Privacy Notice
- Last updated
MFSA Privacy Notice
Data Controller
Unless otherwise specified, the MFSA processes personal data on the following legal bases under Article 6 GDPR:
- Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the MFSA is subject;
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the MFSA;
- Article 6(1)(b) – processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract (e.g. recruitment, procurement);
- Article 6(1)(f) – processing is necessary for legitimate interests pursued by the MFSA (where applicable and provided such interests are not overridden by the interests or fundamental rights and freedoms of the data subject);
- Article 6(1)(a) – consent, in accordance with Article 7 GDPR.
Where special categories of personal data are processed, the MFSA relies on Article 9(2)(g) GDPR (substantial public interest), Article 9(2)(b) (employment law obligations) or Article 9(2)(f) (processing is necessary for the establishment, exercise or defence of legal claims), or other applicable provisions under EU or national law.
Legal Basis for Processing
The MFSA is the controller of personal data in terms of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data(General Data Protection Regulation – “the GDPR”), and the Data Protection Act (Chapter 586 of the Laws of Malta – “DPA”).
The MFSA processes personal data in accordance with the GDPR, the DPA and any other relevant European Union (“EU”) and national legislation. The MFSA ensures inter alia the confidentiality, integrity and security of this personal data.
The MFSA is located at Triq l-Imdina, Zone 1, Central Business District, Birkirkara, CBD 1010, Malta.
Legal Basis for Processing
Unless otherwise specified, the MFSA processes personal data on the following legal bases under Article 6 GDPR:
- Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the MFSA is subject;
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the MFSA;
- Article 6(1)(b) – processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract (e.g. recruitment, procurement);
- Article 6(1)(f) – processing is necessary for legitimate interests pursued by the MFSA (where applicable and provided such interests are not overridden by the interests or fundamental rights and freedoms of the data subject);
- Article 6(1)(a) – consent, in accordance with Article 7 GDPR.
Where special categories of personal data are processed, the MFSA relies on Article 9(2)(g) GDPR (substantial public interest), Article 9(2)(b) (employment law obligations) or Article 9(2)(f) (processing is necessary for the establishment, exercise or defence of legal claims), or other applicable provisions under EU or national law.
The MFSA processes personal data in accordance with the GDPR, the DPA and any other relevant European Union (“EU”) and national legislation. The MFSA ensures inter alia the confidentiality, integrity and security of this personal data.
The MFSA is located at Triq l-Imdina, Zone 1, Central Business District, Birkirkara, CBD 1010, Malta.
Purpose for Collecting Personal Data
Processing of Personal Data in the Exercise of Statutory Functions
The MFSA processes personal data as necessary for the performance of its statutory functions and the exercise of its official authority as established under applicable financial services legislation. These functions include, inter alia:
- Authorisation and licensing of regulated entities and individuals;
- Ongoing supervision and regulatory oversight;
- Enforcement and compliance investigations;
- Resolution, recovery and crisis management functions;
- Market monitoring and maintenance of statutory registers;
- Promote consumer protection by safeguarding their rights and interests in the financial sector, and
- Cooperation and information exchange with national, European and international competent authorities and/or organisations.
Categories of Data Subjects
The MFSA may process personal data relating to the following categories of individuals, in the exercise of its statutory functions:
- Applicants for authorisation, licensing, or approval, including individuals subject to fitness and properness assessments;
- Shareholders, beneficial owners, directors, key function holders, and employees of regulated entities;
- Individuals subject to supervisory reviews, inspections, or enforcement investigations;
- Individuals whose personal data is processed in connection with the supervision of licensed entities;
- Persons discharging managerial responsibilities (PDMRs) and persons closely associated with them;
- Individuals connected to resolution, recovery, and crisis management processes;
- Beneficial owners of trusts and other legal arrangements required to be registered under applicable law;
- Individuals applying under specific statutory schemes administered by the MFSA (including tax-related eligibility determinations);
- Members of committees, working groups, and regulatory cooperation structures;
- Complainants, whistleblowers, and other individuals engaging with the MFSA; and
- Other individuals whose personal data is provided to the MFSA pursuant to applicable financial services legislation.
Categories of Personal Data Processed
The MFSA may process the following categories of personal data depending on the statutory function exercised:
- Identification data including name, ID/passport details, date of birth;
- Contact details including business and/or residential address, email address, telephone number;
- Professional and employment information;
- Financial information;
- Shareholding and/or ownership information;
- Regulatory and compliance-related information;
- Information relating to suitability, reputation, and fitness and properness assessments;
- Information collected during on-site or off-site supervisory inspections, audits, or monitoring visits, including observations, records, and documents reviewed as part of regulatory oversight;
- Information relevant to investigations and enforcement proceedings;
- Information submitted through statutory registers and reporting obligations; and
- Where strictly necessary and authorised by law, special categories of personal data.
The processing of personal data by the MFSA arises from statutory requirements under applicable Maltese and European Union financial services legislation. Where the provision of personal data is mandatory, failure to provide such data may prevent the MFSA from processing an application, granting approval, or otherwise performing its statutory functions.
Whilst most personal data is obtained directly from the data subject, certain data may be collected from regulated entities, competent authorities, public registers, or other lawful sources. Where personal data are not obtained directly from the individual concerned, the MFSA will provide the information required under Article 14 GDPR, unless an exemption under Article 14(5) or Article 23 GDPR applies.
Processing of Personal Data through the Licence Holder (LH) Portal
The MFSA operates the LH Portal, an online platform used to facilitate communication and regulatory interactions between the MFSA and applicants, licence holders, authorised persons, service providers, and other stakeholders.
The LH Portal enables users to submit and manage regulatory applications and reporting, complete due diligence requirements, communicate and exchange documents with the MFSA, maintain corporate and user profile information, track regulatory submissions, and meet applicable legal and regulatory obligations. Users of the LH Portal are responsible for ensuring that any personal data submitted through the portal is accurate, updated and relevant.
Personal data submitted through the LH Portal may be shared with competent authorities, regulatory bodies, law enforcement authorities, external advisors, service providers, or other third parties where permitted or required by law and in accordance with the MFSA’s statutory functions.
Processing of Personal Data when Calling the MFSA
The MFSA may record calls made to its Reception and Communications functions. Call recordings are processed for quality, training, and security purposes. Any personal data included in recordings will be anonymised before use for statistical or training purposes.
Processing of Personal Data when interacting with the MFSA Website
When you visit the MFSA website (www.mfsa.mt) (“MFSA’s website, the MFSA’s servers automatically record information transmitted by your browser. This information may include:
- The requested web page or downloaded content;
- Whether the request was successful;
- The date and time of your visit;
- The Internet Protocol (“IP”) address or domain name of the device used to access the website;
- The operating system of the device, browser type and version, browser language and browser screen size;
- One or more cookies that identify the browser.
The MFSA collects and processes this information solely for statistical and analytical purposes on an aggregated basis to assess website usage and improve its functionality.
Use of Cookies
Cookies are small text files stored on a user’s device when visiting a website. The MFSA’s website uses cookies to enhance user experience, store preferences, and analyse website traffic on an aggregated basis.
The MFSA’s website also utilises third-party tools to generate aggregated statistical reports on website usage.
Where required, consent for non-essential cookies shall be obtained through the website’s cookie management tool and may be withdrawn at any time.
Processing of Personal Data via Contact Forms and Tools
Any personal data collected through the ‘Get in Touch’ section of our website shall be processed to provide you with the necessary information relating to your request and to respond to your inquiries.
Any personal data collected through the ‘Payment Accounts Fees Comparison Tool’ page of our website shall be processed, to provide consumers with information regarding the fees being charged by payment account providers, in relation to the products and services featured on the ‘Payment Accounts Fees Comparison Tool’, in accordance with the Credit Institutions and Financial Institutions (Payment Accounts) Regulations (S.L. 371.18).
Processing of Personal Data in Email Correspondence and Letters
The MFSA processes personal data contained in email communications, letters, and other written correspondence sent to the MFSA through official email addresses or postal mail. This processing is carried out to respond to enquiries, fulfil requests, provide services, manage complaints, and comply with statutory and administrative obligations.
Personal data in such communications may include name, contact details, account references, case references, attachments, and any other information contained in the message.
Processing of Personal Data via Social Media and Online Platforms
The MFSA may process personal data provided through its official social media channels or other online platforms including LinkedIn, Facebook, X, Instagram and YouTube. This may include personal data contained in direct messages, public comments, submissions, or profile information provided by individuals when interacting with the MFSA’s official accounts or pages.
