safeguards for the rights and freedoms of the data subject, including pseudonymisation and other technical and organisational measures to ensure respect for the principle of data minimisation: Provided that, where such purposes can be fulfilled by processing which does not permit, or no longer permits, the identification of data subjects, those purposes shall be fulfilled in that manner. DATA PROTECTION [ CAP. 586. 7. A controller shall consult with, and obtain prior authorisation from, the Commissioner where the controller intends to process in the public interest: 5 Consultation and prior authorisation. (a) genetic data, biometric data or data concerning health for statistical or research purposes; or (b) special categories of data in relation to the management of social care services and systems, including for the purposes of quality control, management information and the general national supervision and monitoring of such services and systems: Provided that, where genetic data, biometric data or data concerning health are required to be processed for research purposes, the Commissioner shall consult a research ethics committee or of an institution recognised by the Commissioner for the purposes of this article. 8. An identity document shall only be processed when such processing is clearly justified having regard to the purpose of the processing and (a) the importance of a secure identification; or (b) any other valid reason as may be provided by Processing of an identity document. law: Provided that the national identity number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to the Regulation. 9. (1) Personal data processed for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with the provisions of the Regulation specified in subarticle (2) where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with any of the provisions as specified in sub-article (2) would be incompatible with such processing purposes: Provided that when reconciling the right to the protection of personal data with the right to freedom of expression and information, the controller shall ensure that the processing is proportionate, necessary and justified for reasons of substantial public interest. (2) For the purposes of the provisions of sub-article (1), the provisions of the following chapters of the Regulation may be exempted or derogated therefrom pursuant to Article 85(2) of the said Freedom of expression and information. 6 [ CAP. 586. DATA PROTECTION Regulation: (a) Chapter II (Principles): (i) Article 5(1)(a) to (e) (principles relating to processing); (ii) Article 6 (lawfulness); (iii) Article 7 (conditions for consent); (iv) Article 10 (data relating to criminal convictions, etc); (v) Article 11(2) (processing not requiring identification); (b) Chapter III (rights of the data subject): (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided); (ii) Article 14(1) to (4) (personal data collected other than from data subject); (iii) Article 15(1) to (3) (access to data and safeguards for third country transfers); (iv) Article 17(1) and (2) (right to erasure); (v) Article 18(1)(a), (b) and (d) (restriction of processing); (vi) portability); Article 20(1) and (2) (right to data (vii) Article 21(1) (objections to processing); (c) Chapter IV (controller and processor): (i) by default); Article 25 (data protection by design and (ii) Article 27 (representatives of controllers or processors not established in the Union); (iii) activities); Article 30 (records of processing (iv) Article 33 (notification of personal data breach to supervisory authority); (v) Article 34 (communication of personal DATA PROTECTION [ CAP. 586. data breach to the data subject); (vi) Article 42 (certification); (vii) Article 43 (certification bodies); (d) Chapter VII (co-operation and consistency): (i) Articles 60 to 62 (co-operation); (ii) Articles 63 to 67 (consistency). PART IV Transborder Data Transfers 10. In the absence of an adequacy decision pursuant to Article 45(3) of the Regulation, the Minister may, following consultation with the Commissioner, by regulations set limits to the transfer of specific categories of personal data to a third country or an international organisation for important reasons of public interest. Limits to transborder data transfers. PART V The Information and Data Protection Commissioner 11. (1) There shall be an Information and Data Protection Commissioner, who shall be appointed by the Prime Minister acting on the advice of the Cabinet of Ministers after consulting the Leader of the Opposition, to perform the duties of supervisory authority for the purposes of Chapter VI of the Regulation. (2) The Commissioner shall be responsible for monitoring and enforcing the application of the provisions of this Act and the Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing of personal data and to facilitate the free flow of personal data between Malta and any other Member State. (3) A person shall not be qualified to hold office as Commissioner if he: (a) is a Minister, Parliamentary Secretary, or a Member of the House of Representatives; or (b) is a judge or magistrate of the courts of justice; (c) is an officer in the public service; or (d) is a member of a local council; or or Information and Data Protection Commissioner. Amended by: XII.2021.12. 