DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

Id-Direttiva tal-Parlament Ewropew u tal-Kunsill 95/46/KE

of 24 October 1995

ta’ l-24 ta’ Ottubru, 1995

on the protection of individuals with regard to the processing of personal data and on the free movement of such data

dwar il-protezzjoni ta’ individwi fir-rigward ta’ l-ipproċessar ta’ data personali u dwar il-moviment liberu ta’ dik id-data

IL-PARLAMENT EWROPEW U L-KUNSILL TAL-UNJONI EWROPEA,

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Wara li kkunsidraw it-Trattat li jistabbilixxi l-Komunità Ewropea, u partikolarment l-Artikolu 100a tiegħu,

Having regard to the Treaty establishing the European Community, and in particular Article 100a thereof,

Wara li kkunsidraw il-proposta tal-Kummissjoni [1],

Having regard to the proposal from the Commission (1),

Wara li kkunsidraw l-opinjoni tal-Kumitat Ekonomiku u Soċjali [2],

Having regard to the opinion of the Economic and Social Committee (2),

Filwaqt li jaġixxu b’konformità mal-proċedura msemmija fl-Artikolu 189b tat-Trattat [3],

Acting in accordance with the procedure referred to in Article 189b of the Treaty (3),

1. Billi l-għanijiet tal-Komunità, kif stabbiliti fit-Trattat, kif emendat bit-Trattat dwar l-Unjoni Ewropea, huma, fost oħrajn, li jġibu l-għaqda dejjem aktar mill-qrib fost il-popli ta’ l-Ewropa, irawmu relazzjonijiet aktar mill-qrib bejn l-Istati tal-Komunità, jassiguraw progress ekonomiku u soċjali b’azzjoni komuni biex jitneħħew il-barrieri li jifirdu l-Ewropa, iħeġġu t-titjib kontinwu tal-kondizzjonijiet ta’ l-għajxien tal-popli tagħha, iżommu u jsaħħu l-paċi u l-libertà u jmexxu ‘l quddiem id-demokrazija imsejsa fuq id-drittijiet fundamentali magħrufa fil-kostituzzjoni u l-liġijiet ta’ l-Istati Membri u fil-Konvenzjoni Ewropea għall-Protezzjoni tad-Drittijiet tal-Bniedem u tal-Libertajiet Fundamentali;

(1) Whereas the objectives of the Community, as laid down in the Treaty, as amended by the Treaty on European Union, include creating an ever closer union among the peoples of Europe, fostering closer relations between the States belonging to the Community, ensuring economic and social progress by common action to eliminate the barriers which divide Europe, encouraging the constant improvement of the living conditions of its peoples, preserving and strengthening peace and liberty and promoting democracy on the basis of the fundamental rights recognized in the constitution and laws of the Member States and in the European Convention for the Protection of Human Rights and Fundamental Freedoms;

2. Billi s-sistemi ta’ l-ipproċessar ta’ data huma maħsuba biex jaqdu lill-bniedem; billi, indipendentement miċ-ċittadinanza jew residenza ta’ persuna naturali, huma għandhom jirrispettaw id-drittijiet u l-libertajiet fundamentali, l-aktar id-dritt għall-ħajja privata, u jaghtu sehemhom għall-progress ekonomiku u soċjali, għat-tkattir tal-kummerċ u l-ġid tal-persuna;

(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to economic and social progress, trade expansion and the well-being of individuals;

3. Billi bit-twaqqif u t-tħaddim ta’ suq intern li fih, skond l-Artikolu 7a tat-Trattat, hemm il-garanzija tal-moviment liberu ta’ oġġetti, persuni, servizzi u kapital, jeħtieġ mhux biss li data personali tkun tista’ tgħaddi liberament minn Stat Membru għal ieħor, imma wkoll li jkun hemm il-protezzjoni tad-drittijiet fundamentali tal-persuna;

(3) Whereas the establishment and functioning of an internal market in which, in accordance with Article 7a of the Treaty, the free movement of goods, persons, services and capital is ensured require not only that personal data should be able to flow freely from one Member State to another, but also that the fundamental rights of individuals should be safeguarded;

4. Billi qed ikun hemm użu aktar ta’ spiss fil-Komunità ta’ ipproċessar ta’ data personali f’bosta oqsma ta’ l-ekonomija u attività soċjali; billi l-progress li sar fit-teknoloġija ta’ l-informatika qiegħed jagħmel l-ipproċessar u l-bdil ta’ din id-data ħafna aktar faċli;

(4) Whereas increasingly frequent recourse is being had in the Community to the processing of personal data in the various spheres of economic and social activity; whereas the progress made in information technology is making the processing and exchange of such data considerably easier;

5. Billi l-integrazzjoni ekonomika u soċjali li seħħet bit-twaqqif u bit-tħaddim tas-suq intern it-tifsira ta’ l-Artikolu 7a tat-Trattat għandu bilfors iwassal għal żjieda sewwa fit-tixrid ta’ data personali minn naħa għal oħra tal-fruntieri bejn dawk kollha li, f’kapaċità privata jew pubblika, għandhom x’jaqsmu f’attività ekonomika u soċjali fl-Istati Membri; billi l-bdil ta’ data personali bejn intrapriżi fi Stati Membri differenti huwa mistenni li jiżdied; billi l-awtoritajiet nazzjonali f’ħafna Stati Membri qed jissejħu bis-saħħa tal-liġijiet tal-Komunità biex jikkolaboraw u jibdlu data personali biex ikunu jistgħu jaqdu d-dmirijiet tagħhom jew jagħmlu xogħol f’isem awtorità fi Stat Membru ieħor fil-qafas ta’ żona mingħajr fruntieri interni kif stabbilit mis-suq intern;