Such personal data is processed for the purpose of responding to enquiries, engaging with stakeholders, sharing information, or complying with regulatory and statutory obligations. The MFSA does not routinely use personal data obtained via social media for purposes beyond those expressly communicated unless there is a legal basis under the GDPR.
Processing of Personal Data in connection with Whistleblower Reports
Processing of Personal Data for Recruitment Purposes
Processing of Personal Data in Connection with Events
Processing of Personal Data by the MFSA Financial Supervisors Academy (FSA)
Processing Personal Data by the Journal of Financial Supervisors Academy (JFSA)
The MFSA processes personal data for the purposes of collection of academic material, including manuscripts and proposals, that are submitted by interested parties for their publication onto the JFSA.
Processing of Personal Data for the Tendering and Supply of Goods or Services
The MFSA processes personal data submitted by tenderers to manage procurement processes and contracts. This includes data of tenderers, their staff, or sub-contractors. In assessing the suitability of the tenderers, their staff and any sub-contractors for the role, the MFSA undertakes a due diligence assessment to ascertain that the entities and/or individuals chosen are of good conduct and character. This process may also involve contacting third parties in order determine suitability. Once a contract is awarded, the MFSA processes the data to fulfil its contractual obligations.
Processing of Personal Data in Connection with MFSA Premises and Security
For security, safety, and operational purposes, the MFSA may collect and process personal data when individuals visit or access its physical premises. This may include:
- CCTV and video surveillance recordings
- Visitor registration details
- Access control data including visitor tags, visitor sign-in logs
Such processing is carried out on the basis of legitimate interests of the MFSA in ensuring the safety and security of its facilities, personnel, visitors, and property, and in compliance with applicable laws. CCTV recordings and access records are retained only for as long as necessary for security purposes.
Disclosure of Personal Data
Disclosure of Data Relating to Beneficial Ownership Information Reported in the Beneficial Ownership Register of Trusts
The MFSA processes and discloses personal data of beneficial owners of trusts as required by law under the Trusts and Trustees Act (Chapter 331 of the Laws of Malta), the Trusts and Trustees Act (Register of Beneficial Owners) Regulations (S.L. 331.10) and the applicable EU legislation for the purpose of establishing and maintaining the Register of Beneficial Owners of Trusts, ensuring transparency of ownership structures, and fulfilling its supervisory and regulatory functions.
In this context, and insofar as the processing activities relating to Trusts Ultimate Beneficial Ownership Register (“TUBOR”) are concerned, the MFSA acts as the data controller. For the specific purpose of determining access privileges and allocation of rights to the Beneficial Ownership Registers Interconnection System (“BORIS”), the MFSA acts as joint controller together with the Malta Business Registry, insofar as both entities jointly determine the purposes and means of such access-related processing.
Disclosure of Information for the Purposes of Protecting Consumers of Financial Services
Retention Periods of Personal Data
Automated Decision-Making
The MFSA does not take decisions concerning individuals based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them, without human involvement.
Where elements of automated processing are used to support supervisory, analytical or risk-based assessments, such processing forms part of a broader decision-making process subject to appropriate human review and oversight.
Individuals’ Rights
- The right to be informed;
- The right of access to their personal data;
- The right of rectification of inaccurate or incomplete personal data;
- The right for erasure of personal data;
- The right for restriction of the processing;
- The right to object to the processing of the personal data;
- The right to data portability;
- The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Contact Details of the Data Protection Officer
Any queries in relation to your rights under Data Protection Legislation, this Privacy Notice, or the processing of your personal data by the MFSA may be forwarded to the MFSA’s Data Protection Officer.
The Data Protection Officer may be contacted by:
- E-mail at dpo@mfsa.mt;
- Postal mail at Malta Financial Services Authority, Triq l-Imdina, Zone 1, Central Business District, Birkirkara, CBD 1010, Malta.
Links
The MFSA’s website may contain links to external sites or third-party services that are not owned or operated by the MFSA. Such websites and/or services are not governed by this Privacy Notice.
The MFSA does not exercise control and is not responsible for, the privacy practices, content or data processing activities of such third party websites. Users are encouraged to review the applicable privacy notices of any external websites they visit before providing personal data.
Changes to this Privacy Notice
The MFSA may update this Privacy Notice to reflect changes in its practices or to comply with new legal requirements. It is therefore advisable to periodically review the ‘Privacy Notice’ page to remain informed of any modifications.
Pulizija Data Protection
We are deeply committed to upholding the highest standards of data protection and privacy. We recognize the critical importance of safeguarding the personal information of the individuals we interact with, as well as the sensitive data that is essential to our operations. Our data protection policies, detailed on this page, provide transparency about the safeguards in place and outline your rights. Here, you can also learn about the systems we employ to protect your information.
Our Data Protection Policy
Our Data Retention Schedule
Know Your Data Protection Rights
What Are Your Rights In Relation To Your Personal Data Processed By The Malta Police Force?
Personal data processed by the Malta Police Force is regulated by the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations (Subsidiary Legislation 586.08) and the GDPR1 when the processing is conducted for other purposes.
However, there are instances when such processing is regulated by specific legislative instruments of the European Union.
In any case, any person has the right to:
request access to personal data relating to them being processed by the Malta Police Force;
request the correction of factually inaccurate personal data relating to them or the deletion of their personal data in the case of unlawfully stored information;
the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) or to request verification of lawfulness of the processing.
How To Exercise Your Rights?
In Malta, any individual has the right to request access, correction or deletion of their personal data by contacting directly the data controller which in this case is the Commissioner of Police, via the Data Protection Officer, or indirectly via the Office of the IDPC as explained below.
Such rights may be exercised directly by submitting a formal request to the Data Protection Officer, on any of the following:
Address: The Data Protection Officer, Legal & Data Protection Unit, Police General Headquarters, St. Calcedonius Square, Floriana, FRN 1530, Malta
Email: dpu.police@gov.mt
Requests submitted by electronic means will be replied through the same means. Due to potential risks of submitting copies of personal documents and other sensitive information via open internet, it is advisable that the security of such electronic means is ensured before submitting the request.
Applicants should provide the following identification details in order to facilitate the responsible authority in dealing with the request:
Name and surname of applicant;
ID Card or Passport Number;
What particular information they would like to see;
A copy of the ID Card or Passport is also to be submitted for identification verification purposes.
In accordance with Maltese law, the request must be submitted in writing and signed by the data subject. The request must be made in Maltese or English.
In order to facilitate the exercise of your rights, the Malta Police Force has prepared a generic access request letter. It is imperative that when using this letter, one indicates clearly the type of personal data which he is requesting to access, rectify or delete.
Are there any limitations to your right?
The right of the data subject may be delayed, restricted or omitted, for as long as this constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned in terms of the law.
Such measures may be imposed in order to:
Avoid obstructing official or legal inquiries, investigations or procedures.
Avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties.
Protect public security.
Protect national security.
Protect the rights and freedoms of others.
In the eventuality of a restriction or refusal, the individual is informed in writing of the decision, including reasons for the decision, unless such communication would have a bearing on the work of competent authorities or on the rights and freedoms of other individuals.
Right To Lodge A Complaint
Any person not satisfied with a reply to his request as outlined above may file a complaint with the office of the IDPC or request that the IDPC verifies that his/her data protection rights are being respected and that his/her personal data are processed according to law.
The Information and Data Protection Commissioner
The Information and Data Protection Commissioner (IDPC) is the national supervisory authority in Malta responsible to conduct independent supervision, monitoring and enforcement of data protection legislation.
To that end, the IDPC is empowered to have access and inspect all the personal data and filing systems in Malta.
The Office of the IDPC may be reached on the following contact details:
Address: Information and Data Protection Commissioner, Floor 2, Airways House, High Street, Sliema, SLM 1549, Malta
Email: idpc.info@idpc.org.mt
Website: https://idpc.org.mt/
Telephone: +35623287100
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Systems: Body Worn Cameras (BWCs)
The use of Body Worn Cameras (BWCs) is an effective tool in the fight against crime. It also demonstrates the commitment of Law Enforcement Authorities to transparency, ensure accountability of its members, increase public trust in users, and protect its members from unjustified complaints of misconduct.
