Malta Data Protection & Privacy Regulation

Algorithmic, Biometric & Surveillance Governance

As Malta's designated Market Surveillance Authority for high-risk AI systems under the EU AI Act, the IDPC drew attention this cycle to revised EU AI Act implementation timelines following Council approval on 27 July 2026. The IDPC also participated in an AI Act conference hosted at the Malta Digital Innovation Authority on 6 August 2026, indicating sustained institutional engagement with AI Act implementation rather than a single passive announcement of a timeline change. Both developments are non-binding in themselves, reflecting active regulatory engagement rather than a new binding rule, but they mark this module as escalating in this cycle's trajectory assessment.

This module sits alongside the IDPC's core GDPR mandate rather than replacing it: the same authority now carries both a data-protection supervisory role and an AI Act market-surveillance role for the specified high-risk use cases of law enforcement, migration and border control, and justice and democracy. No MT-specific AI Act enforcement action was identified this cycle.

Outlook

The practical operationalisation of the revised EU AI Act implementation timeline, and any further IDPC engagement following the 6 August 2026 conference, are the key items to watch for this module next cycle.

Enforcement & Redress

Malta's data protection enforcement framework rests on GDPR Article 83 and Data Protection Act Article 21, under which the Information and Data Protection Commissioner may impose administrative fines up to the higher of twenty million euro or four percent of an undertaking's global annual turnover for the most serious infringements. Where the infringing party is a public authority, the fine ceiling drops to twenty-five thousand euro per violation plus twenty-five euro per day of continuing violation, rising to fifty thousand euro plus fifty euro per day for infringements of the categories set out in Article 83(4).

This existing ceiling structure is now operating within a newly harmonised calculation framework. The European Data Protection Board adopted, at its plenary on 22 September 2026, a harmonised methodology for calculating administrative fines, together with the final version of its guidelines on the interplay between the Digital Services Act and the GDPR. As a member of the EDPB, the IDPC is understood to be bound to apply this methodology when it calculates any future fine. This is a change to the process by which a fine amount is derived, not a change to the statutory ceilings themselves: the twenty-million-euro-or-four-percent cap, and the lower public-authority caps, remain the outer boundary within which the new methodology operates.

No specific IDPC enforcement action applying the new methodology, and no change to the underlying grounds on which the IDPC may find an infringement, was identified. The development is confined to the quantification layer of the enforcement framework.

Outlook

The item to watch is the IDPC's first application of the EDPB's harmonised fining methodology in an actual Maltese enforcement decision, which will show whether harmonisation changes the practical size of fines imposed domestically as well as the process by which they are calculated.

Enforcement & Redress

Malta's data protection enforcement framework rests on GDPR Article 83 and Data Protection Act Article 21, under which the Information and Data Protection Commissioner may impose administrative fines up to the higher of twenty million euro or four percent of an undertaking's global annual turnover for the most serious infringements. Where the infringing party is a public authority, the fine ceiling drops to twenty-five thousand euro per violation plus twenty-five euro per day of continuing violation, rising to fifty thousand euro plus fifty euro per day for infringements of the categories set out in Article 83(4).

This existing ceiling structure is now operating within a newly harmonised calculation framework. The European Data Protection Board adopted, at its plenary on 22 September 2026, a harmonised methodology for calculating administrative fines, together with the final version of its guidelines on the interplay between the Digital Services Act and the GDPR. As a member of the EDPB, the IDPC is understood to be bound to apply this methodology when it calculates any future fine. This is a change to the process by which a fine amount is derived, not a change to the statutory ceilings themselves: the twenty-million-euro-or-four-percent cap, and the lower public-authority caps, remain the outer boundary within which the new methodology operates.

No specific IDPC enforcement action applying the new methodology, and no change to the underlying grounds on which the IDPC may find an infringement, was identified this cycle. The development is confined to the quantification layer of the enforcement framework.

Outlook

The item to watch is the IDPC's first application of the EDPB's harmonised fining methodology in an actual Maltese enforcement decision, which will show whether harmonisation changes the practical size of fines imposed domestically as well as the process by which they are calculated.

