S.L. 458.61 Art. 12Data protection. Cap. 586.

(1) Nothing in these regulations shall prejudice the applicability of the Regulation (EU) 2016/679 and the Data Protection Act and the fundamental rights and freedoms of data subjects.

(2) Where the Superintendent in his capacity of a controller processes the personal data listed in the Schedule through the COVID Result Submission Malta for reasons of public interest in the area of public health pursuant to Articles 6(1)(e) and 9(2)(i) of Regulation

(EU) 2016/679, he shall:

(a) comply with all the principles relating to the processing of personal data pursuant to Article 5(1) of Regulation (UE) 2016/679; and

(b) apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed, and prevent abuse or unlawful access to or transfer of, personal data pertaining to the data subjects.

(3) The controller shall only process personal data which is strictly necessary for the purposes of these regulations:

Provided that the controller shall retain the personal data of the data subjects, including the information in relation to the test performed on the data subjects for the purposes of these regulations, for a period of two (2) years from the date of the performance of the test.

(4) Data subjects shall have the right to exercise their data protection rights pursuant to Chapter III of Regulation (EU) 2016/679 in relation to any personal data processed by the controller.