The Malta Police Force, following on the footsteps of other Law Enforcement Authorities in other countries, including EU Member States, has introduced the use of BWCs by all operational Police Officers. In line with the Standard Operating Procedures, whenever officers know or have a reasonable expectation that they will be interacting with the public in the discharge of their duties related to law enforcement, particularly in relation to the prevention, investigation and detection of criminal offences, the BWCs will be activated. Once activated, the BWCs will light a Green LED so that the public will be aware that the camera is in operation. All captured data will be then stored in a secure manner on a server and managed by a dedicated office under strict conditions and subject to adequate safeguards.
Legal Basis
The processing of personal data captured via BWCs is based on various legal provisions:
It is the duty of the Police to preserve public order and peace, to prevent and to detect and investigate offences, to collect evidence, whether against or in favour of the person suspected of having committed the offence, and to bring the offenders, whether principals or accomplices, before the judicial authorities in terms of Article 346(1) of the Criminal Code (Chapter 9 of the Laws of Malta).
This duty is reinforced and complemented by Article 4(a) of the Police Act (Chapter 164 of the Laws of Malta), which lists as one of the main objectives of the Police Force to preserve public order and peace, to prevent the commission of offences, to promote the observance of the laws, as a first guarantee of the rights of all persons in Malta, even before action is needed through the judicial system to repress, sanction or remedy any breach.
Article 62(1) of the Police Act specifically empowers the Police to hold, process and classify any information relevant to the commission of any crime in or outside Malta which information may be preserved by any system whatsoever, including electronic format.
Moreover, the Malta Police Force, may collect personal data by technical surveillance or other automated means for the prevention, investigation, detection and prosecution of criminal offices in terms of Regulation 8(3) of S.L. 586.08.
Personal Data Captured By BWCs
The categories of personal data captured by BWCs is limited to audio-visual footages and GPS coordinates. Under certain instances, such data may also include special categories data (particularly data concerning health), such as for example when the individuals concerned, on scene of an incident, are suffering from physical injuries.
Disclosure Of Data Captured By BWCs
Data captured by BWCs will be solely used for criminal investigation purposes by the Malta Police Force and may be made available to other competent authorities such as the Attorney General and the Judicial authorities in accordance with the law. In some instances, such data may also be used for internal monitoring and investigation purposes.
There may be instances where such data will be made available to foreign Law Enforcement Authorities, particularly Law Enforcement Authorities in other Member States, in pursue of a legal obligation or a bilateral agreement within the context of Police Cooperation.
Retention Period
All data collected from BWCs are kept for period of ninety (90) days in accordance with the Data Retention Schedule, as approved by the Information and Data Protection Commissioner. All data will be automatically deleted upon the expiration of such period in a secure way.
What Are Your Rights In Relation To Your Personal Data Captured By BWCs?
The processing of personal data collected via BWCs is regulated by the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations (Subsidiary Legislation 586.08).
Any person has the right to:
request access to personal data relating to them processed;
request the correction of factually inaccurate personal data relating to them or the;
deletion of their personal data in the case of unlawfully processed information;
request restriction of processing of their personal data according to law;
the right to lodge a complaint with the Information and Data Protection Commissioner.
How To Exercise Your Rights?
In Malta, any individual has the right to request access, correction or deletion of their personal data by contacting directly the data controller which in this case is the Malta Police Force, via the Data Protection Officer.
Such rights are exercisable by submitting a formal request, preferably by using the following form, to the In-Field Tech Unit, on any of the following:
Address: Att. In-Field Tech Office, The Data Protection Officer, Legal & Data Protection Unit, Police General Headquarters, St. Calcedonius Square, Floriana, FRN 1530, Malta
Email: infield.police@gov.mt
Telephone: +35621224001
The right of the data subject may be delayed, restricted or omitted, for as long as this constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned in terms of the applicable law. In the eventuality of a restriction or refusal, the individual is to be informed in writing of the decision, including reasons for the decision, unless such communication could have a bearing on the work of the national competent authorities or on the rights and freedoms of other individuals.
Moreover, such rights may not be exercised in accordance with the procedure laid down above, where the personal data collected via BWCs is requested by investigating officers for investigation purposes. In such cases, the rules applicable to criminal procedure shall apply.
Systems: Entry / Exit System (EES)
The Entry/Exit System (EES) is a large-scale information system established by the European Union to improve the management of the Schengen external borders. It registers entry data, exit data and refusal of entry data of third-country nationals crossing the external borders of the Schengen Area and replaces the manual stamping of passports.
The EES supports border management, facilitates border crossings, contributes to internal security, and enables the identification of overstayers (persons who remain in the territory of the Member States longer than authorised).
The EES is used for border management and facilitation purposes, as well as for law enforcement purposes, in accordance with Regulation (EU) 2017/2226.
Legal Basis
The EES is established and regulated by:
Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES), determining the purposes of the system, the categories of data processed, retention periods, and the conditions for access, including for law enforcement purposes;
Regulation (EU) 2019/1896 on the European Border and Coast Guard, insofar as it amends and supplements certain provisions relating to the EES;
Delegated and Implementing Acts adopted by the European Commission pursuant to Articles 36 and 68 of Regulation (EU) 2017/2226, laying down technical specifications, operational procedures and data protection safeguards;
National legislation, including:
The Immigration Act (Cap. 217 of the Laws of Malta) and subsidiary legislation;
The Entry and Exit System (EES) Regulations implementing the EES in Malta;
Other applicable laws governing the competent authorities and the processing of personal data, including data protection legislation.
Structure Of The EES
The EES consists of:
A central system operated by eu-LISA;
A national system (N.EES) in each Member State (in Malta, hosted by the Malta Police Force);
A secure communication infrastructure connecting the central and national systems.
Data entered by one Member State is stored centrally and may be accessed and processed by competent authorities of other Member States, by Europol for law enforcement purposes, and by other authorised entities, strictly in accordance with Regulation (EU) 2017/2226.
Controllers & Competent Authorities In Malta
The Malta Police Force has been designated as the controller with central responsibility for the operation of the national Entry/Exit System (N.EES).
Without prejudice to this central responsibility, other national competent authorities act as controllers in their own right, and solely in respect of the processing operations carried out within the scope of their respective legal mandates and functions, as provided for under Regulation (EU) 2017/2226 and applicable national legislation.
In accordance with the EES Regulation, duly authorised staff of the following authorities may enter, amend, erase, verify and consult EES data within the limits of their legal competences:
Malta Police Force
Principal Immigration Officer
Identity Malta Agency (Identity Management and Ancillary Services)
Community Malta Agency
Ministry responsible for Foreign Affairs (for authorised diplomatic missions)
Personal Data Processed In The EES
The EES processes the following categories of personal data relating to third-country nationals subject to registration:
Alphanumeric Data:
First name(s), surname, date of birth, nationality and sex
Travel document details (type, number, issuing authority and validity)
Three-letter ISO code of the issuing country
Date, time and place of entry, exit or refusal of entry
Visa number or residence permit data, where applicable
Biometric Data:
Facial image, which is mandatory for all third-country nationals subject to registration in the EES
Fingerprints, which are mandatory for visa-exempt third-country nationals and holders of a Facilitation Transit Document
Data Relating To Refusals Of Entry:
Authority issuing the refusal
Reasons for refusal
Administrative Data:
Records of the authorities that entered, consulted, modified or erased data
Links to previous entries and exits for the purpose of establishing travel history
Mandatory Nature Of Data Collection
The collection of personal data for registration in the EES is mandatory for the examination of entry conditions at the external borders of the Schengen Area.
Entry will be refused if a third-country national refuses to provide the required biometric data (facial image and, where applicable, fingerprints) for registration, verification or identification in the EES.
Use Of Data For Overstay Detection And Authorised Stay Calculation
EES data is used to calculate the authorised duration of stay of third-country nationals.
Overstays are automatically detected, and where applicable, the individual’s data is added to the list of identified overstayers referred to in Article 12(3) of Regulation (EU) 2017/2226.
Overstaying may result in legal and administrative consequences, including refusal of entry and the initiation of return procedures.
Individuals have the right to receive information on the maximum remaining duration of their authorised stay, in accordance with Article 11(3) of Regulation (EU) 2017/2226.
Transfers Of Personal Data
Personal data stored in the EES may be transferred:
To third countries or international organisations listed in Annex I to Regulation (EU) 2017/2226 for the purposes of return;
To third countries in accordance with Article 41(6) of Regulation (EU) 2017/2226;
To other Member States in accordance with Article 42 of Regulation (EU) 2017/2226.
Such transfers take place only under the conditions and safeguards laid down in EU law.
