S.L. 460.41 Art. 40Mutual assistance. 57 58 [S.L.

(1) Where an entity provides services in Malta and in other Member States, or provides services in Malta or in other Member

States and its network and information systems are located in Malta and in other Member States, the CIP Department, or where designated the competent authority, shall cooperate with and assist competent authorities of the Member States concerned as necessary. Such cooperation shall entail, at least, that:

(a) when the CIP Department, or the designated competent authority, apply supervisory and, or enforcement measures in Malta, the CIP Department, or where designated the competent authority, shall inform and consult the competent authorities in the other Member States concerned on the supervisory and, or enforcement measures taken:

Provided that the designated competent authority shall notify in writing the Malta CIP Department, or where designated the competent authority, of the application of such supervisory and, or enforcement measures in Malta;

(b) the Malta CIP Department, or where designated the competent authority, may request the competent authority of another Member State to take supervisory and enforcement measures in Malta:

Provided that such measures are exercised under the guidance and agreement of the CIP Department, or where designated the competent authority:

Provided further that if the CIP Department, or where designated the competent authority, is not responsible for the sector, sub-sector, or type of entity under the First or Second Schedule, the CIP Department shall cooperate with and coordinate measures arising from this sub-article with the designated competent authority in Malta;

(c) upon receipt of a substantiated request from another competent authority, the CIP Department, or where designated the competent authority, shall provide the other competent authority mutual assistance proportionate to its own resources so that the supervisory and enforcement measures may be implemented in an effective, efficient and consistent manner.

(2) The mutual assistance referred to in sub-article (1)(c) may cover information requests and supervisory measures, including requests to carry out on-site inspections or off-site supervision or targeted security audits.

(3) The CIP Department, or where designated the competent authority, shall not refuse the request under sub-article (2), unless it is established that: CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

(a) it does not have the competence to provide the requested assistance;

(b) the requested assistance is not proportionate to the supervisory tasks of the competent authority; or

(c) the request concerns information or entails activities which, if disclosed or carried out, would be contrary to the essential interests of Malta’s national security, public security or defence:

Provided that before refusing such a request, the CIP Department, or where designated the competent authority, shall consult the other competent authorities concerned and upon the request of one of the Member States concerned, the European Commission and ENISA:

Provided further that the notification of such a request to the competent authority of the other Member State shall be done by the CIP Department, or where designated the competent authority.

(4) Where appropriate and with common agreement, the CIP Department, or where designated the competent authority, may carry out joint supervisory actions with competent authorities of various Member States:

Provided that in joint supervisory actions, the CIP Department, or where designated the competent authority may, where appropriate, confer powers, including supervisory and, or enforcement measures under articles 29 and 30 onto the members or staff of the other competent authorities:

Provided further that the joint supervisory actions shall be coordinated by the CIP Department.