Data Protection

Whenever any person or entity (“the data processor”) intends to process any personal information relating to an individual such as:

• name, address, contact number
• credit card numbers
• salary
• preferences or usage patterns in relation to a website, or
• personal photographs

that person or entity undertaking the processing of the data is legally obliged to notify the Malta Data Protection Commissioner (“the DPC”) prior to commencing any such processing, in terms of the Malta Data Protection Act (Chapter 440 of the Laws of Malta).

The act of “processing” is legally defined to include any of the following actions done in relation to personal data:

• collection;
• recording;
• organisation;
• storage;
• adaptation;
• alteration;
• retrieval;
• gathering;
• use;
• disclosure by transmission or dissemination;
• alignment or combination;
• blocking, erasure or destruction.

Thus, as a result of these rules, every employer and every undertaking that operates a manual or electronic database containing personal data is subject to the obligation of notification.

Notification is a one-time requirement which is satisfied by completing and submitting the appropriate notification form to the DPC. However the DPC must be duly notified in the event of any amendments to information provided in the original form.

A separate form must be completed when personal data is transferred to countries outside the European Union (so-called “third-countries”), and in such cases the DPC has full discretion to decide on the manner in which such transfer is to be carried out. The DPC may, for example oblige the person or entity transferring the data to enter into an agreement with the receiver of the data (being a non-EU Member State), if it deems that such country does not have levels of protection of personal data which are of the same level as those found in the European Union.

An annual notification fee is due by all persons or entities data controllers.

For information relating to your obligations as a data processor, and for assistance in relation to notification with the Data Protection Commissioner, kindly contact us on tmt [at] zammit-law [dot] com