Retention Periods
In accordance with Regulation (EU) 2017/2226:
Entry and exit data and refusal of entry data are stored for three years from the date of exit or refusal of entry;
Where no exit record exists, data is stored for five years from the date of entry;
Records relating to non-EU family members of EU, EEA or Swiss nationals entitled to free movement, who do not hold a residence card or residence permit, are stored for one year from the date of exit.
After expiry of the applicable retention period, data is automatically erased.
Your Rights In Relation To Your Personal Data In The EES
Individuals whose personal data is processed in the EES have the right to:
Obtain access to personal data relating to them stored in the EES;
Request the rectification of inaccurate personal data;
Request the completion of incomplete personal data;
Request the erasure of unlawfully processed personal data;
Request the restriction of processing, where applicable;
Receive information on the procedures for exercising these rights.
Overstayers have the right to request erasure of their personal data from the list of identified persons referred to in Article 12(3) and rectification of EES data, where they provide evidence that the authorised duration of stay was exceeded due to unforeseeable and serious events.
Requests by data subjects may be submitted either to the Malta Police Force or to any national authority having lawful access to the EES, in accordance with Regulation (EU) 2017/2226.
Individuals wishing to exercise their rights through the Malta Police Force are encouraged to use the Model Letters made available to facilitate the submission and handling of such requests.
Complaints
Individuals have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC).
Where applicable, complaints relating to processing carried out at EU level may also be addressed to the European Data Protection Supervisor (EDPS).
Systems: European Travel Information And Authorisation System (ETIAS)
The Malta Police Force is the national authority with central responsibility for the European Travel Information and Authorisation System (ETIAS) in Malta.
The National ETIAS Unit, established in accordance with the applicable European Union legal framework, will be hosted within the Malta Police Force and shall perform the functions established by law in relation to ETIAS in Malta.
Starting from the last quarter of 2026, nationals of 59 visa-free countries travelling to Europe for a short stay will be required to obtain a travel authorisation prior to travel to participating European countries.
ETIAS forms part of the European Union’s efforts to strengthen internal security and border management by carrying out pre-travel screening of visa-free travellers to assess whether they may pose a:
security risk;
irregular migration risk; or
high epidemic or public health risk.
ETIAS applies to short stays in participating European countries and does not constitute a visa.
Before Travelling
Travellers from visa-free countries falling within the scope of ETIAS will be required to obtain a valid travel authorisation before commencing travel.
ETIAS applications are submitted electronically and assessed against relevant European information systems in accordance with the ETIAS legal framework. Most applications are expected to be processed automatically within minutes, while a limited number may require manual assessment by the competent authorities.
Travellers who are required to hold a valid ETIAS travel authorisation and fail to do so may be refused boarding by the carrier, including airlines, ferry operators, or bus companies.
Further information regarding who requires ETIAS, how to apply, and how the system operates may be accessed through the official European Union ETIAS webpages.
At The Border
Upon arrival at the external border of a participating European country, travellers may be subject to border checks in accordance with applicable European Union and national legislation.
Where applicable, border authorities may electronically verify whether a traveller holds a valid ETIAS travel authorisation and whether all other entry conditions are fulfilled.
In Malta, border control functions are carried out under the responsibility of the Principal Immigration Officer, in accordance with the applicable legal framework.
Possession of a valid ETIAS travel authorisation does not automatically guarantee entry, as the final decision regarding admission into the territory remains subject to compliance with all applicable entry conditions under law.
Malta’s National ETIAS Framework
At national level, ETIAS responsibilities in Malta will be exercised in accordance with the applicable European Union and national legal framework.
The National ETIAS Unit, which processes applications in Malta, will be hosted within the Malta Police Force. The latter is designated as the national authority with central responsibility for ETIAS in Malta.
In addition, the Malta Police Force shall act as the Central Access Point for access to personal data stored in ETIAS for law enforcement purposes, in accordance with the conditions and safeguards established by law.
Other Maltese competent authorities may also be granted access to ETIAS where authorised by law and formally designated for specific purposes established under the applicable legal framework.
These may include, for example:
border control authorities;
immigration authorities;
law enforcement authorities; and
other designated competent authorities.
At present, the formal designation or recognition of all competent Maltese authorities having access to ETIAS is still subject to the applicable legal and institutional framework and may be updated at a later stage.
Refusal, Revocation Or Annulment Of An ETIAS Travel Authorisation
Where an ETIAS application is refused, or a travel authorisation is revoked or annulled, the applicant will receive a notification indicating:
the grounds for the decision;
the authority responsible for taking the decision; and
information regarding the available appeal procedure.
Applicants have the right to appeal decisions refusing, revoking, or annulling an ETIAS travel authorisation.
Appeals are handled in accordance with the national law of the European country that took the decision.
Where a travel authorisation is revoked at the request of the traveller, no right of appeal shall apply.
Further information regarding appeals and ETIAS procedures is available through the official European Union ETIAS webpages.
Data Protection And Your Rights
Personal data processed within ETIAS is protected in accordance with applicable European Union and national data protection legislation.
The processing of personal data within ETIAS is subject to strict safeguards, access controls, and legal limitations.
Controllers Of Personal Data
Personal data contained in ETIAS may be processed by the Malta Police Force, including the National ETIAS Unit, and by other competent Maltese authorities authorised by law to access ETIAS, strictly within the limits established by law.
Each competent authority accessing ETIAS acts independently and processes personal data only for the purposes for which it has lawful access.
Accordingly, each authority acts as controller only in relation to personal data processed by that authority within ETIAS.
The Malta Police Force, including the National ETIAS Unit hosted within it, does not automatically act as controller for all personal data processed within ETIAS by other competent Maltese authorities.
Likewise, competent Maltese authorities may only act upon requests concerning personal data where they have processed such data and act as controller in respect of the relevant processing activity.
Maltese authorities cannot grant access to, rectify, complete, erase, restrict, or otherwise act upon personal data processed within ETIAS where they have not processed such data and do not act as controller in relation to that processing.
Your Rights
Subject to the applicable legal framework and any lawful restrictions provided by law, individuals whose personal data is processed in ETIAS may exercise, where applicable, the following rights:
the right to information regarding the processing of personal data;
the right of access to personal data;
the right to request rectification of inaccurate personal data;
the right to request completion of incomplete personal data;
the right to request erasure of unlawfully processed personal data, where applicable;
the right to request restriction of processing, where applicable;
the right to an effective judicial remedy; and
the right to lodge a complaint with the competent supervisory authority.
How To Exercise Your Rights
Requests concerning personal data processed within ETIAS may be submitted:
to the Malta Police Force, including the National ETIAS Unit, where the Malta Police Force processed the relevant personal data and acts as controller; or
directly to the competent Maltese authority that processed the personal data and acts as controller in relation to the relevant processing activity.
Where a Maltese authority has not processed the relevant personal data and does not act as controller, that authority cannot act upon the request.
Where appropriate, applicants may be directed to the competent authority responsible for the relevant processing.
Timeframe For Responding To Requests
Competent authorities shall respond to ETIAS-related requests without undue delay and, in any event, within one month from receipt of the request, in accordance with the ETIAS legal framework.
Certain rights may be restricted in accordance with applicable law where necessary and proportionate to safeguard public security, border management, or the prevention, detection, investigation, or prosecution of criminal offences.
Complaints And Remedies
If you are not satisfied with how your request has been handled, you may lodge a complaint with the competent supervisory authority or seek an effective judicial remedy in accordance with applicable law.
Legal Framework
ETIAS in Malta is governed by applicable European Union and national legislation, including, but not limited to:
Regulation (EU) 2018/1240 establishing a European Travel Information and Authorisation System (ETIAS);
the Immigration Act;
applicable subsidiary legislation implementing European Union obligations;
legislation governing border management, immigration, law enforcement access, and data protection; and
any other applicable national or European Union legal instruments.
Systems: EURODAC
Introduction
EURODAC is a European Union (EU) information system established under Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024 on the establishment of ‘Eurodac’ for the comparison of biometric data, which repealed Regulation (EU) No 603/2013.
EURODAC enables participating States to compare biometric data and other relevant information in order to support the effective application of the European Union asylum and migration framework, including:
determining the Member State responsible for examining an application for international protection;
supporting the implementation of asylum and migration management procedures;
identifying illegally staying third-country nationals and stateless persons;
facilitating procedures related to resettlement, humanitarian admission and temporary protection;
supporting the protection of children and vulnerable persons; and
enabling, under strictly regulated circumstances, access by designated law enforcement authorities and the European Union Agency for Law Enforcement Cooperation (Europol) for the prevention, detection and investigation of terrorist offences and other serious criminal offences.