7 8 [ CAP. 586. DATA PROTECTION (e) has a financial or other interest in any enterprise or activity which is likely to affect the discharge of his functions as a Commissioner. (4) The Information and Data Protection Commissioner shall have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform his duties and exercise his powers in accordance with the provisions of Article 53(2) of the Regulation. Independence of functions. 12. (1) In the exercise of his tasks and powers in accordance with this Act and the Regulation, the Commissioner shall act with complete independence and shall be free from external influence, whether direct or indirect, and shall neither seek nor take instructions or direction from any person or entity. (2) It shall not be lawful for the Commissioner to carry out any other profession, business or trade or to hold any other office of profit whatsoever, even though of a temporary nature, with the exception of any temporary judicial office on any international court or tribunal or any international adjudicating body, and the office of examiner at a University and the Malta College of Arts, Science and Technology. (3) Any officers or employees of the Commissioner shall be chosen by the Commissioner and shall be subject to his exclusive direction. Legal personality and representation of the Commissioner. 13. (1) The Commissioner shall have a separate and distinct legal personality and shall be capable of entering into contracts, of acquiring, holding and disposing of any kind of property for the purposes of his tasks and powers, of suing and being sued, and of doing all such things and entering into all such transactions as are incidental or conducive to the effective performance of his tasks and exercise of his powers under this Act and the Regulation. (2) Any document purporting to be an instrument made or issued by the Commissioner and signed by him shall be received in evidence and shall, until the contrary is proved, be deemed to be an instrument made or issued by the Commissioner. Tenure of office. 14. (1) The Commissioner shall hold office for a term of five years and shall be eligible for reappointment on the expiration of his term of office. (2) The Commissioner shall not be removed from his office except by the Prime Minister upon an address of the House of Representatives supported by the votes of not less than two-thirds of all the members thereof and praying for such removal on the ground of proved inability to perform the duties of his office (whether arising from infirmity of body or mind or any other cause) or proved DATA PROTECTION [ CAP. 586. 9 misbehaviour. (3) The Commissioner shall nominate a person from his office to act as Deputy Commissioner and who shall have the qualifications, experience and skills, in particular in the area of the protection of personal data. (4) If the Commissioner resigns, if his office is otherwise vacant, if for any reason he is unable to perform the duties of his office, or for any other temporary purpose where the Commissioner considers it necessary not to carry out any of his duties that were he a judge of the superior courts he would abstain, the Deputy Commissioner shall perform the Commissioner’s duties and exercise his powers in accordance with the provisions of Article 53(2) of the Regulation. 15. (1) The Commissioner shall perform the duties assigned to him under this Act and the Regulation and shall carry out the functions assigned to him under the Freedom of Information Act and any other law. Functions and duties of the Commissioner. Cap. 496. (2) The Commissioner shall have the power to institute civil judicial proceedings in cases where the provisions of this Act or the Regulation have been or are about to be violated. (3) The Commissioner may seek the advice of, and may consult with, any other competent authority in the exercise of his functions under this Act and the Regulation. 16. (1) In the exercise of the investigative powers pursuant to Article 58 of the Regulation, or any other law, the Commissioner may request the assistance of the executive police in order to enter and search any premises. Commissioner’s right of access to information. (2) In the event of joint operations with supervisory authorities of one or more other Member States the Commissioner may, where appropriate, in accordance with the provisions of Article 63 of the Regulation, confer powers, including investigative powers, on the seconding supervisory authority’s members or staff: Provided that such powers are exercised under the guidance and in the presence of the Commissioner. 