skip to content

Data Protection Laws and Freedom of Expression: MaltaFile:Flag of Malta.svg


Constitutional/Primary Law Background - see also ECHR and EU Charter

Article 42 of the contemporary Maltese Constitution (1964 as revised 2016) prohibits hinderance (absent consent or (for minors) parental discipline) with freedom of expression including holding opinions and receiving and communicating ideas and information.  Whilst there is not protection of data protection or even privacy as such, this same article likewise prohibits interference with correspondence.  Article 38 likewise prohibits entry onto an individual’s premises but this is subject to a wide range of potential legal limitations so long as this is shown to be reasonably justifiable in a democratic society.

These express rights guarantees trace back to the original Malta Independence Constitution of 1964.


First-Generation Statutory Law

Malta did not adopt any data protection statute during the first-generation period.

Second-Generation Statutory Law

Malta implemented the Data Protection Directive 95/46 through Data Protection Act 2001.
Special Expression Derogation
Preliminary Remark: Derogations were of unclear scope and meaning. Sections 6(1)-(3) of the Maltese Data Protection Act provided:
  1. Subject to the following provisions of this article, nothing in this Act shall prejudice the application of the European Convention Act relating to freedom of expression, or the provisions of the Press Act relating to journalistic freedoms.
  2. Notwithstanding the provisions of subarticle (1) the [data protection] commissioner shall encourage the drawing up of a suitable code of conduct to be applicable to journalists and to the media to regulate the processing of any personal data and the code of conduct shall provide appropriate measures and procedures to protect the data subject having regard to the nature of the data.
  3. In the absence of such a code of conduct, the Commissioner may establish specific measures and procedures to protect the data subjects; in such a case journalists and the media are to comply with measures and procedures so established.
Section 6(1) refers to the European Convention Act which in its First Schedule repeats verbatim Article 10(1) of the European Convention on Human Rights which establishes a broad right to freedom of expression, including the imparting and receipt of information without interference by public authority. This right is in clear tension with many data protection requirements. On the other hand, Article 10(2)’s specific validation of permissible interference with this right in order to safeguard the rights of others complicates the picture. Moreover, the rest of Section 6 demonstrates a clear intention not to exclude media activity absolutely and unconditionally from the data protection regime. Overall, it seems that the purpose of the scheme set out in Section 6 was to establish a general expectation that ordinary data protection provisions would not be applicable to media expression as long as certain minimum standards were complied with. Malta can thus be deemed to have established a permissive public interest derogation with regard to the data quality principles, proactive direct and indirect transparency provisions, retroactive transparency provisions, sensitive data rules, the legitimating ground condition, the notification of processing condition and the international data transfer condition. No code of conduct nor formal measures and procedures were ever drawn up.
Broad Expression
Whilst granting a particular priority to the journalistic freedoms set out in the Press Act, Section 6 was not limited to these or similarly special types of expression but rather in principle extended to the European Convention right to freedom of expression in its entirety.It therefore could have had some application to broad as well as special expression.
Personal Exemption
The law did not apply to the processing of personal data where such processing was undertaken by a natural person in the course of a purely personal activity (Data Protection Act 2001, art. 5(a)).
Knowledge Facilitation Framework
The data quality principles were fully applicable with the exception of compatibility and time-limit provisions.[1] Furthermore, no exemption was granted from proactive direct and indirect transparency (ibid, art. 8). The Act also provided for a derogation from reactive transparency rule (subject access) where data was processed solely for the purposes of scientific research or kept in a personal form only so long as necessary to create statistics and in any case only where data was not used for taking measures or decisions regarding a particular individual or where there was a risk of breaching the privacy of the data subject (ibid, art. 23(2)). A special vires was established for the processing of sensitive personal data for statistical or research purposes where necessary processing and carried out in the public interest or the exercise of official authority. Where this was approved by the DPA who, in the case of research, was acting on the advice of a recognized research ethics committee then this would be deemed satisfied (ibid, art. 16).  These provisions excluded criminal-related data which could only be processed under the control of official authority unless another law specifically provided otherwise (Ibid, art. 17).  Unlike in Directive 95/46 itself, the disproportionate limitation to proactively providing transparency information where personal data was not collected direct from the data subject was limited to processing for “statistical purposes” or the “purposes of historical or scientific research” (ibid, s. 20(1)).
Parliamentary Debates
Special Expression Derogation
During the Parliament’s second reading, Joe Sammut MP observed that the media had both good and bad sides. While it was a pillar of democracy, exposing unacceptable political behavior and keeping people across borders informed, it might also be very intrusive of people’s privacy. He, in particular, mentioned paparazzi. He asked how far the media was allowed to go and which data they should legitimately be able to collect. Rather than discussing the provision in the Data Protection Act, he advocated for a code of ethics, which should be drawn up for the media to follow. He was particularly concerned with the regulation of cross-border transmission of data for journalistic purposes.[2]
Jose Herrera MP stated that the proposed Data Protection Act was too vague to satisfy the European Convention on Human Rights’ condition of a legal basis to limit journalistic freedom of expression. He pleaded for a code of ethics, drafted by authorities, to limit the collection of data for journalistic purposes.[3]
Interior minister Tonio Borg emphasised the importance of protecting journalistic freedom of expression. At the same time, he did, however, also point out that investigative journalists may be very disruptive for police operations.[4] He continued to argue that the draft would adequately protect and not violate journalistic freedom of expression, in particular the principle of source protection.[5]
Jean Pierre Farrugia MP cautioned that the media often reported misinformation. While the media was important, its freedom should not be unfettered.[6]
Broad Expression Derogation
Notwithstanding the broad phrasing of Section 6, the debate in Parliament focused on journalism (see above).
Personal Exemption
No discussions found.
Knowledge Facilitation Framework
No discussions found.

