Cap 440.fm DATA PROTECTION [CAP. 440. 1
CHAPTER 440
DATA PROTECTION ACT To make provision for the protection of individuals against the violation
of their privacy by the processing of personal data and for matters connected therewith or ancillary thereto.
22nd March, 2002* 15th November, 2002†
15th July, 2003‡
ACT XXVI of 2001, as amended by Acts XXXI of 2002 and IX of 2003; Legal Notices 181 and 186 of 2006, 426 of 2007; Acts XVI of 2008 and XXV of 2012; and Legal Notice 426 of 2012.
PART I - PRELIMINARY
Short title.1. The short title of this Act is the Data Protection Act. Interpretation. Amended by: XVI. 2008.46; XXV. 2012.2; L.N. 426 of 2012.
2. In this Act, unless the context otherwise requires: "administrative fine" means a fine which may be determined and
imposed by the Commissioner, as prescribed in the Third Schedule; "blocking" in relation to personal data, means the operation to
suspend modification of data or suspend or restrict the provision of information to a third party when such provision is so suspended or restricted in accordance with the provisions of this Act;
"Commissioner" means the Information and Data Protection Commissioner appointed under article 36 and includes any officer or employee of the Commissioner authorised by him in that behalf;
"consent" means any freely given specif ic and informed indication of the wishes of the data subject by which he signifies his agreement to personal data relating to him being processed;
"controller of personal data" or "controller" means a person who alone or jointly with others determines the purposes and means of the processing of personal data;
"court penalty" means a penalty which is enforceable by prosecution in the Courts of Malta, as prescribed in the Second Schedule;
"data subject" means a natural person to whom the personal data relates;
*Part VIII (articles 36 to 53, both inclusive) was brought into force as from 22nd March, 2002, by Legal Notice 70 of 2002. †Articles 2 and 54 were brought into force as from 15th November, 2002, by Legal Notice 382 of 2002. ‡Articles 3 to 28 (both inclusive) were brought into force as from 15th July, 2003, by Legal Notice 150 of 2003 - but see Legal Notice 150 of 2003 re applicability of provisions of articles 7 to 9 and 12 to 17. Part VII (articles 29 to 35, both inclusive) and article 55 were brought into force as from 15th July, 2003, by Legal Notice 151 of 2003. Article 56 of Part IX was brought into force as from 15th July, 2003, by Legal Notice 156 of 2003.
2 [CAP. 440. DATA PROTECTION
Cap. 258.
"a legally valid identification document number" means the identifying number contained in a legally valid identification document as provided in the Identity Card and other Identity Documents Act;
"Minister" means the Minister responsible for freedom of information and data protection;
"personal data" means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
"personal data filing system" or "filing system" means any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
"personal data representative" means a person, appointed by the controller of personal data, who shall independently ensure that the personal data is processed in a correct and lawful manner;
"prescribed" means prescribed by regulations made by the Minister in accordance with the provisions of this Act, after consultation with the Commissioner;
"processing" and "processing of personal data" mean any operation or set of operations which is taken in regard to personal data, whether or not it occurs by automatic means, and includes the collection, recording, organisation, storage, adaptation, alteration, retrieval, gathering, use, disclosure by transmission, dissemination or o therwise making in format ion ava i lab le , a l ignmen t o r combination, blocking, erasure or destruction of such data;
"processor" means a person who processes personal data on behalf of a controller;
"recipient" means a person to whom personal data is provided; however, when personal data is provided in order that the Commissioner may perform such supervision, control or audit that it is under a duty to attend to, the Commissioner shall not be regarded as a recipient;
"sensitive personal data" means personal data that reveals race or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, health, or sex life;
"third country" means a state that is not included in an Order issued for the purpose of determining which states are not to be considered as a third country for the purposes of this Act as may be prescribed from time to time under this Act;
"third party" means a person other than the data subject, the controller of personal data, the personal data representative, the processor and such persons who under the direct responsibility of the controller of personal data or the processor are authorised to process personal data;
"Tribunal" means the Information and Data Protection Appeals
DATA PROTECTION [CAP. 440. 3
Tribunal, established under article 48.
PART II - APPLICABILITY
Mode of Processing.
3. The provisions of this Act shall apply to the processing of personal data, wholly or partly, by automated means and to such processing other than by automated means where such personal data forms part of a filing system or is intended to form part of a filing system.
Territorial scope.4. (1) This Act shall also apply: (a) to the processing of personal data carried out in the
context of the activities of an establishment of a controller in Malta or in a Maltese Embassy or High Commission abroad;
(b) to the processing of personal data where the controller is established in a third country provided that the equipment used for the processing of the personal data is situated in Malta.
(2) Without prejudice to the following proviso, the provisions of subarticle (1)(b) shall not apply if the equipment is used only for purposes of transit of information between a third country and another such country:
Provided that the controller in such a case shall appoint a person established in Malta to act as his representative.
Non-applicability of the Act.
5. This Act shall not apply - (a) to processing of personal data where such processing
is undertaken by a natural person in the course of a purely personal activity; and
(b) to processing operations concerning public security, defence, State security (including the economic well being of the State when the processing operation relates to security matters) and activities of the State in areas of criminal law:
Provided that the Minister may, after consultation with the Commissioner and with the concurrence of the Minister responsible for the Police, by regulations make provisions extending the applicat ion of this Act or adding to or derogating from the provisions of this subarticle to enforce the provisions of any international obligation, convention or treaty relating to the protection of personal data, to which Malta is a party, or may become a party.
Freedom of expression
Cap. 319. Cap. 248.
6. (1) Subject to the following provisions of this article, nothing in this Act shall prejudice the application of the provisions of the European Convention Act relating to freedom of expression, or the provisions of the Press Act relating to journalistic freedoms.
(2) Notwithstanding the provisions of subarticle (1) the Commissioner shall encourage the drawing up of a suitable code of conduct to be applicable to journalists and to the media to regulate the processing of any personal data and the code of conduct shall provide appropriate measures and procedures to protect the data
4 [CAP. 440. DATA PROTECTION
subject, having regard to the nature of the data. (3) In the absence of such code of conduct, the Commissioner
may establish specific measures and procedures to protect the data subjects; in such a case journalists and the media are to comply with measures and procedures so established.
