Notification obligation
In terms of article 29 of the Data Protection Act a data controller, any person or organisation processing personal data, shall prior to carrying out any wholly or partially automated processing operations, notify the Data Protection Commissioner with such processing.
As for manual processing operations of personal data which have commenced prior 15 July 2003, a transition period up till 24 October 2007 has been established allowing data controllers to notify their processing operations.
Exemption from the notification obligation
For companies, where the only personal data processed is that contained in the Memorandum and Articles of Association as filed with the Registrar of Companies, no notification of processing operations is required.
However when this status is changed, such companies are required to notify.
Annual notification fee
The law establishes an annual notification fee of € 23.29 (Lm10) which is due by data controllers who are obliged to notify their processing operations to the Data Protection Commissioner.
Exemptions from the notification fee
L.N.154 of 2003 as amended by L.N.162 of 2004 provides for an exemption from the notification fee for the following:
- any person carrying out an economic activity including any trade, business or profession, as a self-employed with no employees;
- any of the following organisations which are exempt from the payment of tax under article 12(1) of the Income Tax Act:
- philanthropic institutions and any other similar organisations to which paragraph (e) of the said article applies;
- band clubs;
- sports clubs and other similar institutions which qualify under paragraph (o) of the said article;
- registered trade unions;
- political parties and clubs adhering to political parties.
Such exemptions apply without prejudice to the notification requirements as set out in the regulations.
Personal Data Representative (PDR)
Under section 30(1) of the Data Protection Act, Data Controllers may elect to appoint a Personal Data Representative and in such case have to notify the Commissioner for Data Protection. The function of the PDR is to independently ensure that the controller processes personal data in a lawful and correct manner and in accordance with good practice.
It is the intention of the Data Protection Commissioner to recommend the publication of regulations to establish the qualifications regulating Personal Data Representatives. Personal Data Representatives appointed before the publication of the said regulations will have to meet the qualifications eventually incorporated in the regulation.
Submitting the notification form
The obligation to complete and submit the notification form is a one time requirement, however the notification fee is due by data controllers on an annual basis. Any amendments to the original form are to be notified to the Data Protection Commissioner accordingly.
To view the document you need Adobe Acrobat Reader®
(if you don't have it please click hereto download and install Acrobat Reader. )
|