Enforcement & Redress

Malta's Information and Data Protection Commissioner has produced two notable enforcement outcomes bearing on this cycle. First, the Court of Appeal confirmed, on 20 May 2026, a Tribunal's earlier reduction of a 2022 administrative fine imposed for breaches of the Article 32 security-principle obligation, with the final confirmed figure settling at EUR200,000 down from the original EUR250,000. This confirms, at the appellate level, that the Tribunal's reduction was sound, and closes out what had been a multi-year dispute over the appropriate penalty for the underlying security failings. The full judgment text was not independently retrieved this cycle; the finding rests on secondary legal commentary describing the appellate outcome, so the precise reasoning behind the confirmed reduction is not yet available from a primary source.

Second, a 2026 decision found that an insurance company had breached its duties under the direct-marketing objection regime, having continued to send direct marketing to individuals after they had objected. The Commissioner's response combined a formal reprimand with an order for corrective measures to be completed within twenty days, alongside administrative fines totalling EUR1,000. The modest size of the financial penalty, set against the twenty-day corrective-measures deadline and formal reprimand, suggests the Commissioner's enforcement approach in this category of breach is oriented primarily toward securing behavioural compliance rather than imposing a severe financial deterrent.

Taken together, these two matters show continuing enforcement activity by the Commissioner across both a longstanding case reaching its appellate conclusion and a newly decided matter, spanning two different categories of obligation: data security under Article 32, and direct-marketing consent/objection handling. No change to the Commissioner's underlying enforcement powers or procedure was identified this cycle; both matters proceed under the existing framework of the Data Protection Act (Cap. 586).

Outlook

The principal open item is confirmation of the full-text or pinpoint citation for the 2026 insurer direct-marketing decision, which was not independently retrieved this cycle beyond the IDPC's own decisions-page reference. Whether any party pursues further appeal of the now twice-confirmed EUR200,000 security-principle fine is also worth watching, though no indication of a further appeal was identified in the sources reviewed this cycle.

Enforcement & Redress

Malta's Information and Data Protection Commissioner issued a 2026 decision finding that an insurance company breached its data protection obligations by continuing to process a complainant's personal data for direct marketing purposes after the complainant had objected to such processing. The Commissioner's response combined a reprimand, a corrective-measures order requiring the insurer to take remedial action within 20 days, and administrative fines totalling EUR 1,000. The enforcement mechanism behind this and any similar decision is set out in section 20 of the Data Protection Act, Chapter 586: where the Commissioner imposes an administrative fine, the controller or processor concerned must be ordered in writing to pay it, with the amount due as a civil debt, subject to a right of appeal under section 26; absent an appeal, the decision becomes final and executive.

The EUR 1,000 quantum in the 2026 decision sits well below Malta's statutory fine ceilings. Section 21 of Chapter 586 caps a fine on a public authority or body for an Article 83(5) or 83(6) GDPR infringement at EUR 50,000 per violation plus EUR 50 per day of continuation, with correspondingly lower tiers for Article 83(4) infringements; while that specific cap applies to public-sector bodies rather than private insurers, it illustrates that Malta's administrative fines generally continue to be set well short of GDPR's own statutory maxima. Secondary compilation reporting, not independently verified against the Commissioner's own decision text, further describes two 2025 decisions: a EUR 20,000 fine spanning three separate Article 5(1)(a) violations valued at EUR 12,500, EUR 5,000 and EUR 2,500, and a separate EUR 15,000 fine for direct-marketing violations under Articles 21(2) and 5(2) of the GDPR. If accurate, these decisions would reinforce a recurring enforcement interest in direct-marketing practices specifically, consistent with the pattern evident in the verified 2026 decision.

Outlook

The precise date and reference number of the 2026 insurer decision were not confirmed against the Commissioner's own published decision text this cycle, and the two 2025 decisions referenced above rest on a single secondary compilation source rather than independent verification. Confirming these details, and observing whether future decisions move fine quanta closer to the statutory ceiling in cases of recidivist direct-marketing conduct, would sharpen the enforcement-trajectory assessment for this module going forward.