(4) If the measures and procedures contained in the code of conduct applicable to journalists and the media in terms of subarticle (2) or (3) are not complied with, the Commissioner may prohibit any person concerned from carrying out any processing, in whole or in part, and order the blocking of data when, having regard to the nature of the data, the means of the processing or the effects that it may have, there is a serious risk of a relevant damage to one or more data subjects.
PART III - REQUIREMENTS AND CRITERIA FOR PROCESSING
Requirements for processing.
7. The controller shall ensure that: (a) personal data is processed fairly and lawfully; (b) personal data is always processed in accordance with
good practice; (c) personal data is only collected for specific, explicitly
stated and legitimate purposes; (d) personal data is not processed for any purpose that is
incompatible with that for which the information is collected;
(e) personal data that is processed is adequate and relevant in relation to the purposes of the processing;
(f) no more personal data is processed than is necessary having regard to the purposes of the processing;
(g) personal data that is processed is correct and, if necessary, up to date;
(h) all reasonable measures are taken to complete, correct, block or erase data to the extent that such data is incomplete or incorrect, having regard to the purposes for which they are processed;
(i) personal data is not kept for a period longer than is necessary, having regard to the purposes for which they are processed.
Processing for historical purposes, etc.
8. The processing of personal data for historical, statistical or scientific purposes shall not be regarded as incompatible with the purposes for which the information was collected:
Provided that the Controller shall ensure that: (a) the appropriate safeguards are in place where personal
data processed for historical, statistical or scientific purposes may be kept for a period longer than is necessary having regard to the purposes for which they are processed; or
(b) personal data kept for historical, statistical or
DATA PROTECTION [CAP. 440. 5
scientific purposes shall not be used for any decision concerning a data subject.
Criteria for processing.
9. Personal data may be processed only if: (a) the data subject has unambiguously given his consent;
or (b) processing is necessary for the performance of a
contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or
(d) processing is necessary in order to protect the vital interests of the data subject; or
(e) processing is necessary for the performance of an activity that is carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data is disclosed; or
(f) processing is necessary for a purpose that concerns a legitimate interest of the controller or of such a third party to whom personal data is provided, except where such interest is overridden by the interest to protect the fundamental rights and freedoms of the data subject and in particular the right to privacy.
Direct marketing.10. (1) Personal data may not be processed for purposes concerning direct marketing, if the data subject gives notice to the controller of personal data that he opposes such processing.
(2) The controller shall appropriately inform the data subject of his right to oppose, at no cost, the processing referred to subarticle (1) of this article.
Revocation of consent.
11. (1) In those cases where the processing of personal data is made in terms of article 9(e) and (f), the data subject, except where otherwise provided in any other law, shall be entitled to object at any time to the controller on compelling legitimate grounds to the processing of such data.
(2) Saving the provisions of article 10, where the processing of personal data takes place with the consent of the data subject, the data subject may at any time revoke his consent for compelling legitimate grounds relating to his particular situation.
Sensitive personal data.
12. (1) Subject to the other provisions of this Act no person shall process sensitive personal data:
Provided that such personal data may be processed in those cases provided for under subarticle (2) and under articles 13 to 16 or as may be prescribed by the Minister having regard to an important public interest.
(2) Sensitive personal data may be processed if the data subject:
(a) has given his explicit consent to processing; or
6 [CAP. 440. DATA PROTECTION
(b) has made the data public. Necessary processing.
13. Sensitive personal data may be processed if appropriate safeguards are adopted and the processing is necessary in order that:
(a) the controller will be able to comply with his duties or exercise his rights under any law regulating the conditions of employment; or
(b) the vital interests of the data subject or of some other person will be able to be protected and the data subject is physically or legally incapable of giving his consent; or
(c) legal claims will be able to be established, exercised or defended.
PART IV - PROCESSING FOR SPECIFIC PURPOSES
Processing by foundations, etc.
14. Any body of persons or other entity not being a commercial body or entity, with political, philosophical, religious or trade union objects may, in the course of its legitimate activities and with appropriate guarantees, process sensitive personal data concerning the members of the respective body or entity and such other persons who by reason of the objects of the body or entity have regular contact therewith:
Provided that sensitive personal data may be provided to a third party only if the data subject explicitly consents thereto.
Processing concerning health or medical purposes.
15. Sensitive personal data may be processed for health and hospital care purposes, provided that it is necessary for:
(a) preventive medicine and the protection of public health;
(b) medical diagnosis; (c) health care or treatment; or (d) management of health and hospital care services: Provided that the data is processed by a health professional
or other person subject to the obligation of professional secrecy.
Cap. 31.
For the purposes of this article "health professional" means a person in possession of a warrant to exercise a profession regulated by the Medical and Kindred Professions Ordinance and any person acting under the personal direction and supervision of such person.
Processing concerning research and statistics
16. (1) Sensitive personal data may be processed for research and statistics purposes, provided that the processing is necessary as stipulated in article 9(e).
(2) If the processing referred to in subarticle (1) has been approved -
(a) in the case of statistics, by the Commissioner himself; (b) in the case of research, by the Commissioner on the
advice of a research ethics committee of an institution recognised by the Commissioner for the purposes of
DATA PROTECTION [CAP. 440. 7
this paragraph; the provisions of subarticle (1) shall be deemed to be satisfied.
(3) Personal data may be provided to be used for the purposes referred to in subar t ic le (1) , unless otherwise provided by applicable rules on secrecy and confidentiality.
Processing concerning legal offences. Amended by: XXV. 2012.3.
17. (1) Data relating to offences, criminal convictions or security measures may only be processed under the control of a public authority, unless specifically provided for under any other law.
(2) For this purpose, the Minister may by regulations authorise any person to process the data referred to in subarticle (1) subject to such suitable specific safeguards as may be prescribed:
Provided that a complete register of criminal convictions may only be kept under the control of a public authority.
Processing of identity card number. Amended by: L.N. 426 of 2012.
18. A legally valid identification document may, in the absence of consent, only be processed when such processing is clearly justified having regard to:
(a) the purpose of the processing; (b) the importance of a secure identification; (c) some other valid reason as may be prescribed.
PART V - DATA COLLECTION AND RIGHT OF ACCESS
Information to data subject.