EURODAC operates through a Central System containing the database and a secure communication infrastructure connecting participating States through a dedicated encrypted network.
This notice explains how personal data is processed by the Malta Police Force (MPF), through its Eurodac Office, in connection with the EURODAC system and informs you of your rights under applicable data protection legislation.
Role of the Malta Police Force and Scope of Responsibility
In Malta, the authority designated to access and process data within the EURODAC system is the Eurodac Office within the Malta Police Force.
The Malta Police Force, through its Eurodac Office, is responsible solely for the processing of personal data relating to Malta’s operation and use of the EURODAC system, in accordance with Regulation (EU) 2024/1358 and applicable national legislation.
Important Clarification Regarding Asylum Applications
The Malta Police Force is not responsible for the processing of personal data carried out in the context of asylum or international protection procedures generally, except insofar as personal data is processed within the EURODAC system.
Accordingly, where a request concerns personal data processed in relation to an asylum or international protection application other than personal data processed in EURODAC, such requests should be addressed to the competent authority responsible for asylum matters in Malta, namely the International Protection Agency (IPA).
What is EURODAC?
EURODAC is a European database used by participating States to store and compare biometric data, namely fingerprints and facial image data, together with other information relating to specific categories of third-country nationals and stateless persons.
EURODAC supports the implementation of:
Regulation (EU) 2024/1351;
Regulation (EU) 2024/1350; and
Council Directive 2001/55/EC.
EURODAC may be used in relation to the following categories of persons, as provided under Regulation (EU) 2024/1358:
persons applying for international protection;
persons apprehended in connection with the irregular crossing of an external border;
persons found illegally staying in a Member State;
persons disembarked following search and rescue operations at sea;
persons arriving through resettlement or humanitarian admission procedures;
persons benefitting from temporary protection;
persons subject to return procedures, where provided by law.
Biometric data may be collected and processed in relation to persons aged six (6) years and over, in accordance with the applicable legal framework.
EURODAC is accessible by the 27 Member States of the European Union, together with Iceland, Norway, Liechtenstein and Switzerland.
Legal Basis
The processing of personal data within the EURODAC system is carried out in accordance with:
Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024 on the establishment of EURODAC;
Regulation (EU) 2024/1351;
Regulation (EU) 2024/1350;
Council Directive 2001/55/EC;
Regulation (EU) 2016/679 (General Data Protection Regulation), where applicable; and/or
Directive (EU) 2016/680 and applicable national legislation governing processing by competent authorities for law enforcement purposes.
Where personal data is processed for law enforcement access to EURODAC, processing is subject to the specific safeguards, limitations and conditions established by Regulation (EU) 2024/1358.
Categories of Personal Data Processed
Depending on the category of person concerned and the applicable legal framework, the following categories of personal data may be processed within EURODAC.
Biometric Data
fingerprints;
facial image data.
Identification and Administrative Data
Depending on the applicable category, EURODAC may process:
Member State of origin;
place and date of registration, application, apprehension or relevant event;
sex;
nationality, where applicable;
reference number used by the Member State;
date on which biometric data was taken;
date on which data was transmitted to the Central System;
operator user identification number;
information relating to international protection, return, relocation, resettlement, humanitarian admission or temporary protection status, where applicable under law.
The exact categories of data processed depend on the legal category applicable to the person concerned and the requirements of Regulation (EU) 2024/1358.
Purpose of Processing
Personal data processed within EURODAC may be used for the following purposes:
International Protection and Migration Purposes
To:
assist in determining the Member State responsible for examining an application for international protection;
support the implementation of asylum and migration procedures;
support migration management and responsibility allocation between Member States;
identify illegally staying third-country nationals and stateless persons;
support relocation, resettlement and humanitarian admission procedures;
support temporary protection mechanisms;
protect children and vulnerable persons, including facilitating tracing where permitted by law;
support return-related procedures where authorised by law.
Law Enforcement Purposes
Under strictly regulated circumstances, designated law enforcement authorities and Europol may request comparison of EURODAC data where this is necessary for the prevention, detection or investigation of terrorist offences or other serious criminal offences.
Such access is permitted only where all legal conditions are fulfilled, including strict safeguards, necessity and proportionality requirements, and prior verification procedures established by law.
Retention of Data
The retention period applicable to personal data depends on the category under which data is recorded in EURODAC and the requirements of Regulation (EU) 2024/1358.
Applicants for International Protection
Personal data relating to applicants for international protection shall be retained in EURODAC for ten (10) years from the date on which biometric data is taken.
Data shall be erased before expiry of this period where:
the person concerned acquires citizenship of a Member State; or
erasure is otherwise required by law.
Where international protection is granted, the relevant data may be marked in accordance with Regulation (EU) 2024/1358.
Persons Apprehended in Connection with the Irregular Crossing of an External Border
Personal data relating to persons apprehended in connection with the irregular crossing of an external border shall be retained for five (5) years.
Data may be erased before expiry where legally required, including where the person concerned acquires citizenship of a Member State.
Persons Found Illegally Staying in a Member State
Personal data relating to persons found illegally staying in a Member State shall be retained for three (3) years, in accordance with Regulation (EU) 2024/1358.
Persons Disembarked Following Search and Rescue Operations at Sea
Personal data relating to persons disembarked following rescue operations at sea shall be retained for five (5) years, unless erased earlier in accordance with law.
Persons Admitted Through Resettlement or Humanitarian Admission Procedures
Personal data relating to persons admitted through resettlement or humanitarian admission procedures shall be retained for ten (10) years, unless erased earlier in accordance with law.
Persons Benefitting from Temporary Protection
Personal data relating to persons benefitting from temporary protection shall be retained for the duration provided by the applicable legal framework governing temporary protection and EURODAC.
Your Rights
Subject to the applicable legal framework and any lawful restrictions provided by legislation, you have the right to:
request access to personal data relating to you processed within the EURODAC system;
request correction of inaccurate or incomplete personal data;
request deletion of unlawfully processed or unlawfully stored personal data;
request restriction of processing in circumstances provided by law;
request verification of the lawfulness of processing; and
lodge a complaint with the national supervisory authority.
Where necessary to verify your identity and locate your EURODAC data, you may be requested to physically attend the Eurodac Office for biometric verification purposes. Any biometric data taken solely for verification purposes shall not be retained unless otherwise authorised by law.
How to Exercise Your Rights
Requests relating to personal data processed by the Malta Police Force within the EURODAC system may be submitted to the Eurodac Office or to the Data Protection Officer of the Malta Police Force.
To facilitate the exercise of these rights and enable the efficient handling of requests, data subjects are encouraged to make use of the model letters available on the Malta Police Force website by clicking here.
Requests concerning asylum or international protection case files, other than personal data processed in the EURODAC system, should be addressed to the competent authority responsible for asylum matters in Malta, namely the International Protection Agency (IPA).
Contact Details
Eurodac Office
Malta Police Force General Headquarters
St. Calcedonius Square
Floriana FRN 1530
Malta
Email: eurodac.police@gov.mt
Data Protection Officer
Malta Police Force General Headquarters
St. Calcedonius Square
Floriana FRN 1530
Malta
Email: dpu.police@gov.mt
Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully or in breach of applicable data protection legislation, you may lodge a complaint with the national supervisory authority:
Information and Data Protection Commissioner (IDPC)
Email: idpc.info@idpc.org.mt
Telephone: +356 23287100
Website: https://idpc.org.mt/
Further Information
This notice relates solely to the processing of personal data by the Malta Police Force in connection with the EURODAC system.
For information concerning the processing of personal data in the context of an asylum or international protection application, other than EURODAC processing, please contact the International Protection Agency (IPA).
Systems: Hand-Held Speed Cameras (HSCs)
- It is the duty of the Police to preserve public order and peace, to prevent and to detect and investigate offences, to collect evidence, whether against or in favour of the person suspected of having committed the offence, and to bring the offenders, whether principals or accomplices, before the judicial authorities in terms of Article 346(1) of the Criminal Code (Chapter 9 of the Laws of Malta).
- Article 62(1) of the Police Act specifically empowers the Police to hold, process and classify any information relevant to the commission of any crime in or outside Malta which information may be preserved by any system whatsoever, including electronic format.
