Page 1

RESTRICTION OF PROTECTION
DATA (OBLIGATIONS AND RIGHTS)

[ SL586.09

1

SUBSIDIARY LEGISLATION 586.09
REGULATIONS ON THE RESTRICTION OF
DATA PROTECTION
(OBLIGATIONS AND RIGHTS)
June 1, 2018

LEGAL NOTICE 177 of 2018.

1.
The title of these regulations is the Regulations
on Restricting Data Protection (Obligations and Rights).

Title.

2.
In these regulations, as long as the wording does not
does not otherwise require:

Meaning.

"Act" means the Act on the Protection of Privacy and Data ;

Cap. 586

"Commissioner" has the same meaning as is assigned to it
in article 3 of the Act; u
"Regulation" means Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to data processing
personal data and on the free movement of such data , and to delete
Directive 95/46 / EC.
3.
The scope and purpose of these
regulations is to apply restrictions to certain obligations and
rights provided for in Article 23 of the Regulation.

Field of
application and
purpose.

4.
Any restriction on the rights of the data subject
referred to in Article 23 of the Regulation shall apply only where
such restrictions are a necessary measure:

Restrictions.

(a)
to safeguard and maintain security
national security, defense and relations
Malta International;
(b)
for prevention, detection, investigation and
prosecution of criminal offenses, including measures to prosecute
combating any money laundering activity, and for the execution of
criminal penalties;
(c)
for the administration of all taxes, levies,
fines, dues or other money due or payable
to the State, under the Income Tax Act, the Act
on Tax Administration, the Value Act
Added, the Customs Ordinance, the Excise Duty Act and the
Rights Ordinance, and any other law permitting that
collect revenue in any way for the Government of Malta;

Chap.123.
Cap. 372.
Cap. 406.
Cap. 37.
Cap. 382.
Cap. 35.

Page 2

RESTRICTION OF PROTECTION
DATA (OBLIGATIONS AND RIGHTS)

[ SL 586.09

2

(d)
for the administration of security benefits
in accordance with the provisions of the Social Security Act
and where such data have been obtained under the obligation of confidentiality
when an anti-fraud investigation is being conducted;

Cap. 318.

(e)
for the establishment, exercise and defense of a claim
and for legal proceedings that may be initiated under any law;
(f)

for the performance of the functions of the Commissioner;

(g)
for the provision of professional services in relation to
the performance of social work or social assistance by
public authority, public body, voluntary organization
or any other body that provides these services, and so on but that such
data has been obtained under an obligation of confidentiality
specifically for the purposes of providing those services
to the beneficiary;
(h)
for data on health which are processed and where
the application of the rights and obligations referred to in the article
5 (1) of the Act is likely to cause serious harm to the vital interests of
patient; or
(i)
for matters relating to citizenship
Maltese where the Minister responsible for citizenship, or
any person authorized to act on his behalf, shall refuse
application to obtain Maltese citizenship under the Act on
Maltese Citizenship.

Chap.188.

Safeguards and
retention periods.

5.
(1)
Personal data subject to restriction
referred to in regulation 4 shall not be subject to processing which is
incompatible with the purposes for which those data were collected , provided
this is not provided for by law or with the explicit consent of the subject of the
data .
(2)
The data controller shall, in accordance with
Article 32 of the Regulation, implements technical measures and
appropriate organizational arrangements to protect processed personal data
in accordance with these regulations against accidental destruction or
loss or illegal forms of processing.
(3)
Retention period to be applied to data
personal data processed under these regulations shall not be
more than is necessary for the purposes of processing such
personal data , or shall not exceed the period required to
the objective of the restriction is achieved, or as provided by law.

Information to
data subjects .

6.
The data controller shall inform the subject of the
data on any restrictions provided for under these regulations:
However, such disclosure shall not prejudice the

Page 3

RESTRICTION OF PROTECTION
DATA (OBLIGATIONS AND RIGHTS)

[ SL586.09

for the purposes of the restriction applied in accordance with these
regulations.
7.
Any restrictions applied under these regulations
it must respect the essence of fundamental rights and freedoms
of the data subject and shall be a necessary measure and
proportionate.

Proportionality and
necessity.

3

