S.L. 370.48 Art. 7Publication of administrative penalties and measures.

(1) The competent authority, without undue delay, shall publish on its official website and, or on any other media, as deemed appropriate, any administrative penalties and measures which are imposed for breaches of the Act, regulations and Investment Services Rules issued thereunder transposing the requirements of the IFD, and of the IFR. Such publication shall include information on the type and nature of the breach and the identity of the natural or legal person on whom the penalty or measure is imposed. The information shall only be published by the competent authority after that person has been informed of those administrative penalties or measures and to the extent that the publication is necessary and proportionate:

Provided that, in cases where an appeal has been filed by the person on whom such administrative penalties or measures have been imposed, the competent authority shall, without undue delay, also publish on its official website information on the status of the appeal and the outcome thereof.

(2) The competent authority shall publish the penalties or measures imposed in terms of these regulations, on an anonymous basis, in any of the following circumstances:

(a) where the penalty or measure is imposed on a natural person and, following an obligatory prior assessment, the publication of personal data is found to be disproportionate;

(b) where publication would jeopardise the stability of financial markets or an ongoing criminal investigation; or

(c) where publication would cause, insofar as it can be determined, disproportionate damage to the investment firms, or natural persons involved:

Provided that, where the circumstances referred to in paragraph (a) are likely to cease within a reasonable period of time, publication in terms of sub-regulation (1) may be postponed for such period of time.

(3) Information published in terms of this regulation shall remain on the official website of the competent authority for a period of not less than five years. Personal data shall be retained on the official website of the competent authority only for the period necessary, in accordance with the provisions of Maltese legislation on data protection.