S.L. 217.26 Art. 20Data protection. Cap. 586.

(1) Nothing in these regulations shall prejudice the applicability of the General Data Protection Regulation and the Data Protection Act and the fundamental rights and freedoms of the data subject.

(2) Where the Agency in its capacity of data controller processes personal data on the applicant or the beneficiary and, or dependants under the Programme, it shall:

(a) comply with the principles relating to processing of personal data pursuant to Article 5(1) of the General Data Protection Regulation;

(b) apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed, and prevent abuse or unlawful access to or transfer of, personal data pertaining to the main applicant or the beneficiary, and, or dependants.

(3) The controller shall retain the personal data of the beneficiary and, or his dependants, as long as the certificate issued to the beneficiary and dependants, if any, pursuant to these regulations remains in force: Provided that where the application is refused, or where the certificate is revoked, such data shall be retained for the purposes of these Regulations for a period of five (5) years from the date of the refusal of the application or the revocation of the certificate:

Provided further that for the purpose of regulation 13(1)(j), the Agency may retain the minimum details identifying a beneficiary and, or his dependants whose application has been refused or revoked, for an additional period of five (5) years.

(4) Where the Agency pursuant to its functions under these Regulations processes information in relation to due diligence data, the Agency may restrict the rights and obligations provided for in Articles 14 to 20 and Article 34 of the General Data Protection Regulation in accordance with Article 23 of the General Data Protection Regulation:

Provided that such personal data shall only be restricted in case the Agency refuses the application or revokes the certificate:

Provided further that the Agency’s Data Protection Officer designated pursuant to Article 37 of the General Data Protection Regulation shall be consulted as appropriate in a timely manner in the entire process of applying the restriction.

(5) The restrictions under sub-regulation (4) shall only apply in the event that these restrictions are considered as a necessary and proportionate measure to protect the sources and confidentiality of legally privileged information collected in the course of carrying out the due diligence process and to:

(a) safeguard important objectives of general public interest of the Republic of Malta; or

(b) protect national and public security and the obligations of the Agency connected with its functions pursuant to these regulations.

(6) The Agency shall apply the restrictions referred to in sub-regulation (4) for as long as the reasons justifying them remain applicable following a necessity and proportionality test. The reasons justifying the restrictions shall be documented and made available to the Commissioner when and as required.

(7) Where the reasons for a restriction no longer apply, the Agency shall lift the restriction and inform the data subject concerned accordingly and comply with the rights and obligations provided for in Articles 14 to 20 and Article 34 of the General Data Protection Regulation.

(8) The Agency shall review the application of the restrictions referred to in this regulation and depending on the outcome of such review inform the data subject accordingly.

(9) For the safeguard of the rights and freedoms of the data subject, the following conditions and safeguards shall apply to documents, reports and other personal data processed throughout the due diligence process subject to the restrictions in terms of sub-regulation (4):

(a) access to due diligence data by competent authorities other than the Agency shall not be permitted unless provided for by law;

(b) the Agency shall maintain an audit trail record of access to due diligence data by competent authorities, containing at least the date of the access, the identifiable details of the Agency’s officer accessing the data, the requesting competent authority and the purpose for the access. Such audit trail record shall be kept for as long as the due diligence data is stored in line with sub-regulation (3);

(c) the Agency’s Data Protection Officer shall keep a register to record the restrictions applied in relation to the requests made by the applicants. The register shall include the details of the applicants, the right requested to be exercised that was restricted and the purpose for such restriction. Restriction of rights in terms of Article 34 of the General Data Protection Regulation, shall also be recorded in the register; and

(d) the applicants in their capacity as data subjects shall be informed of the application of restrictions to their rights by informing the data subject concerned in reply to the request to exercise any of the rights which are being restricted in terms of these regulations, unless this may be prejudicial to the purpose of the restriction:

Provided that the Agency justifies the prejudice claimed by the Agency to the Commissioner when and where requested.