17. (1) The Commissioner and any officer and employee of the Commissioner shall, before assuming their duties, take the oath of office set out in the First Schedule, to carry out their duties with equity and impartiality and in accordance with the provisions of this Act and the Regulation, and shall be subject to the provisions of the Official Secrets Act, Professional Secrecy Act and the Code of Ethics applicable to public officers. (2) The oath of office shall be taken before the State Oath of office. Amended by: L.N. 212 of 2023.      Cap. 50. Cap. 377. 10 [ CAP. 586. DATA PROTECTION Advocate. Financial provisions.  Cap. 496. 18. (1) The financial resources required by the Commissioner for the effective performance of his tasks and exercise of his powers under this Act and the Regulation, under the Freedom of Information Act and under any other law, as may be fixed by the House of Representatives in accordance with this article, shall be a charge on the Consolidated Fund without the need of any further appropriation other than this Act. (2) Where during the course of any financial year the sum fixed by the House of Representatives is, in the opinion of the Commissioner, insufficient to enable him to efficiently and effectively fulfil his functions, the Commissioner shall prepare supplementary estimates for consideration by the House of Representatives. (3) The Commissioner shall cause to be prepared in every financial year, and shall not later than six months after the end of each such year adopt, estimates of the income and expenditure of the Commissioner for the next following financial year. (4) A copy of the estimates shall, upon their adoption by the Commissioner, be sent forthwith to the Minister and to the Minister responsible for finance. (5) The Minister shall at the earliest opportunity, and not later than six weeks after he has received a copy of the estimates from the Commissioner, approve the same with or without amendment after consultation with the Minister responsible for finance. Accounts and audit.  Cap. 496. 19. (1) The Commissioner shall cause to be kept proper accounts and other records in respect of his operations under this Act, the Regulation and under the Freedom of Information Act and any other law, and shall cause to be prepared a statement of accounts in respect of each financial year. (2) The accounts of the Commissioner shall be audited by an auditor or auditors to be appointed by the Commissioner: Provided that the Minister responsible for finance may, after consultation with the Minister, require the books or the accounts of the Commissioner to be audited or examined by the Auditor General who shall for the purpose have the power to carry out such physical checking and other certifications as he may deem necessary. (3) After the end of each financial year, and not later than the date on which the estimates of the Commissioner are forwarded to the Minister under article 18(4), the Commissioner shall cause a copy of the statement of account duly audited to be transmitted to the Minister and to the Minister responsible for finance together with a DATA PROTECTION [ CAP. 586. copy of any report made by the auditors on that statement or on the accounts of the Commissioner. (4) The Minister shall, at the earliest opportunity and not later than eight weeks after he has received a copy of every such statement and report, or if at any time during that period the House of Representatives is not in session, within eight weeks from the beginning of the next following session, cause every such statement and report to be laid on the Table of the House of Representatives. (5) The Commissioner shall, by not later than six months after the end of each financial year, make and transmit to the Minister and to the Minister responsible for finance a report dealing generally with the activities of the Commissioner during the financial year and containing such information relating to the proceedings and policy of the Commissioner as either of the said Ministers may from time to time require. The Minister shall, at the earliest opportunity and not later than eight weeks after he has received a copy of every such report, or if at any time during that period the House of Representatives is not in session, within eight weeks from the beginning of the next following session, cause a copy of every such report to be laid on the Table of the House of Representatives. PART VI Administrative Fines and Penalties 20. (1) Where the Commissioner imposes an administrative fine, he shall by order in writing require the controller or processor, as the case may be, to pay such administrative fine, which shall be due to the Commissioner as a civil debt: Administrative fines. Provided that such order shall be subject to the appeal procedure as established under article 26. (2) In the absence of an appeal, the decision of the Commissioner shall become final and shall constitute an executive title for the purposes of Title VII of the Code of Organization and Civil Procedure as if the decision had been ordered by a judgement of a court of civil jurisdiction. (3) Where a notice imposing an administrative fine is served on a person and (a) such person fails to appeal within such time as an appeal may be entered under article 26, and fails to pay the fine so imposed; or (b) such person appeals within such time to the Tribunal and the appeal is withdrawn or the Tribunal confirms the fine in the amount fixed by the Commissioner or in an amount reduced by it and no further appeal is filed with the     Cap. 12. 