(5) Whereas the economic and social integration resulting from the establishment and functioning of the internal market within the meaning of Article 7a of the Treaty will necessarily lead to a substantial increase in cross-border flows of personal data between all those involved in a private or public capacity in economic and social activity in the Member States; whereas the exchange of personal data between undertakings in different Member States is set to increase; whereas the national authorities in the various Member States are being called upon by virtue of Community law to collaborate and exchange personal data so as to be able to perform their duties or carry out tasks on behalf of an authority in another Member State within the context of the area without internal frontiers as constituted by the internal market;

6. Billi, wkoll, iż-żjieda fil-kooperazzjoni xjentifika u teknika u l-introduzzjoni koordinata ta’ networks ġodda ta’ telekomunikazzjonijiet fil-Komunità jeħtieġu u jħaffu t-tixrid ta’ data personali minn naħa għal oħra tal-fruntieri;

(6) Whereas, furthermore, the increase in scientific and technical cooperation and the coordinated introduction of new telecommunications networks in the Community necessitate and facilitate cross-border flows of personal data;

7. Billi d-differenza fil-gradi ta’ protezzjoni tad-drittijiet u l-libertajiet tal-persuna, l-aktar id-dritt għall-ħajja privata, fl-ipproċessar ta’ data personali li hemm fl-Istati Membri tista’ tfixkel it-trasmissjoni ta’ dik id-data mit-territorju ta’ Stat Membru għal dak ta’ Stat Membru ieħor; billi din id-differenza tista’ għalhekk tkun ta’ ostakolu biex jinġiebu ‘l quddiem għad ta’ attivitajiet ekonomiċi fil-livell tal-Komunità, tista’ tgħawweġ il-kompetizzjoni u tfixkel lill-awtoritajiet fit-twettiq tar-responsabbiltajiet tagħhom skond il-liġijiet tal-Komunità; billi din id-differenza fil-gradi ta’ protezzjoni hija minħabba li jkun hemm għażla wiesgħa ta’ liġijiet nazzjonali, regolamenti u dispożizzjonijiet amministrattivi;

(7) Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; whereas this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge of their responsibilities under Community law; whereas this difference in levels of protection is due to the existence of a wide variety of national laws, regulations and administrative provisions;

8. Billi, sabiex jitneħħa t-tfixkil għat-tixrid ta’ data personali, il-grad ta’ protezzjoni tad-drittijiet u l-libertajiet tal-persuna fl-ipproċessar ta’ dik id-data għandu jkun l-istess fl-Istati Membri kollha; billi dan il-għan huwa ta’ importanza kbira għas-suq intern, iżda li ma jistax jintlaħaq mill-Istati Membru waħidhom, l-aktar minħabba n-nuqqas sewwa ta’ qbil li hemm bħalissa bejn il-liġijiet rilevanti ta’ l-Istati Membri u l-ħtieġa li jkunu kkoordinati l-liġijiet ta’ l-Istati Membri biex jassiguraw li t-tixrid ta’ data personali minn naħa għal oħra tal-fruntieri jkun regolat b’mod konsistenti skond il-finijiet tas-suq intern kif hemm provdut fl-Artikolu 7a tat-Trattat; billi hemm ħtieġa ta’ azzjoni mill-Komunità biex dawk il-liġijiet ikunu approssimati;

(8) Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States; whereas this objective is vital to the internal market but cannot be achieved by the Member States alone, especially in view of the scale of the divergences which currently exist between the relevant laws in the Member States and the need to coordinate the laws of the Member States so as to ensure that the cross-border flow of personal data is regulated in a consistent manner that is in keeping with the objective of the internal market as provided for in Article 7a of the Treaty; whereas Community action to approximate those laws is therefore needed;

9. Billi, meta jkun hemm l-istess protezzjoni li tiġi mill-approssimazzjoni tal-liġijiet nazzjonali, l-Istati Membri ma jkunx jistgħu iżommu aktar il-moviment liberu ta’ bejniethom ta’ data personali għal raġunijiet li jkollhom x’jaqsmu mal-protezzjoni tad-drittijiet u l-libertajiet tal-persuna, partikolarment tad-dritt għall-ħajja privata; billi Stati Membri jibqgħalhom spazju għal azzjoni, li jistgħu, fil-qafas ta’ l-implimentazzjoni tad-Direttiva, jkun utiliżżat mis-sieħba soċjali u tan-negozju; billi għalhekk Stati Membri jkunu jistgħu jispeċifikaw fil-liġijiet nazzjonali tagħhom il-kondizzjonijiet ġenerali li jirregolaw il-leġittimità ta’ l-ipproċessar ta’ data; billi meta jagħmlu hekk l-Istati Membri għandhom jagħmlu ħilithom biex itejbu l-protezzjoni li bħalissa tinsab provduta fil-liġijiet tagħhom; billi, f’dan l-ispazju ta’ azzjoni u skond il-liġijiet tal-Komunità, jista’ jkun hemm differenzi fl-implimentazzjoni tad-Direttiva, u dan jista’ jħalli effett fuq il-moviment ta’ data f’Istat Membru kif ukoll fil-Komunità;

(9) Whereas, given the equivalent protection resulting from the approximation of national laws, the Member States will no longer be able to inhibit the free movement between them of personal data on grounds relating to protection of the rights and freedoms of individuals, and in particular the right to privacy; whereas Member States will be left a margin for manoeuvre, which may, in the context of implementation of the Directive, also be exercised by the business and social partners; whereas Member States will therefore be able to specify in their national law the general conditions governing the lawfulness of data processing; whereas in doing so the Member States shall strive to improve the protection currently provided by their legislation; whereas, within the limits of this margin for manoeuvre and in accordance with Community law, disparities could arise in the implementation of the Directive, and this could have an effect on the movement of data within a Member State as well as within the Community;