- Regulation 127 of the Motor Vehicles Regulations (S.L. 65.11 of the Laws of Malta) sets the speed limit for motor vehicles and provides for the use of HSCs.
- Moreover, the Malta Police Force, may collect personal data by technical surveillance or other automated means for the prevention, investigation, detection and prosecution of criminal offices in terms of Regulation 8(3) of S.L. 586.08.
- request access to personal data relating to them processed by HSCs;
- request the correction of factually inaccurate personal data relating to them or the;
- deletion of their personal data in the case of unlawfully processed information;
- request restriction of processing of their personal data according to law;
- the right to lodge a complaint with the Information and Data Protection Commissioner.
Systems: Passenger Name Record (PNR) / Advanced Passenger Information (API)
The PNR/API System is an integrated system that processes:
information provided by passengers and collected by airlines, in the normal course of their business, for enabling reservations and carrying out the check-in process, known as Passenger Name Record (PNR), and
Advanced Passenger Information (API) data, which is sent by air carriers upon departure, operating inbound Extra-Schengen flights to Malta.
The Passenger Information Unit (PIU) within the Malta Police Force, under the Organized Crime wing, is responsible for operating the PNR/API System. It is mainly responsible to:
Collect the API and PNR data from air carriers;
Carry out an assessment of passengers prior to their scheduled arrival in or departure from Malta, by comparing API and PNR data against relevant databases, such as the Schengen Information System (SIS) and the National Stop List (NSL), and process them against pre-determined criteria, in order to identify persons that may be involved in a terrorist offence or serious crime1, or that are hindered from entering the Schengen Area;
Inform and disseminate PNR and API data to the competent national authorities, Europol and PIUs of other Member States, as the case may be, either spontaneously or in response to duly reasoned requests.
The received data is compared against a watchlist implemented within the system with details of persons suspected of being involved in a terrorist offence or serious crime that has been provided by the competent authorities.
Risk based profiles have also been introduced, whereby upon matching with several selected criteria, passengers are automatically flagged.
Legal Basis
The processing of PNR data and API is conducted under an obligation imposed by different legislative instruments of the European Union. The relative two legal instruments are:
The Passenger Name Record (PNR) Data Act (Chapter 584 of the Laws of Malta), which implements Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime;
The Communication of Passenger Data by Air or Sea Carriers Order (Subsidiary Legislation 460.18), which implements Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data.
Personal Data Processed In The API System
API data is collected by air carriers operating a flight to Malta from a third country and is transmitted electronically to the PNR/API System by the time of the closure of check-in in terms of Regulation 3 of Subsidiary Legislation 480.18.
Such data consists of:
the number and type of travel document used;
nationality;
full names;
the date of birth;
the border crossing point of entry into the territory of Malta;
code of transport;
departure and arrival time of the transportation;
total number of passengers carried on that transport; initial point of embarkation.
Personal Data Processed In The PNR System
PNR data is more informative in comparison to API and is considered to be an investigative tool, whereas same is received from air carriers operating both Intra and Extra-Schengen and inbound and outbound flights. Same is automatically sent by air carriers upon two push methods:
24 hours prior departure
Upon departure
Such data consists of:
PNR record locator
Date of reservation/issue of ticket
Date(s) of intended travel
Name(s)
Address and contact information (telephone number, e-mail address)
All forms of payment information, including billing address
Complete travel itinerary for specific PNR
Frequent flyer information
Travel agency/travel agent
Travel status of passenger, including confirmations, check-in status, no-show or go-show information
Split/divided PNR information
General remarks (including all available information on unaccompanied minors under 18 years, such as name and gender of the minor, age, language(s) spoken, name and contact details of guardian on departure and relationship to the minor, name and contact details of guardian on arrival and relationship to the minor, departure and arrival agent)
Ticketing field information, including ticket number, date of ticket issuance and one-way tickets, automated ticket fare quote fields
Seat number and other seat information
Code share information
All baggage information
Number and other names of travellers on the PNR
Any Advance Passenger Information (API) data collected (including the type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time)
All historical changes to the PNR listed in numbers 1 to 18.
Disclosure Of API And PNR Data
API and PNR data may be requested by the following competent authorities for the prevention, investigation and prosecution of serious crimes:
Malta Police Force
Principal Immigration Officer
Malta Security Services
Financial Investigation and Analysis Unit
Customs Department
Judicial authorities
Europol
PIUs in other Member States
Competent authorities in Third countries
Retention Period
In terms of Article 13 of the Passenger Name Record (PNR) Data Act, all data in the PNR/API System are kept for period of five years. However, after six months from collection, all data are depersonalised by masking, and disclosure of such data to the competent authorities takes place only upon the approval of a judicial authority or of the Information and Data Protection Commissioner.
What Are Your Rights In Relation To Your Personal Data Processed In The PNR/API System?
Personal data processed within the context of the PNR and API framework is regulated by the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations (Subsidiary Legislation 586.08) and the GDPR2 when the processing is conducted for other purposes.
Any person has the right to:
request access to personal data relating to them stored in the PNR/API System;
request the correction of factually inaccurate personal data relating to them or the deletion of their personal data in the case of unlawfully stored information;
request restriction of processing of their personal data according to law;
the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) or to request verification of lawfulness of the processing.
In order to facilitate the exercise of your rights and to be able to handle request more efficiently, you are solicited to use the following model letters.
1 The categories of serious crimes in relation of which PNR data may be disclosed is listed under Schedule C to CAP.584, where such crimes are punished by a custodial sentence or a detention order for a maximum period of at least three years.
2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Systems: Schengen Information System (SIS)
- Regulation (EU) 2018/1860 of the European Parliament and of the Council of 28 November 2018 on the use of the Schengen Information System for the return of illegally staying third-country nationals
- Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006
- Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU
- Identification data: Data required to identify the person sought and other information relevant for the end user carrying out a search. The alert may also include data on misused identity victims (where applicable).
- Identification documents: Data describing the identification document of the person who is the subject of the alert – a copy of the document can be attached.
- Alert reason: A ‘reason for the alert’, describing, in a structured way, why the person is sought.
- Required action: An ‘action to be taken’, describing, in a structured way, what the officer must do when the person is found.
- Case information: Information about the case e.g., authority authorising the entry of the alert, the case reference number etc. The copy of the European Arrest Warrant (EAW) of a person wanted for arrest is also attached to alerts for arrest for surrender.
- Information on objects related to persons: Data on objects entered in SIS to locate a person who is the subject of an alert, for example the vehicle used by the person sought.
- Photographs: Photographs of the person who is the subject of the alert.
- Fingerprints and palm prints: Dactyloscopic data (fingerprints and/or palm prints) for the person who is the subject of the alert.
- Fingermarks and palmmarks: Dactyloscopic data (fingermarks and/or palmmarks) discovered at crime scenes.
- DNA profile: DNA profile of the person who is the subject of the alert or family members (only in case of missing persons who need to be placed under protection).
List Of Alerts And The Respective Periodic Review Period:
| Regulation (EU) 2018/1860 | ||
| Type of Alert | Article No. | Review Period |
| Alerts in respect of third-country nationals subject to return decisions issued by the Schengen countries (Return decisions). | Article 3 | 3 Years |
| Regulation (EU) 2018/1861 | ||
| Type of Alert | Article No. | Review Period |
| Alerts on third-country nationals who may not enter or stay in the Schengen Area (Refusal of entry or stay). | Articles 24, 25 and 26 | 3 Years |
| Regulation (EU) 2018/1862 | ||
| Type of Alert | Article No. | Review Period |
| Alerts on persons who are subject to a European Arrest Warrant or other warrant for surrender (Norway and Iceland)/Extradition Request (Switzerland and Liechtenstein) (Persons wanted for arrest). | Article 26 | 5 Years |
| Alerts to find missing persons, including children, and to place them under protection if lawful and necessary (Missing persons). | Points (a) and (b) of Article 32(1) | 5 Years |
| Alerts to find out the place of residence or domicile of persons sought to assist with criminal judicial procedures (for example witnesses, persons summoned to appear in Court or who are to be served with a criminal judgment or serve a penalty involving deprivation of liberty) (Persons sought to assist with a judicial procedure). | Articles 34 | 3 Years |
| Alerts for the identification of unknown persons wanted in relation to terrorist offences or other serious crimes under investigation (Unknown wanted persons). | Article 40 | 3 Years |
| Alerts to prevent children at risk from being abducted or going missing (Children at risk of being abducted by parents, relatives, or guardians). | Points (c) of Article 32(1) | 1 Year |
| Alerts for the protection of vulnerable people (adults or children) from being taken unlawfully abroad or to prevent them from travelling without the necessary authorisations (Vulnerable persons whose travel must be prevented). | Points (d) and (e) of Article 32(1) | 1 Year |
| Alerts to obtain information on persons or related objects for the purposes of prosecuting criminal offences and for the prevention of threats to public or national security (Persons and objects for discreet, inquiry or specific checks). | Article 36 | 1 Year |
| Alerts on objects (for example vehicles, travel documents, number plates and industrial equipment) being sought for seizure or use as evidence in criminal proceedings, and Alerts on travel documents for preventing the holders of such documents from travelling (Objects for seizure or use as evidence in criminal procedures). | Articles 36 and 38 | 10 Years |
| Articles 26, 32, 34, and 36 (If linked to an alert on a person) | The same review period of the linked alert on the person | |
What Are Your Rights In Relation To Your Personal Data Processed In The SIS?