Third-Generation Statutory Law

Malta adopted third-generation data protection legislation through the Data Protection Act 2018 which inter alia  implemented the GDPR.
Special Expression Derogation
Section 9 sets out a derogation including for journalistic purposes or the purposes of academic, artistic or literary expression which is applicable to the data protection principles, the transparency rules, the rules applying to criminal-related data, the need for a legal basis for processing, and the data registration requirement. Any use of the derogation is subject to an ultimately strict or objective public interest test. In sum, not only must ‘compliance’ with a derogated provision be ‘incompatible’ with journalism ‘having regard to the importance of the right of freedom of expression and information in a democratic society’, but the journalist is specifically obliged to ‘ensure that the processing is proportionate, necessary and justified for reasons of substantial public interest’.[7]  For unclear reasons, no derogation is set out from the rules applicable to non-criminal sensitive data.  These provisions do not expressly establish priority over the knowledge facilitation framework.
Broad Expression
Section 9 in principle encompasses not just journalistic, academic, artistic and literary expression but all exercises of the right to freedom of expression and information.  It therefore has potential application to not only special but also broad expression.
Personal Exemption – see GDPR, art. 2(2)(c)
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Section 6 of the new law provides for limited derogations for knowledge facilitation purposes. Provisions for derogation and safeguards follow and do not go beyond that envisaged in Article 89 GDPR. They thus cover the processing for scientific or historical research purposes, official statistics, and archiving purposes in the public interest. Derogations are limited to Arts. 15 (subject access), 16 (right to restriction), 18 (right to restriction) and 21 (right to rectification) GDPR, and, in respect of processing for archiving purposes in the public interest, Art. 19 (notification of rectification, erasure or restriction). All these derogations are permitted only insofar as (i) the exercise of a subject’s rights under those GDPR provisions is likely to render impossible or seriously impair the achievement of those purposes; and (ii) the controller reasonably believes such derogations are necessary for the fulfilment of those purposes. Alongside these derogatory provision, the section states that processing for these purposes shall be subject to appropriate safeguards for subject’s rights and freedoms, including pseudonymization and other technical and organizational measures to ensure the respect for the principle of data minimization and where such purposes can be fulfilled by processing which is not permitted, or no longer permits, identification of data subjects, those purposes shall be fulfilled in that manner. Section 7 of the law requires that any processing in the public interest of genetic data, biometric data or data concerning health requires DPA authorisation who must consult with a Research Ethics Committee which it has recognised.  Besides setting down additional requirements here, it is likely that by implication this empoweres the DPA to authorise processing here even where a special legal basis would not otherwise exist.
Parliamentary Debates
The Special Expression Derogation was brought up by the Standing Committee for Draft Laws, which noted that it will be difficult to determine what constitutes a necessary, proportionate and justified derogation from data protection provisions. Such determinations would, however, fall within the realm of lawyers and tribunals.[8]
Parliament did not debate any of other relevant provisions.

[1] Art. 8 Data Protection Law.
[2] MP Joe Sammut, Plenary Session, Sitting No. 421 (8 November 2000) (last accessed 12 December 2020).
[3] Malta, ‘Debates Tal-Kamra Tad-Deputati (Rapport Ufficjali u Revedut)’ (13 November 2000).
[4] Interior Minister Tonio Borg, Plenary Session, Sitting No. 422 (13 November 2000)  (last accessed 12 December 2020).
[5] Interior Minister Tonio Borg, Plenary Session, Sitting No. 422 (13 November 2000)  (last accessed 12 December 2020).
[6] MP Jean Pierre Farrugia, Plenary Session, Sitting No. 424 (14 November 2000) (last accessed 12 December 2020).
[7] Malta, Data Protection Act 2018, sec 9.
[8] Malta, ‘Kamra Tad-Deputati: Kumitat Permanenti Ghall-Konsiderazzjoni Ta’ Abbozzi Ta’ Ligi (Rapport Ufficjali u Rivedut)’ ( 24 May 2018) (last accessed 12 December 2020).