10. Billi l-għan tal-liġijiet nazzjonali dwar il-proċessar ta’ data personali huwa l-protezzjoni tad-drittijiet u l-libertajiet fundamentali, l-aktar id-dritt għall-ħajja privata, li huwa rikonoxxut kemm fl-Artikolu 8 tal-Konvenzjoni Ewropea għall-Protezzjoni tad-Drittijiet tal-Bniedem u tal-Libertajiet Fundamentali u fil-prinċipji ġenerali tal-liġi tal-Komunità; billi, għal dik ir-raġuni, l-approssimazzjoni ta’ dawk il-liġijiet m’għandhiex bħala riżultat ta’ dan tnaqqas mill-protezzjoni minnhom mogħtija, imma għandha, għall-kuntrarju, tfittex li tassigura grad għoli ta’ protezzjoni fil-Komunità;

(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;

11. Billi l-prinċipji tal-protezzjoni tad-drittijiet u l-libertajiet tal-persuna, l-aktar id-dritt għall-ħajja privata, li jinsabu f’din id-Direttiva, isostnu u jwessgħu dawk li jinsabu fil-Konvenzjoni tal-Kunsill ta’ l-Ewropa tat-28 ta’ Jannar, 1981, għall-Protezzjoni ta’ Individwi dwar l-Ipproċessar Awtomatiku ta’ Data Personali;

(11) Whereas the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data;

12. Billi l-prinċipji ta’ protezzjoni għandhom japplikaw għall-ipproċessar kollu ta’ data personali minn kull persuna li l-attivitajiet tagħha huma regolati bil-liġi tal-Komunità; billi m’għandux ikun magħdud l-ipproċessar ta’ data magħmul minn persuna naturali fl-eżerċizzju ta’ attivitajiet li huma esklussivament personali jew domestiċi, bħal ma hija korrispondenza u ż-żamma ta’ reġistri ta’ indirizzi;

(12) Whereas the protection principles must apply to all processing of personal data by any person whose activities are governed by Community law; whereas there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses;

13. Billi l-attivitajiet msemmija fit-Titoli V u VI tat-Trattat ta’ l-Unjoni Ewropea dwar sigurtà pubblika, difiża, sigurtà ta’ l-Istat jew l-attivitajiet ta’ l-Istat fil-qasam tal-liġijiet kriminali ma jaqgħux taħt il-liġi tal-Komunità, bla ħsara għall-obbligazzjonijiet ta’ l-Istati Membri skond l-Artikolu 56(2), l-Artikolu 57 jew l-Artikolu 100a tat-Trattat li jistabbilixxi l-Komunità Ewropea; billi l-ipproċessar ta’ data personali meħtieġ biex jipproteġi l-ġid ekonomiku ta’ l-Istat ma jaqgħax taħt din id-Direttiva meta dak l-ipproċessar ikollu x’jaqsam mas-sigurtà ta’ l-Istat;

(13) Whereas the acitivities referred to in Titles V and VI of the Treaty on European Union regarding public safety, defence, State security or the acitivities of the State in the area of criminal laws fall outside the scope of Community law, without prejudice to the obligations incumbent upon Member States under Article 56 (2), Article 57 or Article 100a of the Treaty establishing the European Community; whereas the processing of personal data that is necessary to safeguard the economic well-being of the State does not fall within the scope of this Directive where such processing relates to State security matters;

14. Billi, meħud kont ta’ l-importanza ta’ l-iżviluppi li qed ikun hemm fil-qafas tas-soċjetà ta’ l-informatika, tat-teknika użata biex taqbad, tibgħat, timmanipula, tirreġistra, taħżen jew tikkomunika data audio-viżwali dwar persuna naturali, din id-Direttiva għandha tapplika għal ipproċessar li jkollu x’jaqsam ma’ din id-data;

(14) Whereas, given the importance of the developments under way, in the framework of the information society, of the techniques used to capture, transmit, manipulate, record, store or communicate sound and image data relating to natural persons, this Directive should be applicable to processing involving such data;

15. Billi l-ipproċessar ta’ din id-data huwa milqut minn din id-Direttiva biss jekk ikun awtomatizzat jew jekk id-data pproċessata titqiegħed jew tkun maħsuba biex titqiegħed f’sistema ta’ skedar skond kriterji speċifiċi li jkollhom x’jaqsmu ma’ individwi, biex l-aċċess għad-data in kwistjoni jkun ħafif;

(15) Whereas the processing of such data is covered by this Directive only if it is automated or if the data processed are contained or are intended to be contained in a filing system structured according to specific criteria relating to individuals, so as to permit easy access to the personal data in question;

16. Billi l-ipproċessar ta’ data audio-viżwali, bħal ma jiġri f’każi ta’ sorveljanza bil-video, ma jaqgħax taħt din id-Direttiva jekk isir għal għanijiet ta’ sigurtà pubblika, difiża, sigurtà nazzjonali jew meta jsiru attivitajiet ta’ l-Istat fil-qasam tal-liġi kriminali jew attivitajiet oħra li ma jaqgħux taħt il-liġi tal-Komunità;

(16) Whereas the processing of sound and image data, such as in cases of video surveillance, does not come within the scope of this Directive if it is carried out for the purposes of public security, defence, national security or in the course of State activities relating to the area of criminal law or of other activities which do not come within the scope of Community law;

17. Billi, sa fejn għandu x’jaqsam l-ipproċessar ta’ data audio-viżwali li jsir għal għanijiet ta’ ġurnaliżmu jew għal għanijiet ta’ espressjoni letterarja jew artistika, partikolarment fil-qasam audio-viżiv, il-prinċipji tad-Direttiva għandhom japplikaw b’mod ristrett skond id-dispożizzjonijiet imsemmija fl-Artikolu 9;