19. The Controller or any other person authorised by him in that behalf must provide a data subject from whom data relating to the data subject himself are collected, with at least the following information, except, where the data subject already has it:
(a) the identity and habitual residence or principal place of business of the controller and of any other person authorised by him in that behalf, if any;
(b) the purposes of the processing for which the data are intended; and
(c) any further information relating to matters such as: (i) the recipients or categories of the recipients of
data; (ii) whether the reply to any questions made to the
data subject is obligatory or voluntary, as well as the possible consequence of failure to reply; and
(iii) the existence of the right to access, the right to rectify, and, where applicable, the right to erase the data concerning him,
and, insofar as such further information is necessary, having regard to the specific circumstances in which the data is collected, to guarantee fair processing in respect of the data subject.
Data collected from other sources.
20. (1) Where the data have not been obtained from the data subject, the controller or any other person authorised by him in that behalf shall provide the data subject with at least the following information, except where the data subject already has it:
8 [CAP. 440. DATA PROTECTION
(a) the identity and habitual residence or principal place of business of the controller and of any other person authorised by him in that behalf;
(b) the purposes of the processing; (c) any further information including:
(i) the categories of data concerned; (ii) the recipients or categories of recipients;
(iii) the existence of the right of access, the right to rectify, and, where applicable, the right to erase the data concerning him;
and insofar as such further information is necessary, having regard to the specific circumstances in which the data is processed, to guarantee fair processing in respect of the data subject.
(2) The information referred to in subarticle (1) shall be provided at the time of undertaking the recording of personal data or, if a disclosure to a third party is envisaged, not later than the time when the data are first disclosed.
(3) Information referred to in subarticle (1) need not be provided if there are provisions concerning the registration or d isclosure of any such personal data in any other law and appropriate safeguards are adopted.
(4) Information under subarticle (1) need not be provided if the personal data is required:
(a) for processing for statistical purposes; (b) for purposes of historical or scientific research;
and insofar as the provision of such information proves impossible or would involve a disproportionate effort.
Right of access. 21. (1) The controller of personal data at the request of the data subject shall provide to the data subject, without excessive delay and without expense, written information as to whether personal data concerning the data subject is processed:
Provided that a request by the data subject under this subarticle shall only be made by the data subject at reasonable intervals.
(2) If such data is processed the data controller shall provide to the data subject written information in an intelligible form about:
(i) actual information about the data subject which is processed;
(ii) where this information has been collected; (iii) the purpose of the processing; (iv) to which recipients or categories of recipients
the information is disclosed; and (v) knowledge of the logic involved in any automatic
processing of data concerning the data subject. (3) An application under subarticle (1) shall be made in writing
to the controller of personal data and is to be signed by the data
DATA PROTECTION [CAP. 440. 9
subject.
Rectification.22. (1) The controller shall be liable at the request of the data subject to immediately rectify, block or erase such personal data that has not been processed in accordance with this Act or with regulations made under this Act.
(2) The controller shall notify the third party to whom the data has been disclosed about the measures undertaken under subarticle (1) of this article:
Provided that no such notification need be provided if it is shown to be impossible or it will involve a disproportionate effort.
PART VI - EXEMPTIONS, RESTRICTIONS AND OTHER MEASURES
Exemptions and restrictions in case of secrecy, etc.
23. (1) The provisions of articles 7, 19, 20 (1), 21 and 35 shall not apply when a law specifically provides for the provision of information as a necessary measure in the interest of:
(a) national security; (b) defence; (c) public security; (d) the prevention, investigation, detection and
prosecution of criminal offences, or of breaches of ethics for regulated professions;
(e) an important economic or financial interest including monetary, budgetary and taxation matters;
(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority referred to in paragraphs (c), (d) and (e); or
(g) such information being prejudicial to the protection of the data subject or of the rights and freedoms of others.
(2) The provisions of article 21 shall not apply when data is processed solely for purposes of scientific research or is kept in personal form for a period which does not exceed the period necessary for the sole purpose of compiling statistics:
Provided that the provisions of this subarticle shall not apply where the data is used for taking measures or decisions regarding any particular individual or where there is a risk of breaching the privacy of the data subject.
Decisions based on automated processing.
24. (1) If a decision is based solely on automated processing of such personal data as is intended to assess the qualities of a natural person, and such decision has a legal or other significant effect for that person, that person shall have the right to request that the decision be reconsidered other than in a manner based solely on automated processing, and such reconsideration shall be obligatory on the person making such decision.
(2) The provisions of subarticle (1) shall not apply where the decision is taken in the course of the entering into or performance
10 [CAP. 440. DATA PROTECTION
of a contract with the data subject, provided that the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or that there are suitable measures to safeguard his legitimate interests such as the right to be heard.
(3) A person who is the subject of a decision referred to in subarticle (1) shall be entitled to obtain upon representation information from the controller about what has controlled the automated processing that resulted in the decision:
Provided that information made available by the controller shall be subject to the provisions of article 21.
Persons authorised to process data.
25. (1) Any person acting under the authority of the controller or of the processor, including the processor himself, who has access to personal data may only process personal data in accordance with instructions from the controller unless the person is otherwise required to do so by law.
(2) The carrying out of processing by way of a processor is to be governed by a contract or other legally binding instrument in a written or in an equivalent form binding the processor to the controller and stipulating in particular that the processor:
(a) shall act only on instructions from the controller; (b) shall take those measures referred to in article 26(1).
Security measures relating to processing.
26. (1) The controller shall implement appropriate technical and organisational measures to protect the personal data that is processed against accidental destruction or loss or unlawful forms of processing thereby providing an adequate level of security that gives regard to the:
(a) technical possibilities available; (b) cost of implementing the security measures; (c) special risks that exist in the processing of personal
data; (d) sensitivity of the personal data being processed.
(2) If the controller engages a processor, the controller shall ensure that the processor:
(a) can implement the security measures that must be taken;
(b) actually takes the measures so identified by the controller.
Transfer of data to a third country.
27. (1) Without prejudice to the provisions of article 28, the transfer to a third country of personal data that is undergoing processing or intended processing, may only take place subject to the provisions of this Act and provided that the third country to which the data i s t ransferred ensures an adequate level of protection.
(2) The adequacy of the level of protection of a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data t ransfer operat ions; particular consideration shall be given to the nature of the data, the
DATA PROTECTION [CAP. 440. 11
purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in quest ion and the professional rules and securi ty measures which are complied with in that country.
(3) It is for the Commissioner to decide whether a third country ensures an adequate level of protection.
(4) The transfer of personal data to a third country that does not ensure adequate protection is prohibited.
