Recent Amendments to the Maltese Special Rules of Processing of Personal Data by Public Authorities in Relation to Criminal Offences

The Maltese subsidiary legislation regulating the Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties (S.L. 586.08), implementing EU Directive 2016/680, came into force on the same day as and in parallel with the EU General Data Protection Regulation (GDPR).

The said S.L. 586.08 has recently been amended by virtue of the similarly named Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) (Amendment) Regulations, 2020 (Legal Notice 108 of 2020).

Other than a few cosmetic amendments (mainly renumbering of certain regulations), the main purpose of Legal Notice 108 of 2020 is to clarify certain issues concerning communications of personal data by the competent authorities (primarily the Police) to government departments, public bodies and other entities established by law, and to private parties, as regulated by Article 38 of S.L. 586.08

One specific amendment further adds that such communication may take place during individual cases for the establishment, exercise or defence of legal claims as may result from or otherwise relate to a criminal offence.

The other main amendment ensures that any such personal data which the competent authorities may communicate to private parties shall be limited only to what is strictly necessary to identify the relevant persons in respect of whom there are serious grounds for believing that they have committed or are about to commit a criminal offence.