(17) Whereas, as far as the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic expression is concerned, in particular in the audiovisual field, the principles of the Directive are to apply in a restricted manner according to the provisions laid down in Article 9;

18. Billi, sabiex ikun assigurat li individwi ma jiċċaħdux mill-protezzjoni li għandhom dritt għaliha b’din id-Direttiva, kull ipproċessar ta’ data personali fil-Komunità għandu jsir skond il-liġi ta’ wieħed mill-Istati Membri; billi, f’dan il-qasam, l-ipproċessar magħmul taħt ir-responsabbiltà ta’ kontrollur li jkun stabbilit fi Stat Membru għandha jkun regolat bil-liġi ta’ dak l-Istat;

(18) Whereas, in order to ensure that individuals are not deprived of the protection to which they are entitled under this Directive, any processing of personal data in the Community must be carried out in accordance with the law of one of the Member States; whereas, in this connection, processing carried out under the responsibility of a controller who is established in a Member State should be governed by the law of that State;

19. Billi stabbiliment fit-territorju ta’ Stat Membru jfisser l-eżerċizzju effettiv u reali ta’ attività permezz ta’ arranġamenti stabbli; billi l-forma legali ta’ stabbiliment bħal dan, kemm jekk sempliċi fergħa jew sussidjarju b’personalità ġuridika, mhux il-fattur determinanti dwar dan; billi, meta kontrollur wieħed ikun stabbilit fit-territorju ta’ diversi Stati Membri, partikolarment permezz ta’ sussidjarji, huwa għandu jassigura, sabiex ma jkunux skartati regoli nazzjonali, li kull stabbiliment jissodisfa l-obbligazzjonijiet tal-liġi nazzjonali li jkunu japplikaw għall-attivitajiet tiegħu;

(19) Whereas establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements; whereas the legal form of such an establishment, whether simply branch or a subsidiary with a legal personality, is not the determining factor in this respect; whereas, when a single controller is established on the territory of several Member States, particularly by means of subsidiaries, he must ensure, in order to avoid any circumvention of national rules, that each of the establishments fulfils the obligations imposed by the national law applicable to its activities;

20. Billi l-fatt li l-ipproċessar ta’ data jsir minn persuna stabbilita f’pajjiż terz m’għandux ikun ta’ xkiel għall-protezzjoni ta’ l-individwu kif provdut f’din id-Direttiva; billi f’dawn il-każi, l-ipproċessar għandu jkun regolat bil-liġi ta’ l-Istat Membru li fih ikunu jinsabu l-mezzi wżati, u għandu jkun hemm garanziji li jassiguraw li d-drittijiet u l-obbligazzjonijiet imsemmija f’din id-Direttiva jkunu rispettati fil-prattika;

(20) Whereas the fact that the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive; whereas in these cases, the processing should be governed by the law of the Member State in which the means used are located, and there should be guarantees to ensure that the rights and obligations provided for in this Directive are respected in practice;

21. Billi din id-Direttiva hija bla ħsara għar-regoli ta’ territorjalità applikabbli f’materji kriminali;

(21) Whereas this Directive is without prejudice to the rules of territoriality applicable in criminal matters;

22. Billi Stati Membri għandhom ifissru b’mod iktar ċar fil-liġijiet li huma jagħmlu jew meta jġibu fis-seħħ il-miżuri msemmija f’'din id-Direttiva iċ-ċirkostanzi ġenerali li bihom l-ipproċessar ikun skond il-liġi; billi, partikolarment l-Artikolu 5, flimkien ma’ l-Artikoli 7 u 8, jippermetti, indipendentement minn regoli ġenerali, lil Stati Membri li jipprovdu għal kondizzjonijiet speċjali ta’ ipproċessar għal setturi speċifiċi u għal kategoriji ta’ data milquta bl-Artikolu 8;

(22) Whereas Member States shall more precisely define in the laws they enact or when bringing into force the measures taken under this Directive the general circumstances in which processing is lawful; whereas in particular Article 5, in conjunction with Articles 7 and 8, allows Member States, independently of general rules, to provide for special processing conditions for specific sectors and for the various categories of data covered by Article 8;

23. Billi Stati Membri għandhom is-setgħa li jassiguraw l-implimentazzjoni tal-protezzjoni ta’ l-individwu kemm permezz ta’ liġi ġenerali dwar il-protezzjoni ta’ l-individwu fl-ipproċessar ta’ data personali, kif ukoll b’liġijiet settorjali bħalma huma dawk li għandhom x’jaqsmu, per eżempju, ma’ istituti ta’ statistika;

(23) Whereas Member States are empowered to ensure the implementation of the protection of individuals both by means of a general law on the protection of individuals as regards the processing of personal data and by sectorial laws such as those relating, for example, to statistical institutes;

24. Billi l-liġijiet dwar il-protezzjoni ta’ persuni ġuridiċi f’dak li għandu x’jaqsam ma’ l-ipproċessar ta’ data ta’ interess għalihom mhix milquta b’din id-Direttiva;

(24) Whereas the legislation concerning the protection of legal persons with regard to the processing data which concerns them is not affected by this Directive;

