Cap. 371 Art. 35BPublication of administrative penalties.

(1) The competent authority shall publish, on its official website and in any other media as it considers appropriate, any administrative penalty or penalties imposed under the provisions of this Act or of any regulations made or Banking Rules or Conduct of

Business Rules issued thereunder, of the CRR, or of any binding legal instruments issued under the CRD. Such publications shall include information on the type and nature of the breach and the identity of the person on whom the penalty is imposed, without undue delay after that person is informed of those penalties:

Provided that in cases where an appeal has been filed by the person on whom such administrative penalty or penalties have been imposed, the competent authority shall, without undue delay, also publish on its official website and in any other media as it considers appropriate, information on the status of the appeal and the outcome thereof.

(2) The competent authority shall publish the penalties imposed under the provisions of this Act or of any regulations made or Banking Rules or Conduct of Business Rules issued thereunder, of the CRR, or of any binding legal instruments issued under the CRD, on an anonymous basis, in any of the following circumstances:

(a) where the penalty is imposed on a natural person and, following an obligatory prior assessment, publication of personal data is found to be disproportionate;

(b) where publication would jeopardise the stability of financial markets or an on-going criminal investigation;

(c) where publication would cause, insofar as it can be determined, disproportionate damage to the credit institutions or natural persons involved: Provided that, with respect to paragraphs (a), (b) and (c), publication on an anonymous basis in any such circumstances shall be an exceptional measure which needs to be justified by a detailed report compiled by the competent authority:

Provided further that, where the circumstances referred to in this sub-article are likely to cease within a reasonable period of time, publication under this article may be postponed for such a period of time.

(3) Information published in terms of this article shall remain on the official website of the competent authority for a period of not less than five years. Personal data shall be retained on the official website of the competent authority and in any other media it considers appropriate only for the period necessary, in accordance with the provisions of Maltese legislation on data protection.