Malta

Malta did not adopt any data protection statute during the first-generation period.

Malta implemented the Data Protection Directive 95/46 through Data Protection Act 2001.

 

Preliminary Remark: Derogations were of unclear scope and meaning. Sections 6(1)-(3) of the Maltese Data Protection Act provided:

 

Section 6(1) refers to the European Convention Act which in its First Schedule repeats verbatim Article 10(1) of the European Convention on Human Rights which establishes a broad right to freedom of expression, including the imparting and receipt of information without interference by public authority. This right is in clear tension with many data protection requirements. On the other hand, Article 10(2)’s specific validation of permissible interference with this right in order to safeguard the rights of others complicates the picture. Moreover, the rest of Section 6 demonstrates a clear intention not to exclude media activity absolutely and unconditionally from the data protection regime. Overall, it seems that the purpose of the scheme set out in Section 6 was to establish a general expectation that ordinary data protection provisions would not be applicable to media expression as long as certain minimum standards were complied with. Malta can thus be deemed to have established a permissive public interest derogation with regard to the data quality principles, proactive direct and indirect transparency provisions, retroactive transparency provisions, sensitive data rules, the legitimating ground condition, the notification of processing condition and the international data transfer condition. No code of conduct nor formal measures and procedures were ever drawn up.

 

Whilst granting a particular priority to the journalistic freedoms set out in the Press Act, Section 6 was not limited to these or similarly special types of expression but rather in principle extended to the European Convention right to freedom of expression in its entirety.It therefore could have had some application to broad as well as special expression.

 

The law did not apply to the processing of personal data where such processing was undertaken by a natural person in the course of a purely personal activity (Data Protection Act 2001, art. 5(a)).

 

The data quality principles were fully applicable with the exception of compatibility and time-limit provisions.[1] Furthermore, no exemption was granted from proactive direct and indirect transparency (ibid, art. 8). The Act also provided for a derogation from reactive transparency rule (subject access) where data was processed solely for the purposes of scientific research or kept in a personal form only so long as necessary to create statistics and in any case only where data was not used for taking measures or decisions regarding a particular individual or where there was a risk of breaching the privacy of the data subject (ibid, art. 23(2)). A special vires was established for the processing of sensitive personal data for statistical or research purposes where necessary processing and carried out in the public interest or the exercise of official authority. Where this was approved by the DPA who, in the case of research, was acting on the advice of a recognized research ethics committee then this would be deemed satisfied (ibid, art. 16).  These provisions excluded criminal-related data which could only be processed under the control of official authority unless another law specifically provided otherwise (Ibid, art. 17).  Unlike in Directive 95/46 itself, the disproportionate limitation to proactively providing transparency information where personal data was not collected direct from the data subject was limited to processing for “statistical purposes” or the “purposes of historical or scientific research” (ibid, s. 20(1)).

Malta adopted third-generation data protection legislation through the Data Protection Act 2018 which inter alia  implemented the GDPR.

 

Section 9 sets out a derogation including for journalistic purposes or the purposes of academic, artistic or literary expression which is applicable to the data protection principles, the transparency rules, the rules applying to criminal-related data, the need for a legal basis for processing, and the data registration requirement. Any use of the derogation is subject to an ultimately strict or objective public interest test. In sum, not only must ‘compliance’ with a derogated provision be ‘incompatible’ with journalism ‘having regard to the importance of the right of freedom of expression and information in a democratic society’, but the journalist is specifically obliged to ‘ensure that the processing is proportionate, necessary and justified for reasons of substantial public interest’.[7]  For unclear reasons, no derogation is set out from the rules applicable to non-criminal sensitive data.  These provisions do not expressly establish priority over the knowledge facilitation framework.

 

Section 9 in principle encompasses not just journalistic, academic, artistic and literary expression but all exercises of the right to freedom of expression and information.  It therefore has potential application to not only special but also broad expression.

 

 

Section 6 of the new law provides for limited derogations for knowledge facilitation purposes. Provisions for derogation and safeguards follow and do not go beyond that envisaged in Article 89 GDPR. They thus cover the processing for scientific or historical research purposes, official statistics, and archiving purposes in the public interest. Derogations are limited to Arts. 15 (subject access), 16 (right to restriction), 18 (right to restriction) and 21 (right to rectification) GDPR, and, in respect of processing for archiving purposes in the public interest, Art. 19 (notification of rectification, erasure or restriction). All these derogations are permitted only insofar as (i) the exercise of a subject’s rights under those GDPR provisions is likely to render impossible or seriously impair the achievement of those purposes; and (ii) the controller reasonably believes such derogations are necessary for the fulfilment of those purposes. Alongside these derogatory provision, the section states that processing for these purposes shall be subject to appropriate safeguards for subject’s rights and freedoms, including pseudonymization and other technical and organizational measures to ensure the respect for the principle of data minimization and where such purposes can be fulfilled by processing which is not permitted, or no longer permits, identification of data subjects, those purposes shall be fulfilled in that manner. Section 7 of the law requires that any processing in the public interest of genetic data, biometric data or data concerning health requires DPA authorisation who must consult with a Research Ethics Committee which it has recognised.  Besides setting down additional requirements here, it is likely that by implication this empoweres the DPA to authorise processing here even where a special legal basis would not otherwise exist.