25. Billi l-prinċipji ta’ protezzjoni għandhom ikunu riflessi, minn naħa l-waħda, fl-obbligazzjonijiet imposti fuq persuni, awtoritajiet pubbliċi, intrapriżi, aġenziji u korpi oħra responsabbli għal ipproċessar, partikolarment dwar il-kwalità tad-data, sigurtà teknika, avviżi lill-awtorità ta’ superviżjoni, u ċ-ċirkostanzi li fihom jista’ jsir l-ipproċessar, u, minn naħa l-oħra, id-dritt mogħti lil individwu, li d-data dwaru jkun is-suġġett ta’ l-ipproċessar, li jkun mgħarraf bl-ipproċessar li jkun qed isir dwaru, li jikkonsulta d-data, jitlob korrezzjonijiet u li jagħmel ukoll oġġezzjoni għal ipproċessar f’ċerti ċirkostanzi;

(25) Whereas the principles of protection must be reflected, on the one hand, in the obligations imposed on persons, public authorities, enterprises, agencies or other bodies responsible for processing, in particular regarding data quality, technical security, notification to the supervisory authority, and the circumstances under which processing can be carried out, and, on the other hand, in the right conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances;

26. Billi l-prinċipji ta’ protezzjoni għandhom ikunu applikabbli għal kull informazzjoni li jkollha x’taqsam ma’ persuna identifikata jew identifikabbli; billi, biex ikun stabbilit jekk persuna tkunx identifikabbli, għandhom jitqiesu l-mezzi kollha li raġonevolment aktax jintużaw mill-kontrollur jew minn persuna oħra biex tkun identifikata l-imsemmija persuna; billi l-prinċipji ta’ protezzjoni m’għandhomx ikunu applikati għal data mogħti b’mod anonimu tant illi s-suġġett tad-data ma jkunx aktar identifikabbli; billi kodiċijiet ta’ kondotta skond it-tifsira ta’ l-Artikolu 27 jistgħu jkunu strument tajjeb biex jagħtu gwida dwar il-metodi li bihom id-data tkun tista’ tingħata b’mod anonimu u tinżamm b’mod li bih l-identifikazzjoni tas-suġġett tad-data ma jkunx iktar possibbli;

(26) Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable; whereas codes of conduct within the meaning of Article 27 may be a useful instrument for providing guidance as to the ways in which data may be rendered anonymous and retained in a form in which identification of the data subject is no longer possible;

27. Billi l-protezzjoni ta’ individwi għandha tkun applikata kemm għal ipproċessar awtomatiku ta’ data u kemm għal ipproċessar manwali; billi l-iskop ta’ din il-protezzjoni m’għandux fil-fatt jiddependi mill-mezzi tekniċi użati, peress li dan jista’ joħloq riskju serju li dawn jistgħu jiġu skartati; billi, madankollu, dwar ipproċessar manwali, din id-Direttiva għandha x’taqsam biss ma’ sistemi ta’ skedar, mhux files mingħajr struttura; billi, b’mod partikolari, il-kontenut tas-sistema ta’ skedar għandu jkun strutturat skond kriterji speċifiċi dwar individwi b’mod li l-aċċess għal data personali jkun ħafif; billi, skond id-definizzjoni fl-Artikolu 2(ċ), il-kriterji differenti biex ikunu stabbiliti l-elementi ta’ sett strutturat ta’ data personali, u l-kriterji differenti li jirregolaw l-aċċess għal sett bħal dan, jistgħu ikunu stabbiliti minn kull Stat Membru; billi sett jew settijiet ta’ files, kif ukoll il-qoxra tal-faċċata tagħhom, li ma jkunux strutturati skond kriterji speċifiċi, m’għandhomx jaqgħu, għal l-ebda raġuni, taħt din id-Direttiva;

(27) Whereas the protection of individuals must apply as much to automatic processing of data as to manual processing; whereas the scope of this protection must not in effect depend on the techniques used, otherwise this would create a serious risk of circumvention; whereas, nonetheless, as regards manual processing, this Directive covers only filing systems, not unstructured files; whereas, in particular, the content of a filing system must be structured according to specific criteria relating to individuals allowing easy access to the personal data; whereas, in line with the definition in Article 2 (c), the different criteria for determining the constituents of a structured set of personal data, and the different criteria governing access to such a set, may be laid down by each Member State; whereas files or sets of files as well as their cover pages, which are not structured according to specific criteria, shall under no circumstances fall within the scope of this Directive;

28. Billi kull ipproċessar ta’ data personali għandu jkun ġust u skond il-liġi għall-individwi konċernati; billi, b’mod partikolari, id-data għandha tkun adekwata, rilevanti u mhux eċċessiv għall-għanijiet li għalihom ikun ipproċessat; billi dawn l-għanijiet għandhom ikunu espliċiti u leġittimi u stabbiliti waqt il-ġbir tad-data; billi l-għanijiet ta’ l-ipproċessar wara l-ġbir m’għandhomx ikunu inkompatibbli ma’ l-għanijiet kif stabbiliti oriġinarjament;

(28) Whereas any processing of personal data must be lawful and fair to the individuals concerned; whereas, in particular, the data must be adequate, relevant and not excessive in relation to the purposes for which they are processed; whereas such purposes must be explicit and legitimate and must be determined at the time of collection of the data; whereas the purposes of processing further to collection shall not be incompatible with the purposes as they were originally specified;

29. Billi meta jkun hemm iktar ipproċessar ta’ data personali għal għanijiet ta’ storja, statistika jew xjenza dan mhux ġeneralment meqjus bħala inkompatibbli ma’ l-għanijiet li dwarhom id-data jkun inġabar minn qabel, sakemm Stati Membri jagħtu protezzjoni xierqa; billi din il-protezzjoni għandha teskludi l-użu tad-data sabiex jittieħdu miżuri jew deċiżjonijiet fir-rigward ta’ individwi partikolari;

(29) Whereas the further processing of personal data for historical, statistical or scientific purposes is not generally to be considered incompatible with the purposes for which the data have previously been collected provided that Member States furnish suitable safeguards; whereas these safeguards must in particular rule out the use of the data in support of measures or decisions regarding any particular individual;

