New Law enables Third Parties to a Contract to benefit from Data Protection Rights

A recently published Legal Notice (204 of 2023) has created the “Enforcement of the Rights of Data Subjects in relation to Transfers of Personal Data to a Third Country or an International Organisation Regulations” (Subsidiary Legislation 586.12). This marks the first time that an entirely new subsidiary law has been enacted under the auspices of the Data Protection Act (Chapter 586 of the laws of Malta), since June 2018, shortly after the coming into force of the GDPR.

S.L. 586.12 resolves a long-standing lacuna in the field of Maltese data protection law. The scope and purpose of this new law is to establish rights for third party beneficiaries with respect to transfers of personal data to a third country or an international organisation. S.L. 586.12 now provides a clear mechanism in Malta for data subjects to enforce their rights (including those granted under the GDPR) when their personal data are transferred to a third country, even though they would not be parties to the instrument (either the Standard Contractual Clauses or any other appropriate safeguard), by virtue of which the third country transfer is being made.

As a general principle of Maltese law, a contract is to be considered inter partes and not normally deemed to have the power to confer rights to third parties, rendering S.L. 586.12 an exception to the rule, albeit, a necessary one.