- request access to personal data relating to them entered in the SIS;
- request the correction of factually inaccurate personal data relating to them or the deletion of their personal data in the case of unlawfully stored information;
- the right to lodge a complaint with the Information and Data Protection; Commissioner (IDPC) or to request verification of lawfulness of the processing.
This Policy describes and provides the required information regarding the handling of personal data by the Office of the Arbiter for Financial Services (“OAFS”, “we”) and your rights in terms of the applicable Law. This Policy is to be read in the light of the applicable provisions of the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and especially Articles 13, 14 and 21.
1. Scope
Whether the Data Subject (“you”) are a complainant, a representative of an applicant, or just want to find out more about the complaint procedure managed by the OAFS, we would like to provide you with an overview of the personal data we collect from you as a financial services redress mechanism and what we use this data for. In addition, we would like to inform you about the entitlements and rights you have under the applicable data protection law.
2. Definitions
For the purposes of this Policy, the definitions contained in Regulation (EU) 2016/679 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (“GDPR”)1 will apply in like manner, mutatis mutandis.
3. Law
This Policy and any resulting effects are governed by the Laws of Malta and the Courts of Law in Malta have non-exclusive jurisdiction.
Who is responsible for personal data processing?
You may reach the Data Protection Officer (DPO) for the OAFS on the following addresses:
The DPO, Office of the Arbiter for Financial ServicesN/S in Regional Road,Msida MSD1920 MALTA Email: dpo.oafs@financialarbiter.org.mtWhat personal data does the OAFS process when you contact us?
We record details about your contact with us manually or on an excel worksheet which is saved on servers hosted by MITA, the Malta Government Agency which provides IT infrastructure to all government agencies.
We will use your personal information to provide you with any information or services that you ask for, or to reply to any correspondence exchanged with us. If you have asked us to intervene on a minor case with a financial services provider against whom you have a dispute, we will share such personal information, as is necessary, with such entity solely for the purpose of helping you with your query. Where so required, we will also use personal information to analyse:
- information,
- what type of questions are being directed to the OAFS, and,
- whether the service we provide is effective in delivering useful information, guidance or otherwise.
In other cases, we will endeavour to minimise the use of personal data, as may be applicable and required.
Contacting us by phone
Calls to our office lines may be recorded for quality, evaluation, security and training purposes. When you contact us, we ask for the necessary personal information, as may be applicable, depending on the nature of the call. You are under no obligation to provide this information to us, but it enables us to provide a better quality of service when you contact us again. As a minimum, we will hold your name and phone number for the purposes specified above unless you inform us that you wish to remain anonymous.
Monitoring of emails
Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with security policy. Email monitoring or blocking software may also be used. The site and domain are hosted and managed by MITA, on behalf of the OAFS. MITA has its Head Office registered at:
Data Protection OfficeMalta Information & Technology AgencyGattard House, National Road, Blata l-Bajda HMR 9010. Malta.Telephone (+356) 2599 2410Email: dp.mita@gov.mt
Please be aware that you have a responsibility to ensure that any emails you send to us are within the bounds of the Law. As a public agency, we are required to produce statistical information about our work. In this regard, we publish annual anonymised aggregated data of the number of enquiries (phone calls and emails) and complaints that we receive and process, including the subject matter of such enquiries. We never publish statistical information which could in any way identify consumers. As for enquiries, once such annual statistical tables are produced, personal details, categorisation of the enquiry and any notes taken describing the enquiry will be destroyed. Regarding the statistical information relating to complaints, our retention policy outlined below applies.
CCTV (Closed Circuit Television)
The OAFS operates a video-surveillance system to deter, prevent, manage and investigate safety and security incidents as well as for the protection of persons, property and documents against damage, theft, intrusion, assault or any other threat. The video-surveillance system complements other typical security and access control purposes by monitoring specific areas and events. It forms part of the measures to support broader OAFS security policies. The system is not used for any purpose other than those mentioned above. For instance, it is not used to monitor the workstations of personnel or attendance. Neither is the system used as an investigative tool for purposes other than those instances described above, or in disciplinary procedures unless a physical security incident or criminal behaviour is involved. CCTV footage is recorded on a hard-drive and kept on a rolling 30 days. Footage beyond 30 days is automatically deleted.
In the case of a Complaint, what personal data does the OAFS process and where does this data come from?
The OAFS processes personal data obtained from the Complaint Forms submitted to it by the Complainant/s and/or their respective representative. In addition, the OAFS processes personal data that is received from the Respondent party/parties, that is, the financial services provider against which the Complaint is lodged. As part of the procedures, the following personal data is usually processed by us, as follows:
- First and last name/s of consumer/s submitting a complaint
- (Correspondence) Address
- Phone number/s
- E-mail address
- Skype ID
- Date and time of the Complaint Registration
- First and last name/s of the person assisting or representing the consumer/s, if applicable
- (Correspondence) Address data of the person assisting or representing the consumer/s, if applicable
- Phone number/s of the person assisting or representing the consumer/s, if applicable
- E-mail address of person assisting or representing the consumer/s, if applicable
- Details of any person/s who originally sold the product or service to the consumer/s
In addition to the above-mentioned items of personal data, there are other data items that would be required in connection with the Complaint submitted to the OAFS and the subsequent procedures relating to the mediation and/or investigation. Such data and information may relate to any contractual agreement/s you may have entered or signed up to, substantiating documentation directly or indirectly related to such contractual agreement/s, products or services you may have purchased or otherwise subscribed to, on a one-off or a continued-delivery basis. In this regard, we may also require the production, from you and/or other parties, correspondence (including voice/video recordings and other media files) that may have passed between you, your representative and/or the Respondent or other relevant third parties.
In the case of a Complaint, what is the personal data processed for (purpose of processing) and on what legal basis does this processing take place?
Your personal data will be processed in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Data Protection Act in Malta (Act 20 of 2018, Chapter 586 of the Laws of Malta). The processing of your personal data takes place exclusively to answer queries and properly conduct the necessary work in connection with the Complaint you would have submitted to us, with regard to the applicable complaint procedure/s and in accordance with the rules of procedure relevant and as contained in the applicable Laws.
The substantive legal basis for the processing of your personal data is the Arbiter of the Financial Services Act (Chapter 555 of the Laws of Malta), which attributes the necessary functions, powers and rights to this Office and, in particular, Article 21 (Competence of Arbiter), Article 22 (Procedure relating to complaints), Article 24 (Mediation), Article 25 (Investigation), Article 26 (Adjudication) and Article 27 (Appeal and enforceability).
In line with GDPR Article 6 (1)(f), processing shall be lawful, only if and to the extent that, it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, especially where the processing is carried out by public authorities in the performance of their tasks. This, together with the consent provided by the data subject to the processing of his or her personal data for one or more specific purposes, as per GDPR Art. 6(1)(a) for the 7 March 2019 Page 5 of 10 essential legal basis for the data processing activity carried out by the OAFS, in the execution of its mandate.
Furthermore, it is pointed out that in line with L.N. 177 of 2018, Restriction of the Data Protection (Obligations and Rights) Regulations, 2018, and in particular Regulation 4(e), the scope of the obligations and rights provided for in GDPR Articles 12 to 22, 34, as well as Article 5 (as applicable), any restriction to the rights of a data subject shall only apply where such restrictions are a necessary measure for the establishment, exercise or defence of a legal claim and for legal proceedings which may be instituted under any law.
Who has access to your personal data?
