Cap. 487 Art. 46Confidentiality.

(1) Nothing in this Act shall authorise the competent authority to enquire or cause an enquiry to be made in relation to an enrolled person into the affairs of any individual client of the enrolled person except for the purpose of ensuring compliance with any of the provisions of this Act or any other Act.

(2) Information obtained by the competent authority or by its officers, employees or agents, including former officers, employees or agents, as well as by inspectors, auditors and experts acting on behalf of the competent authority for the purposes of, or pursuant to, any of the provisions of this Act, or of any regulations, Insurance Distribution Rules or Conduct of Business Rules made thereunder, or

(a) where the information is disclosed with a view to the institution of, or otherwise for the purposes of, criminal proceedings or of any proceedings by the competent authority before any court under this Act;

(b) where the information is disclosed with a view to enabling or assisting the competent authority in the performance or discharge of any of its functions under this Act;

(c) where the information has been made available to the public by virtue of being disclosed in any circumstances in which, or for any purpose for which, disclosure is not precluded by this article;

(d) where a summary or collection of information is prepared or supplied in such a way as not to enable the identity of any person to whom the information relates to be ascertained, without prejudice to cases covered by criminal law;

(e) where the information is disclosed to an auditor where such disclosure would assist the auditor in the exercise of his functions under article 28;

(f) where the information is provided to the Central Bank of Malta in the exercise of its functions in terms of law;

(g) where the information is provided to such other local or overseas regulatory, judicial or enforcement authorities where such disclosure is required or requested for the pursuance of serious regulatory concerns or the detection, prevention or prosecution of criminal offences;

(h) where the information is disclosed in civil or commercial proceedings in relation to the bankruptcy or compulsory winding up of an insurance intermediary provided such information does not concern third parties involved in attempts to rescue such insurance intermediary, and to such overseas bodies responsible for the liquidation and bankruptcy of a person holding an authorisation or an equivalent licence from an overseas regulatory authority.

(3) Subject to the provisions of article 45, information obtained from an overseas regulatory authority may only be disclosed to another person, to another overseas regulatory authority or to any other third party with the prior approval of the authority which had provided the information.

(4) No person, including past and present officers or agents of an enrolled person, shall disclose any information relating to the affairs of an enrolled person or of a client of the enrolled person concerned which he has acquired in the performance of his duties exercise of his functions;

(c) when lawfully required to do so by any court or under a provision of any law.

(5) In this article, the expression "agents", in relation to an enrolled person, means and includes the bankers and the auditor of the enrolled person.

(6) When an officer or an employee of an enrolled company, or a person registered or enrolled, or an officer or an employee of such person, has reason to believe that an activity or proposed activity could involve money laundering, he shall act in compliance with the reporting and other obligations set out in the regulations made under article 12 of the Prevention of Money Laundering Act and any procedures and guidance issued thereunder, and such disclosure shall not constitute a breach of confidentiality.

(7) The competent authority, when processing personal data for the purposes of the Act and any regulations, Insurance Distribution Rules and Conduct of Business Rules issued thereunder, shall do so in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as amended from time to time.