11 12 [ CAP. 586. DATA PROTECTION Court of Appeal, or if an appeal is filed with the Court of Appeal and such Court either confirms the decision taken or decides that a penalty is due in another amount, or the imposed penalty is not paid within fifteen days from the date of the decision or the withdrawal of the appeal, or the date when the Tribunal or the Court of Appeal confirms or varies the penalty as aforesaid, the Commissioner shall be entitled to take civil action to recover the amount due. Administrative fines on public authorities or bodies. 21. The Commissioner may, after giving due regard to the circumstances of the case pursuant to Article 83(2) of the Regulation, impose an administrative fine on a public authority or body: Provided that such a fine shall not exceed twenty-five thousand euro (€25,000) for each violation and, additionally, the Commissioner may impose a daily fine payment of twenty-five euro (€25) for each day during which such violation persists, which fine shall be determined and imposed by the Commissioner in accordance with the procedure under article 26 for an infringement of Article 83(4) of the Regulation: Provided further that such a fine shall not exceed fifty thousand euro (€50,000) for each violation and, additionally, the Commissioner may impose a daily fine payment of fifty euro (€50) for each day during which such violation persists, which fine shall be determined and imposed by the Commissioner, in accordance with the procedure stipulated under article 26 for an infringement of Articles 83(5) or 83(6) of the Regulation. Offences. 22. Without prejudice to the provisions of article 21 and Article 83 of the Regulation, any person who (a) knowingly provides false information to the Commissioner when so requested by the Commissioner pursuant to his investigative powers under Article 58 of the Regulation, or any other law; or (b) does not comply with any lawful request pursuant to an investigation by the Commissioner, shall be guilty of an offence against this article and shall, upon conviction, be liable to a fine (multa) of not less than one thousand, two hundred and fifty euro (€1,250) and not more than fifty thousand euro (€50,000) or to imprisonment for six months or to both such fine (multa) and imprisonment: Provided that no proceedings shall be instituted in respect of any offence under this article except where the Commissioner provides information to any officer of the Executive DATA PROTECTION [ CAP. 586. 13 Police. 23. (1) Where the Commissioner exercises his powers pursuant to the Regulation, or any other law, the decision of the Commissioner shall forthwith be served on the person to whom the decision is addressed, which decision shall be served either personally, by registered post to the person’s last known business or private address, or by electronic means that provide a reliable record of when service took place. Methods of service. (2) In the case of service by electronic means, the decision shall be deemed to have been served upon each person to whom the decision is addressed when the Commissioner has received: (a) an electronic receipt automatically generated by the e-mail server when the communication is read; (b) a written confirmation by return electronic mail from the person to whom the decision is addressed; or (c) a verbal confirmation from the person to whom the decision is addressed that the electronic mail was received. (3) If service is not effected within a week of issuing the decision, because the person to whom the decision refers could not be found or for any other reason attributable to the person to whom the decision is addressed, the Commissioner shall publish a notice in the Gazette and in one or more daily newspapers, stating that a decision has been taken in respect of the person to whom the decision is addressed and inviting him to collect the decision from the Commissioner’s office. In any such case, service shall be deemed to have been effected on the third day after the date of publication of the last notice. PART VII Appeals 24. (1) There shall be a tribunal to be known as the Information and Data Protection Appeals Tribunal, referred to in this Act as ''the Tribunal'', having the functions and powers assigned to it by this Act or by any other law. (2) The Tribunal shall consist of a chairperson and two other members appointed by the Minister. (3) The chairperson shall be an advocate with a minimum of twelve years legal experience and shall have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to fulfil his role. (4) The two other members mentioned in sub-article (2) Information and Data Protection Appeals Tribunal. 