Know Your Data Protection Rights

What are your rights in relation to your personal data processed by the Malta Police Force?

Personal data processed by the Malta Police Force is regulated by the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations (Subsidiary Legislation 586.08) and the GDPR¹ when the processing is conducted for other purposes. However, there are instances when such processing is regulated by specific legislative instruments of the European Union.

In any case, any person has the right to:

     request access to personal data relating to him/her being processed by the Malta Police Force
     request the correction of factually inaccurate personal data relating to him/her or the deletion of his/her personal data in the case of unlawfully stored information
     the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) or to request verification of lawfulness of the processing

How to exercise your rights?

In Malta, any individual has the right to request access, correction or deletion of his/her personal data by contacting directly the data controller which in this case is the Commissioner or Police, via the Data Protection Officer, or indirectly via the Office of the IDPC as explained below.

Such rights may be exercised directly by submitting a formal request to the Data Protection Officer, on any of the following:

Address: The Data Protection Officer
Legal & Data Protection Unit,
Police Headquarters,
Floriana,
Malta.

Email: dpu.police@gov.mt

Requests submitted by electronic means will be replied through the same means. Due to potential risks of submitting copies of personal documents and other sensitive information via open internet, it is advisable that the security of such electronic means is ensured before submitting the request.

Applicants should provide the following identification details in order to facilitate the responsible authority in dealing with the request:

     Name and surname of applicant
     ID Card or Passport Number
     What particular information he/she would like to see

A copy of the ID Card or Passport is also to be submitted for identification verification purposes.

In accordance with Maltese law, the request must be submitted in writing and signed by the data subject. The request must be made in Maltese or English.

In order to facilitate the exercise of your rights, the Malta Police Force has prepared model letters with different types of requests. On the left side of this page you may find a generic letter. It is imperative that when using this letter one indicates clearly the type of personal data which he is requesting to access, rectify or delete. Moreover, more specific model letters have been prepared where the request relates to personal data processed in particular information systems and databases such as the Schengen Information System (SIS) and the PNR/API System.

These model letters can also be found on the left side of the page relative to each information system and database.

Are there any limitations to your right?

The right of the data subject may be delayed, restricted or omitted, for as long as this constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned in terms of the law.

Such measures may be imposed in order to:

a) Avoid obstructing official or legal inquiries, investigations or procedures
b) Avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
c) Protect public security
d) Protect national security
e) Protect the rights and freedoms of others.

In the eventuality of a restriction or refusal, the individual is informed in writing of the decision, including reasons for the decision, unless such communication would have a bearing on the work of competent authorities or on the rights and freedoms of other individuals. 

Right to lodge a complaint

Any person not satisfied with a reply to his request as outlined above may file a complaint with the office of the IDPC or request that the IDPC verifies that his/her data protection rights are being respected and that his/her personal data are processed according to law.

The Information and Data Protection Commissioner

The Information and Data Protection Commissioner (IDPC) is the national supervisory authority in Malta responsible to conduct independent supervision, monitoring and enforcement of data protection legislation.

To that end, the IDPC is empowered to have access and inspect all the personal data and filing systems in Malta.

The Office of the IDPC may be reached on the following contact details:

Address: Information and Data Protection Commissioner
Floor 2, Airways House
High Street
Sliema, SLM 1549
Malta.

Email:  idpc.info@idpc.org.mt

Website: https://idpc.org.mt/

Telephone: +356 2328 7100

¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)