S.L. 370.48 Art. 10Reporting of breaches. 8 [S.L.

(1) The competent authority shall establish effective and reliable mechanisms to encourage the reporting to it of potential or actual breaches of the provisions of the Act, regulations and Investment Services Rules issued thereunder transposing the requirements of the IFD, and of the provisions of the IFR.

(2) The mechanisms referred to in sub-regulation (1) shall include at least:

(a) specific procedures for the reception, treatment and following up of such reports, including the establishment of secure communication channels;

(b) appropriate protection against retaliation, discrimination or other types of unfair treatment by the investment firm for employees of investment firms who report breaches committed within the investment firm; (ADMINISTRATIVE PENALTIES, MEASURES 370.48 AND INVESTIGATORY POWERS)

(c) protection of personal data concerning both the person who reports the breaches and the natural person who is allegedly responsible for a breach, in accordance with the Maltese legislation on data protection and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

(d) clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports the breaches committed within the investment firm, unless disclosure is required by national law in the context of further investigations or subsequent judicial proceedings.

(3) Investment firms shall have in place appropriate procedures for their employees to report breaches internally through a specific independent channel. Those procedures may be provided for by the social partners provided that those procedures offer the same protection as the protection referred to in paragraphs (b), (c) and (d) of sub-regulation (2).