S.L. 123.127 Art. 21Data protection.

(1) (a) Every exchange of information in accordance with these regulations shall be made in conformity with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection

Regulation) and the Data Protection Act, including the regulations made thereunder.

(b) The Commissioner may restrict the rights and obligations established in Article 13, Article 14(1) and Article 15 of Regulation (EU) 2016/679, where such restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard the objective established in Article 23(1)(e) of Regulation (EU) 2016/679. Before applying a restriction, the Commissioner shall conduct a necessity and proportionality assessment and be able to demonstrate that the application of the restriction is necessary and proportionate.

(c) The Commissioner shall keep a record of any such restriction and the reasons for such restriction.

(d) Where a restriction applies, the Commissioner shall inform the data subject, in writing, of the rights and obligations being restricted, the reason for such restriction, and his right to file a data protection complaint with the Information and Data Protection Commissioner:

Provided that this requirement shall not apply where such information may be prejudicial to the purpose of the restriction.

(e) The Commissioner shall periodically review the decision applying a restriction and assess the necessity and proportionality thereof to ensure that the justification for the restriction is still valid:

Provided that where the reason for the restriction no longer applies, the Commissioner shall lift the restriction without undue delay.

(f) The data protection officer shall be consulted, properly and in a timely manner, with respect to such restriction as referred to in paragraph (a), both prior to and throughout the duration of such restriction.

(2) Regulation (EU) 2018/1725 of the European Parliament and of the Council of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC shall apply to any processing of personal data under the EU Administrative Cooperation Directive by the Union institutions, bodies, offices and agencies. However, for the purposes of the correct application of the EU Administrative Cooperation Directive, the scope of the obligations and rights provided for in Article 15, Article 16(1), and Articles 17 to 21 of Regulation (EU) 2018/1725 shall be restricted to the extent required in order to safeguard the interests referred to in point (c) of Article 25(1) of the said Regulation.

(3) The Reporting Malta Financial Institutions, the intermediaries, the Reporting Malta Platform Operators, Reporting Crypto-Asset Providers and the competent authority in Malta shall be considered to be data controllers when, acting alone or jointly, they determine the purposes and means of the processing of personal data within the meaning of the regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and the Data Protection Act.

(4) Notwithstanding the provisions of sub-regulation (1), the Commissioner shall ensure that each Reporting Malta Financial Institution, intermediary, or Reporting Malta Platform Operator, or Reporting Crypto-Asset Provider, as the case may be, which falls under the jurisdiction of Malta:

(a) informs each individual concerned that information relating to such individual shall be collected and transferred in accordance with these regulations; and

(b) provides to each individual concerned with all the information that the individual is entitled to from the data controller in sufficient time for such individual to exercise his data protection rights and, in any case, before the information is reported:

Provided that notwithstanding the provisions of this sub-regulation, each Reporting Malta Platform Operator shall inform Reportable Sellers of the reported consideration.

(5) Information processed in accordance with these regulations shall be retained for not longer than is necessary to achieve the purposes of these regulations:

Provided that information received through the automatic exchange of information in accordance with sub-regulations (1) to (13) of regulation 13 shall be retained for not longer than is necessary but in any event, not less than five (5) years from its date of receipt to achieve the purposes of these regulations.

(6) In the case that a data breach occurs in Malta:

(a) the competent authority in Malta shall report the data breach and any subsequent remedial action to the Commission without delay; and

(b) the competent authority in Malta shall investigate, contain and remedy the data breach and shall, by giving notice in writing to the Commission, request the suspension of the CCN access for the purposes of these regulations, if the data breach cannot be contained immediately and appropriately.

(7) In the case that a data breach occurs in another Member State, the competent authority in Malta may suspend the exchange of information to the Member State where the data breach occurred by giving notice in writing to the Commission and the Member State concerned. Such suspension shall have immediate effect.

(8) The competent authority in Malta together with the other Member States, assisted by the Commission, shall agree on the practical arrangements necessary for the implementation of the said Regulation, including data breach management processes which are aligned with internationally recognised good practices and, where appropriate, a joint data controller agreement, an agreement between the data processor and the data controller, or models thereof.