S.L. 460.43 Art. 1Citation, scope, commencement and applicability. 2 [S.L.   S.L. 460.41. 3         S.L. 586.01.

(1) The title of this order is the Resilience of Critical

Entities and Infrastructures (Identification, Designation and

Protection) Order.

(2) The scope of this order is to transpose Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC. This order:

(a) establishes national obligations to take specific measures aimed at ensuring that services which are essential for the maintenance of vital societal functions or economic activities within the scope of Article 114 of Treaty on the Functioning of the European Union (TFEU) are provided in an unobstructed manner in the internal market, in particular obligations to identify critical entities and to support critical entities in meeting the obligations imposed on them;

(b) establishes obligations for critical entities aimed at enhancing their resilience and ability to provide services as referred to in paragraph (a) in the internal market;

(c) establishes rules:

(i) on the supervision of critical entities;

(ii) on enforcement;

(iii) for the identification of critical entities of particular European significance and on advisory missions to assess the measures that such entities have established to satisfy their obligations under Part III;

(d) establishes common procedures for cooperation and reporting on the application of this order; INFRASTRUCTURES (IDENTIFICATION, 460.43 DESIGNATION AND PROTECTION)

(e) establishes measures with a view to achieving a high level of resilience of critical entities in order to ensure the provision of essential services within the Union and to improve the functioning of the internal market.

(3) This order shall come into force on such a date as the Minister responsible for the resilience of critical entities and infrastructures may by notice in the Gazette establish, and different dates may be so established for different provisions or different purposes of this order.

(4) Without prejudice to article 9, this order shall not apply to matters covered by the Measures for a High Common Level of

Cybersecurity across the European Union (Malta) Order. In light of the relationship between the physical security and cybersecurity of critical entities, the CIP Department and the designated competent authorities shall ensure that this order and the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order are being implemented in a coordinated manner.

(5) Where the provisions of sector-specific Union legal acts require critical entities to take measures to enhance their resilience and where those requirements are recognised by the CIP Department and the designated competent authorities as at least equivalent to the corresponding obligations established in this order, the relevant provisions of this order, including the provisions on supervision and enforcement established in Part VI shall not apply.

(6) Without prejudice to Article 346 TFEU, information that is confidential pursuant to Union or national rules, such as rules on business confidentiality, shall be exchanged with the Commission and other relevant authorities in accordance with this order only where that exchange is necessary for the application of this order. The information exchanged shall be limited to that which is relevant and proportionate to the purpose of such exchange. The exchange of information shall safeguard the confidentiality of such information and the security and commercial interests of critical entities, while respecting the national security.

(7) This order is without prejudice to the national responsibility for safeguarding national security and defence and their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.

(8) This order does not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement, including the investigation, detection and prosecution of criminal offences, nor does it affect the competence of any public administration entity terms in safeguarding other essential national functions, in particular concerning public security, territorial integrity and the maintenance of law and order.

(9) Critical entities which carry out activities in the areas of national security, public security, defence or law enforcement, including the investigation, detection and prosecution of criminal offences, or which provide services exclusively to the public administration entities referred to in sub-article (4) may be exempted from article 10 and Parts III, IV and V, by means of instructions issued by the CIP Department.

(10) The obligations stipulated in this order shall not entail the supply of information the disclosure of which would be contrary to the essential interests of national security, public security or defence.

(11) This order is without prejudice to Union law on the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

95/46/EC (General Data Protection Regulation) and the Processing of

Personal Data (Electronic Communications Sector) Regulations.