30. Billi, biex l-ipproċessar ta’ data personali jsir skond il-liġi, dan għandu wkoll isir bil-kunsens tas-suġġett tad-data jew li jkun meħtieġ għall-konklużjoni jew eżekuzzjoni ta’ kuntratt li jorbot lis-suġġett tad-data, jew bħala kondizzjoni ta’ liġi, jew biex isir xogħol fl-interess pubbliku jew fl-eżerċizzju ta’ awtorità uffiċjali, jew fl-interessi leġittimi ta’ persuna naturali jew ġuridika, sakemm l-interessi jew id-drittijiet u l-libertajiet tas-suġġett tad-data ma jeħdux preċedenza; billi, b’mod partikolari, sabiex jinżamm bilanċ bejn l-interessi konċernati, waqt li tkun garantita kompetizzjoni effettiva, Stati Membri jistgħu jistabbilixxu iċ-ċirkostanzi li fihom data personali tista’ tkun użata jew żvelata lil parti terza fil-qafas ta’ l-attivitajiet ordinarji u leġittimi tan-negozju ta’ kumpaniji u korpi oħra; billi Stati Membri jistgħu bl-istess mod jispeċifikaw il-kondizzjonijiet li bihom data personali tista’ tiġi żvelata lil parti terza għal finijiet ta’ marketing, sew jekk isir kummerċjalment jew jekk minn organizzazzjoni ta’ karità jew minn assoċjazzjoni jew fondazzjoni oħra, per eżempju ta’ natura politika, bil-kondizzjoni li s-suġġett tad-data jkun jista’ jagħmel oġġezzjoni għall-ipproċessar tad-data li tinteressa lilu, mingħajr ħlas u mingħajr ma jkollu għalfejn jagħti raġuni;

(30) Whereas, in order to be lawful, the processing of personal data must in addition be carried out with the consent of the data subject or be necessary for the conclusion or performance of a contract binding on the data subject, or as a legal requirement, or for the performance of a task carried out in the public interest or in the exercise of official authority, or in the legitimate interests of a natural or legal person, provided that the interests or the rights and freedoms of the data subject are not overriding; whereas, in particular, in order to maintain a balance between the interests involved while guaranteeing effective competition, Member States may determine the circumstances in which personal data may be used or disclosed to a third party in the context of the legitimate ordinary business activities of companies and other bodies; whereas Member States may similarly specify the conditions under which personal data may be disclosed to a third party for the purposes of marketing whether carried out commercially or by a charitable organization or by any other association or foundation, of a political nature for example, subject to the provisions allowing a data subject to object to the processing of data regarding him, at no cost and without having to state his reasons;

31. Billi l-ipproċessar ta’ data personali għandu wkoll jitqies li hu skond il-liġi meta jsir biex jipproteġi interess meħtieġ għal ħajja tas-suġġett tad-data;

(31) Whereas the processing of personal data must equally be regarded as lawful where it is carried out in order to protect an interest which is essential for the data subject's life;

32. Billi huma l-liġijiet nazzjonali li għandhom jistabbilixxu jekk il-kontrollur li jagħmel xogħol fl-interess pubbliku jew fl-eżerċizzju ta’ awtorità uffiċjali għandhux ikun amministratur pubbliku jew persuna naturali jew ġuridika oħra regolata mill-liġi pubblika, jew minn liġi privata bħal ma hija assoċjazzjoni professjonali;

(32) Whereas it is for national legislation to determine whether the controller performing a task carried out in the public interest or in the exercise of official authority should be a public administration or another natural or legal person governed by public law, or by private law such as a professional association;

33. Billi data li minn natura tagħha tista’ tikser il-libertajiet fundamentali jew id-dritt għall-ħajja privata m’għandhiex tkun ipproċessata jekk is-suġġett tad-data ma jagħtix il-kunsens espliċitu tiegħu; billi, iżda, derogi għal din il-projbizzjoni għandhom jissemmew espliċitament dwar ħtiġijiet speċifiċi, partikolarment meta l-ipproċessar ta’ dan id-data jsir għal ċerti għanijiet mediċi minn persuni soġġetti għal obbligazzjoni tas-sigriet professjonali skond il-liġi jew meta jsir waqt attivitajiet leġittimi minn ċerti assoċjazzjonijiet jew fondazzjonijiet li l-għan tagħhom hu li jippermettu l-eżerċizzju tal-libertajiet fundamentali;

(33) Whereas data which are capable by their nature of infringing fundamental freedoms or privacy should not be processed unless the data subject gives his explicit consent; whereas, however, derogations from this prohibition must be explicitly provided for in respect of specific needs, in particular where the processing of these data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy or in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms;

34. Billi Stati Membri għandhom ukoll ikunu awtorizzati, meta dan ikun ġustifikat minħabba interess pubbliku ta’ importanza, li jidderogaw mill-projbizzjoni dwar l-ipproċessar ta’ kategoriji sensittivi ta’ data meta jkunu ġustifikati jagħmlu dan minħabba raġunijiet ta’ interess pubbliku ta’ importanza f’oqsma bħalma huma s-saħħa pubblika u l-protezzjoni soċjali - l-iktar biex jassiguraw kwalità u spejjeż mill-inqas tal-proċeduri wżati biex jintlaqgħu talbiet għal benefiċċji u servizzi fis-sistema ta’ assigurazzjoni tas-saħħa - riċerka xjentifika u statistika governattiva; billi huma għandhom id-dmir, iżda, li jipprovdu protezzjoni speċifika u tajba biżżejjed biex jipproteġu d-drittijiet fundamentali u l-ħajja privata ta’ individwi;