Exemptions from the prohibition of the transfer of data to third country
28. (1) For the purpose of implementing any international convention to which Malta is a party or any other international obligation of Malta, the Minister may by Order designate that the transfer of personal data to any country listed in the said Order shall not, notwithstanding the provisions of this Act or any other law, be restricted on grounds of protection of privacy. In making such Order the Minister may include conditions and restrictions provided for in any said international instrument.
(2) A transfer of personal data to a third country that does not ensure an adequate level of protection within the meaning of article 27(2) may be effected by the controller if the data subject has given his unambiguous consent to the proposed transfer or if the transfer -
(a) is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request;
(b) is necessary for the performance or conclusion of a contract concluded or to be concluded in the interests of the data subject between the controller and a third party;
(c) is necessary or legally required on public interest grounds, or for the establishment, exercise or defence of legal claims;
(d) is necessary in order to protect the vital interests of the data subject; or
(e) is made from a register that according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, provided that the conditions laid down in law for consultation are fulfilled in the particular case.
(3) Without prejudice to subarticle (1) the Commissioner may authorise a transfer or a set of transfers of personal data to a third country that does not ensure an adequate level of protection within the meaning of article 27(2):
Provided that the controller provides adequate safeguards, which may result particularly by means of appropriate contractual provisions, with respect to the protection of the privacy and fundamental rights and freedoms of individuals and with respect to their exercise.
12 [CAP. 440. DATA PROTECTION
PART VII - NOTIFICATION AND OTHER PROCEDURES
Obligation for notification. Amended by: XXV. 2012.4.
29. (1) The controller shall notify the Commissioner before carrying out any whol ly or par t ia l ly automated or manual processing operation or set of such operations intended to serve a single purpose or several related purposes.
(2) The Minister may prescribe on any matter relating to the form of notification to be made under this subarticle in respect of -
(a) processing whose sole purpose is the keeping of a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person demonstrating a legitimate interest; and
(b) processing operations referred to in article 14. (3) The notification referred to in subarticle (1) must specify:
(a) the name and address of the data controller and of any other person authorised by him in that behalf, if any;
(b) the purpose or purposes of the processing; (c) a description of the category or categories of data
subject and of the data or categories of data relating to them;
(d) the recipients or categories of recipient to whom the data might be disclosed;
(e) proposed transfers of data to third countries; and (f) a general description allowing a preliminary
assessment to be made of the appropriateness of the measures taken pursuant to article 26 to ensure security of processing:
Provided that the controller shall notify the Commissioner of any changes affecting the information referred to under this subarticle and the Minister may prescribe any matter related to the form of such notification.
(4) The Commissioner may allow the simplification of or the exemption from the notification obligations provided for under this Part of this Act only in respect of categories of processing operations -
(i) which are unlikely, due account being taken of the data being processed, to prejudice the rights and freedoms of data subjects, and
(ii) in respect of which the Commissioner specifies the purposes of the processing, the data or categories of data being processed, the category or categories of data subjects affected by such processing, the recipients or categories of recipients to whom the data is to be disclosed and the length of time for which the data is to be stored.
DATA PROTECTION [CAP. 440. 13
Derogation from the obligation for notification.
30. (1) The controller shall notify the Commissioner on the appointment or removal of a personal data representative.
(2) Where a personal data representative has been so appointed the notification required in terms of article 29(1) and (3) shall not be required.
Function of data representative.
31. (1) The personal data representative shall have the function of independently ensuring that the controller processes personal data in a lawful and correct manner and in accordance wi th good p rac t i ce and in the even t o f t he pe r sona l da t a representative identifying any inadequacies, he shall bring these to the attention of the controller.
(2) If the personal data representative has reason to suspect that the controller has contravened the provisions applicable for processing personal data and if rectification is not implemented as soon as practicable after such contravention has been pointed out, the personal data representative shall notify this situation to the Commissioner.
(3) The personal data representative shall also consult with the Commissioner in the event of doubt about how the rules applicable to processing of personal data are to be applied.
Register of processing subject to notification.
32. The personal data representative shall maintain a register of the processing that the controller implements and which would have been subject to the duty of notification if the representative had not been appointed. The register shall comprise at least the information that a notification under art icle 29 would have contained.
Assistance to data subject.
33. The personal data representative shall assist the data subject to exercise his rights under this Act.
Mandatory notification. Amended by: XXV. 2012.5.
34. (1) (a) Processing of personal data that involves particular risks of improper interference with the rights and freedoms of data subjects shall be submitted for prior checking to the Commissioner. (b) The Commissioner may, from time to time as he may deem necessary, issue guidelines in order to define the processing operations involving particular risks as referred to in paragraph (a) and may, in such guidelines, prescribe rules in relation to such processing operations.
(2) The prior checking referred to in subarticle (1) shall be carried out by the Commissioner following receipt of a notification from either the controller or the personal data representative:
Provided that in the case of doubt, the controller or personal data representative shall consult the Commissioner.
Register of processing operations.
35. (1) The Commissioner shall maintain a register of processing operations notified in accordance with article 29(1). The register shall contain the information listed in article 29(3)(a) to (e).
(2) The controller or the personal data representative, if so instructed by the controller, shall provide at least the information referred to in article 29(3)(a) to (e) to any person who requests it
14 [CAP. 440. DATA PROTECTION
expeditiously and in an appropriate manner about such automated or other processing of personal data that have not been notified to the Commissioner under article 29(3):
Provided that the provisions of this subarticle shall not apply to the information specified in article 29(2)(a).
PART VIII - THE INFORMATION AND DATA PROTECTION COMMISSIONER
Information and Data Protection Commissioner.
36. (1) There shall be an Information and Data Protection Commissioner who shall be appointed by the Prime Minister after he has consulted the Leader of the Opposition.
(2) A person shall not be qualified to hold office as Commissioner if he:
(a) is a Minister, Parliamentary Secretary, or a Member of the House of Representatives; or
(b) is a judge or magistrate of the courts of justice; or (c) is an officer in the public service; or (d) is a member of a local council; or (e) has a financial or other interest in any enterprise or
activity which is likely to affect the discharge of his functions as a Commissioner:
Provided that the disqualification of a person under this paragraph may be waived if such person declares the interest and such declaration and waiver are published in the Gazette.
Independence of functions. Amended by: IX. 2003.118.