14 [ CAP. 586. DATA PROTECTION shall be persons who, in the opinion of the Minister, equally represent the interests of data subjects on the one hand, and of data controllers and data processors on the other, and who have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to fulfil their roles. (5) The chairperson and other members of the Tribunal shall hold office for a period of three years and cannot be removed during their term of office except on grounds of proved inability to perform the functions of their office, whether arising from infirmity of body or mind or any other cause, or proved misbehaviour.    Cap. 12. (6) A member of the Tribunal may be challenged or abstain for any of the reasons for which a judge may be challenged or abstain in accordance with article 734 of the Code of Organization and Civil Procedure. In any such case the Minister shall appoint a person, having the qualifications of the member challenged or abstaining, to sit as a member of the Tribunal in substitution of the said member. (7) A member of the House of Representatives or of a local council, a judge or a magistrate, or an officer in the public service shall be disqualified from being appointed or continuing to be a member of the Tribunal for so long as he holds that office. (8) The Minister shall also designate a person to serve as secretary to the Tribunal. Registry of the Information and Data Protection Appeals Tribunal. 25. (1) There shall be a Registry of the Tribunal and all records shall be filed therein and made accessible to the public. Procedure. 26. (1) Any person to whom a legally binding decision of the Commissioner is addressed, shall have the right to appeal in writing to the Tribunal within twenty days from the service of the said decision as provided in article 23. (2) The Secretary to the Tribunal shall be responsible for managing the Registry. The Secretary shall also perform any other duty which may be incumbent upon him under this Act or any rules made thereunder. (2) An appeal to the Tribunal may be made on any of the following grounds: (a) that a material error as to the facts has been (b) that there was a material procedural error; (c) that an error of law has been made; made; (d) that there was some material illegality, including unreasonableness or lack of proportionality. DATA PROTECTION [ CAP. 586. (3) An appeal from a decision of the Commissioner shall be filed in the Registry of the Tribunal and shall contain: (a) the grounds on which such appeal is based; (b) the names of the witnesses the appellant intends to produce in evidence, together with their full address, stating in respect of each of them the facts and proof he intends to establish by their evidence; and (c) any other documents as may be necessary in support of the appeal. (4) The Registry of the Tribunal shall, no later than ten days from the date of filing of the appeal: (a) serve a copy of the appeal on the Commissioner, and request him to file a statement on his decision together with any other information on which such decision was based, within twenty days from the date when the appeal was served; and (b) serve a copy of the appeal on the respondent or respondents to the appealed decision, and request the respondent or respondents to file a reply within twenty days of service of the appeal. (5) The respondent or respondents shall file their reply to the appeal in the Registry of the Tribunal within twenty days of service of the appeal. Such reply shall contain: (a) a statement of the facts upon which the respondent bases his rebuttal of the appellant’s claim; (b) the names of the witnesses the respondent intends to produce in evidence, together with their full address, stating, in respect of each of them, the facts and proof he intends to establish by their evidence; and (c) any other documents as may be necessary in support of the defence. (6) The reply, together with any documents in support thereof, shall be served without delay on the appellant and on the Commissioner by the Tribunal. (7) Upon the expiry of the time-limits for filing the Commissioner’s statement and the reply, the Tribunal shall fix a date and time for the hearing. The Tribunal shall notify such date and time to the appellant, the respondent or respondents to the appealed decision and to the Commissioner. 15 16 [ CAP. 586. DATA PROTECTION (8) The parties to an appeal may be represented or assisted by their advocates or legal procurators, or by any other person who enjoys their trust: Provided that no person shall claim fees for representing or assisting a party before the Tribunal unless such assistance is provided by an advocate or legal procurator. Competence of the Tribunal. 