(34) Whereas Member States must also be authorized, when justified by grounds of important public interest, to derogate from the prohibition on processing sensitive categories of data where important reasons of public interest so justify in areas such as public health and social protection - especially in order to ensure the quality and cost-effectiveness of the procedures used for settling claims for benefits and services in the health insurance system - scientific research and government statistics; whereas it is incumbent on them, however, to provide specific and suitable safeguards so as to protect the fundamental rights and the privacy of individuals;

35. Billi, wkoll, l-ipproċessar ta’ data personali minn awtoritajiet uffiċjali biex jintlaħqu għanijiet stabbiliti b’liġi kostituzzjonali jew b’liġi pubblika internazzjonali, ta’ assoċjazzjonijiet reliġjużi rikonoxxuti uffiċjalment, issir għal raġunijiet ta’ interess pubbliku ta’ importanza;

(35) Whereas, moreover, the processing of personal data by official authorities for achieving aims, laid down in constitutional law or international public law, of officially recognized religious associations is carried out on important grounds of public interest;

36. Billi meta jkun hemm attivitajiet elettorali, it-tħaddim tas-sistema demokratika f’xi Stati Membri teħtieġ li partiti politiċi jiġbru data fuq l-opinjoni politika tan-nies, l-ipproċessar ta’ dik id-data jista’ jkun permess għal raġunijiet ta’ interess pubbliku ta’ importanza, bil-kondizzjoni li jkunu stabbiliti mezzi xierqa ta’ protezzjoni;

(36) Whereas where, in the course of electoral activities, the operation of the democratic system requires in certain Member States that political parties compile data on people's political opinion, the processing of such data may be permitted for reasons of important public interest, provided that appropriate safeguards are established;

37. Billi l-ipproċessar ta’ data personali għal għanijiet ta’ ġurnaliżmu jew għal għanijiet ta’ espressjoni letterarja jew artistika, partikolarment fil-qasam audio-viżwali, għandu jikkwalifika għal eżenzjoni minn ċerti dispożizzjonijiet ta’ din id-Direttiva meta dan ikun meħtieġ biex issir rikonċiljazzjoni bejn id-drittijiet fundamentali ta’ individwi u l-libertà ta’ l-informazzjoni, u l-iktar mad-dritt li tingħata u tintbagħat informazzjoni, kif garantita partikolarment bl-Artikolu 10 tal-Konvenzjoni Ewropea għall-Protezzjoni tad-Drittijiet tal-Bniedem u tal-Libertajiet Fundamentali; billi Stati Membri għandhom għalhekk jistabbilixxu eżenzjonijiet u derogi meħtieġa għall-fini ta’ bilanċ bejn id-drittijiet fundamentali dwar miżuri ġenerali ta’ leġitimità ta’ l-ipproċessar tad-data, miżuri dwar it-trasferiment ta’ data lil pajjiżi terzi u s-setgħat ta’ l-awtorità ta’ superviżjoni; billi dan iżda m’għandux iwassal lil Stati Membri li jistabbilixxu eżenzjonijiet mill-miżuri li jassiguraw is-sigurtà ta’ l-ipproċessar; billi l-awtorità ta’ superviżjoni responsabbli għal dan is-settur għandha wkoll mill-inqas tkun provduta b’ċerti poteri ex-post, e.g. li tippubblika rapport regolari jew li tirreferi affarijiet lill-awtoritajiet ġudizjarji;

(37) Whereas the processing of personal data for purposes of journalism or for purposes of literary of artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, measures on the transfer of data to third countries and the power of the supervisory authority; whereas this should not, however, lead Member States to lay down exemptions from the measures to ensure security of processing; whereas at least the supervisory authority responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report or to refer matters to the judicial authorities;

38. Billi, biex l-ipproċessar ta’ data jkun ġust, is-suġġett tad-data għandu jkun f’pożizzjoni li jkun jaf bl-eżistenza ta’ operazzjoni ta’ ipproċessar u, meta data tinġabar mingħandu, huwa għandu jingħata informazzjoni eżatta u sħiħa, meħud kont taċ-ċirkostanzi tal-ġbir;

(38) Whereas, if the processing of data is to be fair, the data subject must be in a position to learn of the existence of a processing operation and, where data are collected from him, must be given accurate and full information, bearing in mind the circumstances of the collection;

39. Billi ċerti operazzjonijiet ta’ ipproċessar jeħtieġu data li l-kontrollur ma jkunx ġabar direttament mis-suġġett tad-data; billi, wkoll, data tista’ leġittimament tkun żvelata lil parti terza, ukoll jekk l-iżvelar ma jkunx mistenni meta d-data jinġabar mingħand is-suġġett tad-data; billi, f’dawn il-każi kollha, is-suġġett tad-data għandu jkun mgħarraf meta d-data tkun irreġistrata jew mill-inqas meta d-data tkun żvelata l-ewwel lil parti terza;

(39) Whereas certain processing operations involve data which the controller has not collected directly from the data subject; whereas, furthermore, data can be legitimately disclosed to a third party, even if the disclosure was not anticipated at the time the data were collected from the data subject; whereas, in all these cases, the data subject should be informed when the data are recorded or at the latest when the data are first disclosed to a third party;

40. Billi, iżda, mhux meħtieġ li tkun imposta din l-obbligazzjoni jekk is-suġġett tad-data diġa jkollu l-informazzjoni; billi, wkoll, m’għandu jkun hemm l-ebda obbligazzjoni bħal din jekk ir-reġistrazzjoni jew l-iżvelar ikunu espressament provduti mill-liġi jew jekk l-għoti ta’ informazzjoni lis-suġġett tad-data tkun impossibli jew ikun jeħtieġlu jagħmel sforzi sproporzjonati, li jista’ jkun il-każ meta l-ipproċessar isir għal għanijiet ta’ storja, statistika jew xjenza; billi, dwar dan, jistgħu jiġu kkunsidrati l-għadd ta’ suġġetti tad-data, kemm ikollu żmien id-data u kull miżura ta’ kumpens li tittieħed;