37. (1) In the exercise of his functions under this Act the Commissioner shall act independently and shall not be subject to the direction or control of any other person or authority.
Commissioner may not hold other offices of profit. Exceptions.
(2) It shall not be lawful for the Commissioner to carry out any other profession, business or trade or to hold any other office of profit whatsoever, even though of a temporary nature, with the exception of any temporary judicial office on any international court or tribunal or any international adjudicating body, and the office of examiner at a University.
Legal personality and representation of the Commissioner.
38. (1) The Commissioner shall have a distinct legal personality and shall be capable, subject to the provisions of this Act, of entering into contracts, of acquiring, holding and disposing of any kind of property for the purposes of his functions, of suing and being sued, and of doing all such things and entering into all such transactions as are incidental or conducive to the exercise or performance of his functions under this Act.
(2) Any document purporting to be an instrument made or issued by the Commissioner and signed by him shall be received in evidence and shall, until the contrary is proved, be deemed to be an instrument made or issued by the Commissioner.
Tenure of office. Amended by: XXXI. 2002.263.
39. (1) The Commissioner shall hold office for a term of five years and shall be eligible for reappointment on the expiration of his term of office.
DATA PROTECTION [CAP. 440. 15
(2) The Commissioner shall not be removed from his office except by the Prime Minister upon an address of the House of Representatives supported by the votes of not less than two thirds of all the members thereof and praying for such removal on the ground of proved inability to perform the functions of his office (whether arising from infirmity of body or mind or any other cause) or proved misbehaviour.
(3) If the Commissioner resigns or if his office is otherwise vacant or if the Commissioner is for any reason unable to perform the functions of his office, or for any other temporary purpose where the Commissioner considers it necessary not to carry out any of his functions because of such circumstances, that were he a judge of the superior courts, he would abstain, the Prime Minister shall, after he has consulted the Leader of the Opposition, appoint a person who is qualified to be appointed as a temporary Commissioner, if such person is qualified to be a Commissioner; and any person so appoin ted sha l l cease to be such a Commiss ioner when a Commissioner is appointed to fill the vacancy or, as the case may be, when the Commissioner who was unable to perform the functions of his office resumes those functions or, in the case of a temporary purpose, the temporary Commissioner has performed the function assigned to him.
(4) The appointment of a temporary Commissioner for a temporary purpose as provided in subarticle (3) shall be exercised only on a certificate signed by the Commissioner to the effect that, in his opinion, it is necessary for the due conduct of the business of the Commissioner under this Act, that a temporary Commissioner be appointed.
Functions of the Commissioner. Amended by: XVI. 2008. 46.
40. The Commissioner shall have the following functions: (a) to create and maintain a public register of all
processing operations according to notifications submitted to him as specified in this Act;
(b) to exercise control and, either of his own motion or at the request of a data subject, verify whether the processing is carried on in accordance with the provisions of this Act or regulations made thereunder;
(c) to instruct the processor and controller to take such measures as may be necessary to ensure that the processing is in accordance with this Act or regulations made thereunder;
(d) to receive reports and claims from data subjects or associations representing them on violations of this Act or regulations made thereunder, to take such remedial action as he deems necessary or as may be prescribed under this Act, and to inform such data subjects or associations of the outcome;
(e) to issue such directions as may be required of him for the purposes of this Act;
(f) to institute civil legal proceedings in cases where the provisions of this Act have been or are about to be violated and to refer to the competent public authority
16 [CAP. 440. DATA PROTECTION
any criminal offence encountered in the course of or by reason of his functions;
(g) to encourage the drawing up of suitable codes of conduct by the various sectors affected by the provisions of this Act and to ascertain that the provisions of such codes are in accordance with the provisions of this Act and for such purpose the Commissioner may seek the views of data subjects or their representatives;
(h) to take such measures as may be necessary so as to bring to the knowledge of the general public the provisions of this Act and for such purpose to give advice to any person where it is required;
(i) to order the blocking, erasure or destruction of data, to impose a temporary or definitive ban on processing, or to warn or admonish the controller;
(j) to advise the Government on any legislative measures that are required to be taken to enable him carry out his functions appropriately;
(k) to draw up annual reports of his activities at regular intervals, at least once a year, which reports shall be made public;
(l) at the request of a data subject to verify that the processing of the personal data described in article 23 of this Act is compliant with the provisions of this Act or of any law as specified in subarticle (1) of the said article 23 and in such a case the data subject shall be informed accordingly; and
(m) to collaborate with supervisory authorities of other countries to the extent necessary for the performance of his duties, in particular by exchanging all useful information, in accordance with any convention to which Malta is a party or other any international obligation of Malta; and
Cap. 496. (n) to carry out the functions assigned to him by the
Freedom of Information Act. Commissioner’s right of access to information.
41. (1) The Commissioner shall be entitled to obtain on request:
(a) access to the personal data that is processed, and; (b) information about and documentation of the
processing of personal data and security of such processing:
Provided that where the personal data is processed for the purpose of compliance with a legal obligat ion to which the controller is subject, the Minister may by regulation prescribe rules and procedures for the purposes of the implementation of subarticle (1)(a).
(2) Without prejudice to any other provision of any other law, any person who does not comply with any lawful request relevant
DATA PROTECTION [CAP. 440. 17
to an investigation by the Commissioner shall be guilty of an offence against this article.
(3) The investigations on the data processing described in a r t i c l e 23 a re sub jec t t o t he wr i t t en au tho r i sa t ion o f t he Commissioner.
(4) If the Commissioner cannot, pursuant to a request under subarticle (1), obtain sufficient information in order to conclude that the processing of personal data is lawful, the Commissioner may prohibit the controller of personal data from processing personal data in any other manner than by storing them.
(5) In the exercise of his functions under this article the Commissioner shall have the same powers to enter and search any premises as are vested in the executive police by any law as may from time to time be in force.
Classification of fines and penalties. Added by: XXV. 2012.6.
41A. (1) With respect to a penalty of any level specified in the first column of the Second Schedule which is a court penalty, the penalty shall be either the corresponding fine (multa) specified in the second column thereof or the corresponding per iod of imprisonment specified in the third column thereof, or both such fine and imprisonment.
(2) With respect to an administrative fine of any level specified in the first column of the Third Schedule, the fine shall be the corresponding amount specified in the second column thereof and the cor responding amount fo r each day dur ing which the infringement continues shall be that specified in the third column thereof.