27. (1) The Tribunal shall be competent to hear and decide any appeal made to it in accordance with the provisions of this Act and, subject to the provisions of article 29, the decisions of the Tribunal shall be final and binding. (2) The Tribunal may summon any person to appear before it to give evidence and produce documents. The Tribunal may also appoint experts to advise it on any technical issue that may be relevant to its decision. On the day appointed by the Tribunal for the hearing of the appeal, it shall hear, under oath, the evidence of the appellant and of the respondent, as well as of other witnesses. The secretary shall issue the necessary summons by the method of service referred to in article 23 for any person involved in the hearing of the appeal. (3) The Tribunal shall hold its sittings in public unless, having regard to the nature of the appeal or any other matter before it, it deems it proper to conduct the proceedings or part thereof in private. (4) The Tribunal shall have the same powers as are competent to the First Hall, Civil Court according to law. (5) Without prejudice to the provisions of this Act or any other law, the Tribunal shall regulate its own procedure. (6) If any party requires the attendance of witnesses, that party shall complete Form A in the Second Schedule, which shall be signed by the Chairman of the Tribunal and served on each witness in accordance with sub-article (2). Decisions of the Tribunal. 28. (1) (a) its entirety; In determining an appeal the Tribunal may: dismiss the appeal and confirm the decision in (b) substitute the decision; (c) modify or vary the decision; or (d) annul the decision. (2) The Tribunal shall give reasons for its decision and shall cause such decision to be made public omitting, if it deems it DATA PROTECTION [ CAP. 586. 17 appropriate for reasons of confidentiality, the identity of the persons involved. (3) The effects of a decision of the Commissioner which is appealed from shall not, except where the Tribunal or the Court of Appeal, as the case may be, so orders, be suspended by virtue of the appeal: Provided that any administrative fine imposed by the Commissioner shall not apply until the person on whom the administrative fine is imposed has exhausted all legal remedies provided pursuant to articles 26 and 29, or if the person to whom the decision is addressed has permitted the relevant time-limits to expire without availing himself of the said legal remedies. (4) The decisions of the Tribunal shall be notified to all parties to the appeal and to the Commissioner, by any of the methods of service referred to in article 23. 29. Any party to an appeal before the Tribunal who feels aggrieved by a decision of the Tribunal, or the Commissioner if he feels aggrieved by any such decision, may appeal to the Court of Appeal as constituted in accordance with article 41(9) of the Code of Organization and Civil Procedure by means of an application filed in the registry of that court within twenty days from the date on which the decision of the Tribunal was notified pursuant to article 26. Court of Appeal.    Cap. 12. 30. (1) Without prejudice to any other remedy available to him, including the right to lodge a complaint with the Commissioner, a data subject may, where he believes that his rights under the Regulation or this Act have been infringed as a result of the processing of his personal data in contravention of the provisions of the Regulation or this Act, by sworn application filed before the First Hall of the Civil Court, institute an action for an effective judicial remedy against the controller or processor concerned. Right to take action against the controller or processor. (2) A data subject may also, by sworn application filed before the First Hall of the Civil Court, institute an action for damages against the controller or processor who processes personal data in contravention of the provisions of the Regulation or this Act. (3) If in determining an action under sub-article (2) the court finds that the controller or processor is liable for the damage caused pursuant to Article 82 of the Regulation, the court shall determine the amount of damages, including, but not limited to, moral damages as the court may determine, due to the data subject. (4) Any action under this article shall be instituted within a period of twelve months from the date when the data subject became aware, or ought to have reasonably become aware, of such a contravention, whichever is the earlier. 18 [ CAP. 586. Actions against the Commissioner. DATA PROTECTION 31. (1) Where the Commissioner fails to act in accordance with Article 78(2) of the Regulation, the data subject may appeal to the Tribunal in accordance with the procedures established in article 26. (2) Where the Tribunal finds that such an appeal is justified it shall, where appropriate, order the Commissioner to update the data subject on the progress or outcome of the complaint lodged or order the Commissioner to handle the complaint lodged in accordance with Article 77(1) of the Regulation. PART VIII General Provisions Accreditation of certification bodies.  