Your personal data will only be made accessible and transmitted to the parties directly involved in the complaint procedure or which may have a duty or legitimate interest at law to have access to such data and information. The following will have access to some or all of the personal data pertinent to the said procedures, as follows and at different stages, as may be applicable:
- the personnel acting and serving the OAFS
- any authorised or specifically engaged party acting for or otherwise assisting the OAFS in the course of proceedings
- the person who will assist or represent you in the course of the proceedings or that you may have authorized
- the respondent and its authorised agents, dependents and (legal) representative/s.
If your case is appealed, the case file is passed on to the Courts of Appeal (Inferior Jurisdiction) in its entirety.
After the decision of the Arbiter becomes res judicata (binding on all parties and cannot be pursued any further), if in the Arbiter’s opinion there is substantial evidence of any significant breach of duty or misconduct on the part of a financial services provider, or any criminal conduct of any of the parties, the Arbiter shall refer the matter to the competent authorities to take any further appropriate action, if any, according to law.
Furthermore, it is to be noted that it is not excluded that certain duly contracted service providers (data processors within the meaning of GDPR Art. 28) may also have short-term access to your personal data. Such data processors are, in particular, persons responsible for the continued care and maintenance of the implementation of the I.T. infrastructure and security applications at the OAFS, together with service providers in the telecommunications industry (in providing the necessary electronic communication channels), printing and computer hardware services and general logistics. It is to be noted that all relevant providers (processors) will be engaged by virtue of a written contractual agreement that is to cater to the duties and responsibilities around the GDPR.
It is not usual practice for the OAFS to allow its service providers (data processors) to subcontract to third parties. Should this be the case, the appropriate (contractual) measures will be taken to ensure that the sub-processor will assume the responsibilities bestowed by us on the processor, as may be so applicable.
All the above-mentioned parties are to be regulated or otherwise made subject to the applicable provisions of the GDPR and the Data Protection Act in Malta (Act 20 of 2018 of 28 May 2018).
For how long will your data be stored?
In line with L.N. 177 of 2018, Restriction of the Data Protection (Obligations and Rights) Regulations, 2018, and in particular Regulation 5(3), it is pointed out that the retention period to be applied for personal data that is processed pursuant to these regulations, shall not be longer than what is necessary for the purpose of the processing of such personal data or shall not be longer than the period required to achieve the aim of the restriction, or as provided by law.
Except for decisions of the Arbiter (see below), physical and electronic (i.e. scanned) case files will be kept by the OAFS for five (5) years from the date when the decision becomes binding on all parties to the complaint.
Once the applicable retention period expires, physical and electronic copies of case records (that is, scanned copies of the physical file) will be destroyed, except for names of the parties and details of the complaint which will be retained to facilitate searches of decisions.
Physical and electronic versions of the Arbiter’s decisions as relayed to the parties to the complaint will be retained by us permanently.
Decisions issued by the Arbiter for Financial Services are published on the Office’s website and will remain available for a minimum of ten (10) years from the date of the Arbiter’s decision. The published version will replace complainants’ names with different initials to make them unidentifiable.
We are also obliged to publish a summary of cases decided by the Arbiter in our Annual Report. Here, too, we will replace complainants’ names with different initials to preserve anonymity.
Are data transmitted to a third country or to an international organisation?
There are no transfers of personal data to countries outside the European Union (EU) / European Economic Area (EEA) or to an international organisation.
As part of the remote maintenance of software and standard I.T. components, especially in the context of certain troubleshooting in individual cases stations or terminals, MITA may make use of an I.T. service provider from a third country outside the EU/EEA (e.g. the USA). Details sourced from MITA will be provided to you separately, as and if required by law.
What data subject rights do you have?
In terms of GDPR, consent is not regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Thus, the Data Subject has the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the Data Subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
According to GDPR Art. 15, you have the Right of Access to obtain from the Data Controller confirmation as to whether or not your personal data is being processed, and, where that is the case, access to the personal data and the following information:
- the purposes of the processing
- the categories of personal data concerned
- the recipients or categories of recipient to whom the personal data have been or will be disclosed
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
- the right to lodge a complaint with a supervisory authority
- where the personal data are not collected from the data subject, any available information as to their source
- the existence of automated decision-making, including profiling.
In addition, you may, under GDPR Article 16, obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data about you.
The law also allows for the exercise of other rights, as follows:
Article 17. Right to erasure (‘right to be forgotten’). The data subject shall have the right to obtain from the Data Controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay, depending on the conditions applicable at Law.
Article 18. Right to restriction of processing. This applies in one or more of the following cases:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
- the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims
- the data subject has formally objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
Article 20. Right to data portability. The right of the data subject to receive his/her personal data (which s/he has provided to a Data Controller) in a structured, commonly used and machine-readable format, and ancillary right to transmit such data to another Data Controller without hindrance.
Please do bear in mind that Data Protection is a civil law right and is not an absolute right law, that is, there are other laws and circumstances which – by their nature – take preference and prevalence over personal data protection, as further detailed in the GDPR and in the relevant body of Laws in Malta (e.g. laws regulated public safety and security, criminal law).
Thus, the Data Subject’s rights referred to above are not absolute and there could be situations where the right may either not be exercised or may only be partially entertained by the Data Controller/Processor.
Furthermore, in order to allow the OAFS to adequately conduct its functions at Law, the necessary personal data would need to be processed. Without the right information, the fair and good delivery of service would be prejudiced. In the event of an objection to processing your personal data, we will no longer process your personal data, unless it is established that there are compelling legitimate grounds for processing such data, which grounds do outweigh your interests, rights and freedoms, and may be justified as being pursued for the common good.
The above is further substantiated by L.N. 177 of 2018, Restriction of the Data Protection (Obligations and Rights) Regulations, 2018, and in particular Regulation 4(e), where the scope of the obligations and rights provided for in GDPR Articles 12 to 22, 34, as well as Article 5 (as applicable) may be restricted for the establishment, exercise or defense of a legal claim and for legal proceedings which may be instituted under any law. Thus, where any restriction provided for under these regulations applies, the OAFS shall inform the data subject, provided such a disclosure will not be prejudicial to the purposes of the restriction applied pursuant to these regulations.
Data Subject Request (DSR). You may exercise the above-mentioned rights by submitting your request, in writing, including the following items:
- Name and Surname
- Contact Details
- Proof of identification
- Indication whether you have a Complaint lodged with OAFS (and whether such Complaint is pending review)
- Indication whether you are engaged or known to the OAFS, otherwise than as Complainant
- Indication of the GDPR right being exercised
The request is to be sent (manually or electronically) to the attention of the DPO as follows:
The DPO, Office of the Arbiter for Financial ServicesN/S in Regional Road, Msida MSD1920 MALTAEmail: dpo.oafs@financialarbiter.org.mt
What are the data subject’s rights of redress and remedy?
Without prejudice to any other administrative or judicial remedy, GDPR Art. 77 allows every data subject the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy.
The Data Protection Supervisory Authority responsible for the OAFS is:
Information and Data Protection CommissionerFloor 2, Airways House, High Street, Sliema, SLM 1549. MALTA.Telephone: (+356) 2328 7100
Email: idpc.info@gov.mt
In line with GDPR Art. 78 and 79, without prejudice to any other administrative or non-judicial remedy:
- each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them
- each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed, as a result of the processing of his or her personal data in non-compliance with this Regulation.
The Data Subject has the right to mandate a not-for-profit body, organisation or association which has been properly constituted at Law has statutory objectives which are in the public interest, and are active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in this part on his/her behalf, and to exercise the right to receive compensation were provided for by Member State law.
Is there an obligation for you to provide your data?
You only need to provide us with personal data and information required for the adequate completion of your Complaint, or for the processing of your request and the execution of the relevant procedure.
Please be advised that if you withhold or otherwise object to the OAFS processing personal data necessary and required in the consideration of the relevant Complaint or procedures, and in line with the functions and powers of the OAFS, then the OAFS would not be in a position to adequately review and/or decide on your Complaint. In such a case, the Complaint will be rejected or otherwise abandoned/discontinued.
To what extent is there automated decision-making in individual cases?
Automated decision-making within the meaning of GDPR Art. 22, that is, decisions that rely solely on automated processing, including profiling, cannot and are not found in setups such as the OAFS; it is not the remit of the OAFS to perform such automated processing.
Updating of this Policy
We reserve the right to update this Data Protection Policy at any time. The updated Data Protection Policy will be published on our website.
Stay up to date
Join our subscribers list to get the latest news.