Imposition of fines and penalties. Added by: XXV. 2012.6.
41B. (1) Any person found guilty of an offence for having contravened a provision of this Act mentioned in the first column of the Fourth Schedule, with a corresponding general description of the offence set out in the second column thereof, shall be liable to the corresponding penalty of the level specified in the third column thereof.
(2) For any infringement by any person of any provision of this Act mentioned in the first column of the Fifth Schedule, consisting in the corresponding act or omission described in the second column thereof, the Commissioner may, by notice in writing, impose by way of an administrative fine on the person concerned the corresponding fine specified in the third column thereof.
(3) Any description in the second column of the Fourth and Fifth Schedules related to any offence and infringement as referred to in sub-articles (1) and (2) respectively shall not prejudice the interpretation of the provisions of this Act to which the offence or infringement corresponds.
Offences and infringements not specifically provided for in the Schedules.
(4) Any person who is found guilty of an offence under any provision of this Act, which is not specifically provided for in the Fourth Schedule, shall be liable to a fine (multa) of not less than one hundred and twenty euro (€120) and not more than twenty- t h r e e t h o u s a n d a n d t h r e e h u n d r e d e u r o ( € 2 3 , 3 0 0 ) o r t o i m p r i s o n m e n t f o r s i x m o n t h s o r t o b o t h s u c h f i n e a n d imprisonment.
18 [CAP. 440. DATA PROTECTION
(5) Any person who fails to comply with any other provision of this Act which may give rise to the imposition of an administrative fine not otherwise specifically provided for in the Fifth Schedule, shall be liable to an administrative fine of not less than one hundred and twenty euro (€120) and not more than twenty-three thousand and three hundred euro (€23,300) for each violation and fifty euro (€50) for each day during which such violation persists, which fine shal l be determined and imposed by the Commissioner, in accordance with the procedure stipulated under article 42.
Commissioner to seek rectification and the power to impose and recover administrative penalties.. Substituted by: XXV. 2012.7.
42. (1) If the Commissioner concludes that personal data is processed or may be processed in an unlawful manner, the Commissioner shall order rectification, and if rectification is not effected or if the matter is urgent, the Commissioner may prohibit the controller of personal data to continue processing the personal data in any manner other than to store that data.
(2) Without prejudice to his other powers under this Act, the Commissioner may impose an administrative fine as stipulated in sub-article (3) in the following cases:
(a) if the controller does not implement security measures in terms of article 26;
(b) if the controller transfers personal data to a third country in contravention of articles 27 and 28;
(c) if the controller fails to notify the Commissioner in terms of article 29(1) or article 34(1)(a).
(3) In any of the cases mentioned in the preceding sub-article or in article 41(2), the Commissioner may, by order in writing, require the controller of personal data to pay such administrative fine as provided in the Schedules or as may be prescribed.
(4) Any administrative fine imposed under this Act shall be due to the Commissioner as a civil debt:
Provided that such order shall be subject to the appeal procedure as established under article 51.
Cap. 12.
(5) In the absence of such an appeal, the decision of the Commissioner shall become final and shall constitute an executive title for the purposes of Title VII of the Code of Organisation and Civil Procedure as if the decision had been ordered by a judgement of a court of civil jurisdiction.
(6) Where a notice imposing an administrative fine is served on a person and -
(a) such person fails to appeal within such time as an appeal may be entered, and fails to pay the fine so imposed; or
(b) such person appeals within such time to the Tribunal and the appeal is withdrawn or the Tribunal confirms the penalty in the amount fixed by the Commissioner or in an amount reduced by it, and no further appeal is filed with the Court of Appeal or if an appeal is filed with the Court of Appeal and such Court either confirms the decision taken, or decides that a penalty
DATA PROTECTION [CAP. 440. 19
is due in another amount, or the imposed penalty is not paid within fifteen days from the date of the decision or the withdrawal of the appeal or the date when the Tribunal or the Court of Appeal confirms or varies the penalty as aforesaid,
the Commissioner shall be entitled to take civil action to recover the amount due.
Application for erasure.
43. (1) Where the Commissioner decides that personal data has been unlawfully processed, the Commissioner shall by notice order the controller of personal data to erase the personal data.
(2) If the controller of personal data feels aggrieved by the decision of the Commissioner, he may, within fifteen days from the receipt of the notice referred to in subarticle (1), by application request the Court of Appeal as constituted in accordance with article 41(6) of the Code of Organization and Civil Procedure, to revoke the order of the Commissioner.
Collaboration with other authorities.
44. The Commissioner, before taking a decision in the exercise of his functions under article 40(c) or (e) which may significantly impact the operation of any government department or of any public or private enterprise, shall consult the interested party or parties who may be directly affected by the decision and he shall give reasons for his decisions.
Oath of secrecy. Amended by: XXV. 2012.8.
Cap. 50.
45. The Commissioner and any officer and employee of the Commissioner shall, before assuming their duties, take an oath of office contained in the First Schedule to carry out their duties with equity and impartiality and in accordance with the provisions of this Act and shall be subject to the provisions of the Official Secrets Act, and the Code of Ethics applicable to public officers. The oath of office shall be taken before the Attorney General.
Compensation for damages. Amended by: L.N. 181 of 2006; L.N. 186 of 2006.
46. (1) The data subject may, by sworn application filed in the competent court, exercise an action for damages against the controller who processes data in contravention of this Act or regulations made thereunder.
(2) An action under this article shall be commenced within a period of twelve months from the date when the data subject b e c o m e s a w a r e o r c o u l d h a v e b e c o m e a w a r e o f s u c h a contravention, which ever is the earlier.
Penalties. Amended by: L.N. 426 of 2007. Substituted by: XXV. 2012.9.
47. Any person who: (a) provides untrue information to data subjects as is
prescribed by this Act, or in the notification to the Commissioner under article 29 or to the Commissioner when the Commissioner requests information in accordance with article 41; or
(b) processes personal data in contravention of the provisions of articles 12 to 17,
shall be guilty of an offence and shall on conviction be liable to a fine (multa) of not less than one hundred and twenty euro (€120) and not more than twenty-three thousand and three hundred euro (€23,300) or to imprisonment for six months or to both such fine and imprisonment,
20 [CAP. 440. DATA PROTECTION
as provided in the Second Schedule, or as may be prescribed.
