The Data Act

Under the Data Act, data holders may refuse, suspend, or withhold the sharing of data in specific circumstances, as outlined in Articles 4 and 5 of the Regulation.

Refusal of Data Sharing

A data holder may refuse a request for access to specific data, on a case-by-case basis, where:

• The processing of such data would undermine the security requirements of a connected product, resulting in a serious adverse effect on the health, safety, or security of natural persons (Article 4(2)).

• The data holder is a trade secret holder and can demonstrate that it is highly likely to suffer serious economic damage from the disclosure of trade secrets, despite the technical and organisational measures taken by the user (Article 4(8)) or by a third party (Article 5(11)).

Suspension or Withholding of Data Sharing

Trade secrets shall be preserved and shall be disclosed only where the data holder and the user take all necessary measures prior to the disclosure to preserve their confidentiality in particular regarding third parties.

The data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata, and shall agree with the user, proportionate technical and organisational measures necessary to preserve the confidentiality of the shared data, in particular in relation to third parties, such as model contractual terms, confidentiality agreements, strict access protocols, technical standards and the application of codes of conduct.

A data holder may suspend or withhold, the sharing of data identified as trade secrets where:

• there is no agreement on the necessary measures as referred to in Regulation, or if the user fails to implement the measures agreed or undermines the confidentiality of the trade secrets.

• there is no agreement on the necessary measures as referred to in Regulation, or if the third party fails to implement the measures agreed or undermines the confidentiality of the trade secrets.

As per Regulation, the data holder shall notify the Competent Authority when refusing, suspending or withholding of data sharing. The data holder shall inform the MDIA, where applicable, using the official notification form: https://forms.office.com/e/UEZw5j4ESm

Under Article 10 of the Data Act, individuals, data holders, and data recipients shall have access to a certified Dispute Settlement Body, to settle disputes pursuant to Article 4(3) and (9) and Article 5(12) as well as disputes relating to the fair, reasonable and non-discriminatory terms and conditions for, and transparent manner of, making data available.

The MDIA shall, at the request of the Dispute Settlement Bodies established in Malta, certify that body, where it has demonstrated that it meets all of the following conditions:

a) it is impartial and independent, and it is to issue its decisions in accordance with clear, non-discriminatory and fair rules of procedure;

b) it has the necessary expertise, in particular in relation to fair, reasonable and non-discriminatory terms and conditions, including compensation, and on making data available in a transparent manner, allowing the body to effectively determine those terms and conditions;

Click on the following link to certify a Dispute Settlement Body.

Where a public sector body, the Commission, the European Central Bank or a Union body demonstrates an exceptional need, as set out in the Data Act Regulation, to use certain data, including the relevant metadata necessary to interpret and use those data, to carry out its statutory duties in the public interest, data holders that are legal persons, other than public sectors bodies, which hold those data shall make them available upon a duly reasoned request.

Exceptional need to use data

An exceptional need arises when a public sector body, the European Commission, the European Central Bank, or a Union body shall be limited in time and scope and shall be considered to exist only in any of the following circumstances:

a) Where the data requested is necessary to respond to a public emergency and the public sector body, the Commission, the European Central Bank or the Union body is unable to obtain such data by alternative means in a timely and effective manner under equivalent conditions.

b) In circumstances not covered by point (a) and only insofar as non-personal data is concerned, where:

1. • a public sector body, the Commission, the European Central Bank or a Union body is acting on the basis of Union or national law and has identified specific data, the lack of which prevents it from fulfilling a specific task carried out in the public interest, that has been explicitly provided for by law, such as the production of official statistics or the mitigation of or recovery from a public emergency; and
   • the public sector body, the Commission, the European Central Bank or the Union body has exhausted all other means at its disposal to obtain such data, including purchase of non-personal data on the market by offering market rates, or by relying on existing obligations to make data available or the adoption of new legislative measures which could guarantee the timely availability of the data.

Point (b), shall not apply to microenterprises and small enterprises.

Requests for data to be made available shall be in line with Article 17 of the Data Act Regulation.

When shall the MDIA be notified?

Where the request is made by a public sector body established in Malta, it shall be transmitted to the MDIA as the data coordinator in Malta, who shall make the request publicly available online without undue delay unless the data coordinator considers that such publication would create a risk for public security.

Where a public sector body intends to request data from a data holder established in another Member State, it shall first notify the competent authority designated pursuant to Article 37 in that Member State of that intention. This requirement shall also apply to requests by the Commission, the European Central Bank and Union bodies. The request shall be examined by the competent authority of the Member State where the data holder is established.

To notify the MDIA, kindly complete and submit the notification form detailing a clear justification of the exceptional need through the following link: https://forms.office.com/e/UEZw5j4ESm and provide any supporting documentation to [email protected].

What Is Expected from Data Holders?

A data holder receiving a request to make data available under Chapter V of the Data Act Regulation, shall make the data available without undue delay, taking into account necessary technical, organisational and legal measures.

Where the public sector body, the Commission, the European Central Bank or the Union body wishes to challenge a data holder’s refusal to provide the data requested, or where the data holder wishes to challenge the request and the matter cannot be resolved by an appropriate modification of the request, the matter shall be referred to the MDIA as the competent authority designated pursuant to Article 37, when the data holder is established in Malta.