S.L. 419.07 32. (1) The certification bodies referred to in Article 43 of the Regulation shall be accredited by the National Accreditation Board (Malta) as established by regulation 3 of the National Accreditation Board (Malta) (Establishment) Regulations. (2) The Board referred to in sub-article (1) shall accredit certification bodies in accordance with EN-ISO/IEC 17065/2012 and with the additional criteria and requirements established by the Commissioner. (3) For the purposes of this article, the National Accreditation Board (Malta) may consult the Commissioner in the process of accrediting certification bodies. (4) Where the Commissioner concludes that the conditions for accreditation are not, or are no longer met, or where action taken by a certification body infringes the Regulation, the Commissioner shall advise the National Accreditation Board (Malta) not to issue such accreditation, or to revoke such accreditation, as the case may be. Power to make regulations. 33. The Minister may, after consultation with the Commissioner, prescribe regulations for the better carrying out of the provisions of this Act and the Regulation, and without prejudice to the generality of the foregoing and the provisions of the Regulation, may in particular prescribe regulations concerning: (a) any Commissioner; (b) this Act; fees that may be levied by the the criminal penalties that may be imposed under (c) for establishing rules, procedures, formalities and time limits in respect of any matter provided for under this Act; DATA PROTECTION [ CAP. 586. (d) the extension of the application of this Act to any particular activity or sector and to provide for the manner in which data protection is to be implemented in specific sectors or in respect of specific activities; (e) for anything that may be prescribed under any of the provisions of this Act or the Regulation; (f) the cases, other than those referred to in Article 37(1) of the Regulation, where the controller or processor or associations and other bodies representing categories of controllers or processors shall designate a data protection officer; (g) the establishment of a lower age than sixteen years where the processing of the personal data of a child shall be deemed to be lawful in the absence of consent by the holder of parental responsibility over the child, provided that such lower age is not below thirteen years pursuant the provisions of Article 8(1) of the Regulation; (h) to amend the Schedules to this Act; and (i) on any other matter relating to data protection. 34. (1) The Data Protection Act, hereinafter referred to as "the repealed Act", is hereby repealed, and any references in any law to the repealed Act shall be construed as references to this Act. (2) Notwithstanding the provisions of sub-article (1): (a) the repealed Act shall remain in force for the purpose of any act, decision, action or proceedings taken in respect of any breach of the repealed Act that occurred or were instituted prior to the coming into force of this Act; and (b) any subsidiary legislation made under the provisions of the repealed Act shall, until other provision is made under or by virtue of this Act, continue in force and have effect as if it was made under this Act. Repeal and Savings. Cap. 440. 19 20 [ CAP. 586. DATA PROTECTION FIRST SCHEDULE (Article 17) Oath of Office I ……………………………………… solemnly swear / affirm that I will faithfully and conscientiously perform my duties as (Information and Data Protection Commissioner / Officer of the Information and Data Protection Commissioner / Employee of the Information and Data Protection Commissioner) in terms of the Data Protection Act, the General Data Protection Regulation and in accordance with the laws of Malta, without fear or favour. (So help me God). DATA PROTECTION [ CAP. 586. SECOND SCHEDULE (Article 27) FORM A Summons of Witnesses INFORMATION AND DATA PROTECTION APPEALS TRIBUNAL DATA PROTECTION ACT In the case..................................................................... versus........................................................ Application of Respectfully requests the issue of a summons of a witness in the above-stated cause against the person mentioned hereunder to attend for the hearing at the time stated hereunder, and at any other hearing as may be required, and to bring with him/ her any documents referred to hereunder. Name and address (home or work or e-mail) of the person summoned to attend as a witness: ……………………………………........................................... ………………………………………………………………… Documents to be brought by him/her: ………………………………………………………………… Date, time and place where he/she is to attend: ………………………………………………………………… The said ……………………………………is hereby being warned that should he/she fail to attend the sitting without informing the Tribunal of his/her unavailability beforehand, he/ she may be compelled to attend by a warrant of escort and shall be liable to all consequences according to the provisions of the Code of Organization and Civil Procedure. Given by order of the Information and Data Protection Appeals Tribunal. This, .................... day of .............................. 20............... 21