Information and Data Protection Appeals Tribunal. Amended by: XVI. 2008. 46.
48. (1) There shall be a Tribunal to be known as the Information and Data Protection Appeals Tribunal, in this Act referred to as ' 'the Tribunal'', having the functions and powers assigned to it by this Act or by any other law.
(2) The Tribunal shall consist of a chairman and two other members appointed by the Minister.
(3) The chairman shall be an advocate with a minimum of twelve years legal experience.
(4) The two other members mentioned in subarticle (2) shall be persons who in the opinion of the Minister represent the interests of data subjects and of data controllers.
(5) The chairman and other members of the Tribunal shall hold office for such period being of not less than three years as may be determined in their appointment and cannot be removed during their term of office except on grounds of proved inability to perform the functions of their office whether arising from infirmity of body or mind or any other cause, or proved misbehaviour.
Cap. 12.
(6) A member of the Tribunal may be challenged or abstain for any of the reasons for which a judge may be challenged or abstain in accordance with article 734 of the Code of Organization and Civil Procedure. In any such case the Minister shall appoint a person, having the qualifications of the member challenged or abstaining, to sit as a member of the Tribunal in substitution of the said member.
(7) A member of the House of Representatives or of a Local Council, a Judge or a Magistrate, or an officer in the public service shall be disqualified from being appointed or continuing to be a member of the Tribunal for so long as he holds that office.
(8) The Minister shall also designate a person to serve as secretary to the Tribunal.
Appeals. 49. (1) Any person aggrieved by a decision of the Commissioner shall have the right to appeal in writing to the Tribunal within thirty days from the notification to him of the said decision.
(2) An appeal to the Tribunal may be made on any of the following grounds:
(a) that a material error as to the facts has been made; (b) that there was a material procedural error; (c) that an error of law has been made; (d) that there was some material illegality, including
unreasonableness or lack of proportionality. (3) The Tribunal shall give reasons for its decision and shall
cause such decisions to be made public omitting, if it deems it appropriate for reasons of confidentiality, the names of the persons involved.
(4) In determining an appeal under this article the Tribunal
DATA PROTECTION [CAP. 440. 21
may: (i) dismiss the appeal;
(ii) annul the decision; and where the Tribunal annuls the decision it may refer the matter to the competent authority with a direction to reconsider it and reach a decision in accordance with the findings of the Tribunal.
(5) The effect of a decision to which an appeal relates shall not except where the Tribunal or the Court of Appeal, as the case may be, so orders, be suspended in consequence of the bringing of the appeal.
Powers and procedures of the Tribunal.
50. (1) The Tribunal shall be competent to hear and decide any appeal made to it in accordance with the provisions of this Act and any regulations made thereunder; and subject to article 51, the decisions of the Tribunal shall be final and binding.
(2) For the exercise of its functions, the Tribunal may summon any person to appear before it and give evidence and produce documents; and the chairperson shall have the power to administer the oath. The Tribunal may also appoint experts to advice the Tribunal on any technical issue that may be relevant to its decision.
(3) For the purposes aforesaid the Tribunal shall have the same powers as are competent to the First Hall, Civil Court according to law.
(4) Save as may be prescribed, the Tribunal may regulate its own procedure.
Appeal to the Court of Appeal.
Cap. 12.
51. Any party to an appeal to the Tribunal who feels aggrieved by a decision of the Tribunal, or the Commissioner if he feels aggrieved with any such decision, may on a question of law appeal to the Court of Appeal as constituted in accordance with article 41(6) of the Code of Organization and Civil Procedure by means of an application filed in the registry of that court within thirty days from the date on which that decision has been notified.
Financial provision. Amended by: XVI. 2008. 46. Cap. 496.
52. (1) The expenses required by the Commissioner to exercise his functions under this Act and under the Freedom of Information Act and other laws as may be fixed by the House of Representatives in accordance with this article shall be a charge on t h e C o n s o l i d a t e d F u n d w i t h o u t t h e n e e d o f a n y f u r t h e r appropriation other than this Act.
(2) Where during the course of any financial year the sum fixed by the House of Representatives is in the opinion of the Commissioner insufficient to enable him to efficiently fulfil his functions the Commissioner shall prepare supplementary estimates for consideration by the House of Representatives.
(3) The Commissioner shall cause to be prepared in every financial year, and shall not later than six weeks after the end of each such year adopt, estimates of the income and expenditure of the Commissioner for the next following financial year:
Provided that the estimates for the first financial year of the Commissioner shall be prepared and adopted within such time as the Minister may by notice in writing to the Commissioner
22 [CAP. 440. DATA PROTECTION
specify. (4) A copy of the estimates shall, upon their adoption by the
Commissioner, be sent forthwith by the Commissioner to the Minister and to the Minister responsible for finance.
(5) The Minister shall at the earliest opportunity and not later than six weeks after he has received a copy of the estimates from the Commissioner, approve the same with or without amendment after consultation with the Minister responsible for finance.
Accounts and audit. Amended by: XVI. 2008. 46. Cap. 496.
53. (1) The Commissioner shall cause to be kept proper accounts and other records in respect of his operations under this Act and under the Freedom of Information Act and other laws and shall cause to be prepared a statement of accounts in respect of each financial year.
(2) The accounts of the Commissioner shall be audited by an auditor or auditors to be appointed by the Commissioner and approved by the Minister:
Provided that the Minister responsible for finance may after consultation with the Minister require the books or the accounts of the Commissioner to be audited or examined by the Auditor General who shall for the purpose have the power to carry out such physical checking and other certifications as he may deem necessary.
(3) After the end of each financial year, and not later than the date on which the estimates of the Commissioner are forwarded to the Minister under article 52(3), the Commissioner shall cause a copy of the statement of account duly audited to be transmitted to the Minister and to the Minister responsible for finance together with a copy of any report made by the auditors on that statement or on the accounts of the Commissioner.
(4) The Minister shall, at the earliest opportunity and not later than eight weeks after he has received a copy of every such statement and report, or if at any time during that period the House of Representatives is not in session, within eight weeks from the beginning of the next following session, cause every such statement and report to be laid on the Table of the House of Representatives.
(5) The Commissioner shall, not later than six weeks after the end of each financial year, make and transmit to the Minister and to the Minister responsible for finance a report dealing generally with the activities of the Commissioner during the financial year and contain such information relating to the proceedings and policy of the Commissioner as either of the said Ministers may from time to time require. The Minister shall, at the earliest opportunity and not later than eight weeks after he has received a copy of every such repor t , o r i f a t any t ime dur ing tha t pe r iod the House o f Representatives is not in session, within eight weeks from the beginning of the next following session cause a copy of every such report to be laid on the Table of the House of Representatives.
DATA PROTECTION [CAP. 440. 23
PART IX - GENERAL
Power to make regulations. Amended by: XXXI. 2002.263; L.N. 426 of 2007.
54. The Minister may, after consultation with the Commissioner, prescribe regulations for the better carrying out of the provisions of this Act, and without prejudice to the generality of the foregoing may in particular prescribe regulations concerning:
(a) the cases in which processing of personal data is permitted;
(b) the requirements which are imposed on the controller when processing personal data;
(c) what a notification or application to a controller should contain;
(d) which information shall be provided to the data subject and how information shall be provided;
(e) notification to the Commissioner and the procedure when information notified has been altered;
(f) rules and procedures relating to access by the Commissioner of data held in instances where the controller processes data for compliance with a legal obligation;
(g) the qualifications required for a person to be appointed as a personal data representative;
(h) the minimum guarantees to be provided by the bodies of persons or other entities referred to in article 14 in the processing of personal data;
(i) the fees that may be levied by the Commissioner; (j) the administrative fines that may be imposed by the
Commissioner and the administrative violations in respect of which such fines be imposed; provided that such fines shall not be in an amount exceeding twenty- three thousand and two hundred and ninety-three euro and seventy-three cents (€23,293.73) for each violation and two thousand and three hundred and twenty-nine euro and thirty-seven cents (€2,329.37) for each day during which such violation persists;
(k) the penalties that may be imposed under this Act; (l) for establishing rules, procedures, formalities and time
limits in respect of any matter provided for under this Act;
(m) the extension of the application of this Act to any particular activity or sector and to provide for the manner in which data protection is to be implemented in specific sectors or in respect of specific activities; and
(n) for anything that may be prescribed under any of the provisions of this Act.
English text to prevail.
55. In the case of conflict between the Maltese and English text of this Act, the English text shall prevail.
24 [CAP. 440. DATA PROTECTION
Amendment to the Malta Communications Authority Act. Cap. 418.
56. The First Schedule to the Malta Communications Authority Act shall be amended as follows:
(a) paragraph 2 thereof shall be deleted; and (b) paragraph 3 thereof shall be re-numbered as paragraph
2.
DATA PROTECTION [CAP. 440. 25
I ……………………………………… solemnly swear / affirm that I will faithfully and conscientiously perform my duties as (Information and Data Protection Commissioner / Officer of the Information and Data Protection Commissioner / Employee of the Information and Data Protection Commissioner) in terms of the Data Protection Act and in accordance with the laws of Malta, without fear or favour. (So help me God.).
Penalties which are enforceable by prosecution in the Courts of Malta
Administrative fines which may be imposed by the Commissioner without recourse to a court hearing
FIRST SCHEDULE Re-numbered by: XXV. 2012.10.
Article 45 Oaths of Office
SECOND SCHEDULE Added by: XXV. 2012.10.
Article 4
First Column Second Column Third Column Level Fine (multa) Imprisonment
1 Not less than €120 but not more than €600
Not more than one month
2 Not less than €250 but not more than €2,500
Not less than one month but not more than three months
3 Not less than €2 ,500 b u t n o t m o r e t h a n €23,300
Not less than three months but not more than six months
THIRD SCHEDULE Added by: XXV. 2012.10.
Article 4
First Column Second Column Third Column Level Fine Daily fine
1 Not less than €120 but not more than €600
Not less than €20 but not more than €60
2 Not less than €250 but not more than €2,500
Not less than €25 but not more than €250
3 Not less than €2 ,500 b u t n o t m o r e t h a n €23,300
Not less than €250 but not more than €2,500
26 [CAP. 440. DATA PROTECTION
Court Penalties
Administrative Fines
Added by: XXV. 2012.10.
FOURTH SCHEDULE Article 5
First Column Second Column Third Column Article Offence Penalty Level
47(1)(a) Providing untrue information to data subjects
3
47(1)(a) Providing untrue information in t h e n o t i f i c a t i o n t o t h e C o m m i s s i o n e r , m a d e i n accordance with article 29
3
47(1)(a) Providing untrue information to t h e C o m m i s s i o n e r u p o n h i s request for information, made in accordance with article 41
3
47(1)(b) Processing of personal data, in contravention of articles 12 to 17
3
Added by: XXV. 2012.10.
FIFTH SCHEDULE Article 5
First Column Second Column Third Column Article Infringement Fine Level
42(2)(a) Failure to implement appropriate t e c h n i c a l a n d o rg a n i s a t i o n a l s e c u r i t y m e a s u r e s t o p r o t e c t personal data that is processed against accidental destruction, loss or unlawful forms of processing, in contravention of article 26
2
42(2)(b) Transfer of personal data to a third country which does not ensure an adequate level of protection, in contravention of article 27, and which does not satisfy any of the requirements mentioned in article 28
1
42(2)(c) F a i l u r e t o n o t i f y t h e Commissioner of any processing o p e r a t i o n p r i o r t o i t s commencement, in contravention of article 29(1)
1
DATA PROTECTION [CAP. 440. 27
42(2)(c) F a i l u r e t o n o t i f y t h e Commissioner of any processing operation that involves risks of improper interference with the rights and freedoms of the data sub jec t fo r pr io r check ing , in contravention of article 34(1)(a)
2
42(3) Failure to comply with any lawful r e q u e s t r e l e v a n t t o a n i n v e s t i g a t i o n b y t h e Commissioner, in contravention of article 41(2)
2
42(3) Unlawful processing of personal data, in contravention of article 42(1)
2
42(3) W h e r e p e r s o n a l d a t a m a y b e processed in an unlawful manner, in contravention of article 42(1)
1
42(3) F a i l u r e t o r e c t i f y u n l a w f u l processing of personal data, as ordered by the Commissioner, in contravention of article 42(1)
3
42(3) Failure to rectify the processing of p e r s o n a l d a t a w h i c h m a y b e u n l a w f u l , a s o r d e r e d b y t h e Commissioner, in contravention of article 42(1)
2".