(40) Whereas, however, it is not necessary to impose this obligation of the data subject already has the information; whereas, moreover, there will be no such obligation if the recording or disclosure are expressly provided for by law or if the provision of information to the data subject proves impossible or would involve disproportionate efforts, which could be the case where processing is for historical, statistical or scientific purposes; whereas, in this regard, the number of data subjects, the age of the data, and any compensatory measures adopted may be taken into consideration;

41. Billi kull persuna għandha tkun tista’ teżerċita id-dritt ta’ aċċess għal data dwarha li tkun qed tiġi pproċessata, biex tivverifika partikolarment l-eżatezza tad-data jekk l-ipproċessar ikunx skond il-liġi; billi, għall-istess raġunijiet, kull persuna li tkun suġġett tad-data għandha wkoll ikollha d-dritt li tkun taf ir-raġuni għall-ipproċessar awtomatiku ta’ data li jkollha x’taqsam miegħu, għall-inqas fil-każ tad-deċiżjonijiet awtomatizzati msemmija fl-Artikolu 15(1); billi dan id-dritt m’għandux jaffettwa ħażin sigrieti tal-kummerċ jew ta’ proprjetà intelletwali u partikolarment id-dritt ta’ l-awtur li jipproteġi s-software; billi dawn il-konsiderazzjonijiet m’għandhomx, iżda, jċaħħdu lis-suġġett tad-data milli jingħata l-informazzjoni kollha;

(41) Whereas any person must be able to exercise the right of access to data relating to him which are being processed, in order to verify in particular the accuracy of the data and the lawfulness of the processing; whereas, for the same reasons, every data subject must also have the right to know the logic involved in the automatic processing of data concerning him, at least in the case of the automated decisions referred to in Article 15 (1); whereas this right must not adversely affect trade secrets or intellectual property and in particular the copyright protecting the software; whereas these considerations must not, however, result in the data subject being refused all information;

42. Billi Stati Membri jistgħu, fl-interess tas-suġġett tad-data jew biex jipproteġu d-drittijiet u l-libertajiet ta’ oħrajn, jillimitaw id-drittijiet ta’ aċċess u informazzjoni; billi huma jistgħu, per eżempju, jispeċifikaw li aċċess għal data medika jista’ jingħata biss minn professjonista mediku;

(42) Whereas Member States may, in the interest of the data subject or so as to protect the rights and freedoms of others, restrict rights of access and information; whereas they may, for example, specify that access to medical data may be obtained only through a health professional;

43. Billi restrizzjonijiet dwar id-drittijiet ta’ aċċess u informazzjoni u ċerti obbligazzjonijiet tal-kontrollur jistgħu bl-istess mod ikunu imposti minn Stati Membri jekk ikunu meħtieġa biex jipproteġu, per eżempju, is-sigurtà nazzjonali, id-difiża, is-sigurtà pubblika, jew interessi ekonomiċi jew finanzjarji ta’ importanza ta’ Stat Membru jew ta’ l-Unjoni, kif ukoll investigazzjonijiet kriminali u prosekuzzjonijiet u proċeduri dwar ksur ta’ etika fil-professjonijiet regolati; billi l-lista ta’ eċċezzjonijiet u limitazzjonijiet għandha tinkludi xogħol ta’ sorveljanza, spezzjoni jew regolamenti meħtieġa f’dan l-aħħar tlett oqsma msemmija dwar sigurtà pubblika, interessi ekonomiċi u finanzjarji u prevenzjoni ta’ reati; billi l-listi ta’ xogħlijiet f’dawn it-tlett oqsma ma jaffettwawx il-leġittimità ta’ eċċezzjonijiet jew restrizzjonijiet għal raġunijiet ta’ sigurtà jew difiża ta’ l-Istat;

(43) Whereas restrictions on the rights of access and information and on certain obligations of the controller may similarly be imposed by Member States in so far as they are necessary to safeguard, for example, national security, defence, public safety, or important economic or financial interests of a Member State or the Union, as well as criminal investigations and prosecutions and action in respect of breaches of ethics in the regulated professions; whereas the list of exceptions and limitations should include the tasks of monitoring, inspection or regulation necessary in the three last-mentioned areas concerning public security, economic or financial interests and crime prevention; whereas the listing of tasks in these three areas does not affect the legitimacy of exceptions or restrictions for reasons of State security or defence;

44. Billi Stati Membri jistgħu wkoll ikunu jridu, bis-saħħa tad-dispożizzjonijiet ta’ liġijiet tal-Komunità, li jidderogaw mid-dispożizzjonijiet ta’ din id-Direttiva dwar id-dritt ta’ aċċess, l-obbligazzjoni li jgħarrfu lil individwi, u l-kwalità tad-data, sabiex jiggarantixxu uħud mill-finijiet imsemmija hawn fuq;

(44) Whereas Member States may also be led, by virtue of the provisions of Community law, to derogate from the provisions of this Directive concerning the right of access, the obligation to inform individuals, and the quality of data, in order to secure certain of the purposes referred to above;

45. Billi, fil-każijiet meta d-data tista’ tkun ipproċessata skond il-liġi fuq il-bażi ta’ interess pubbliku, awtorità pubblika jew interessi leġittimi ta’ persuna naturali jew ġuridika, kull suġġett tad-data għandu, iżda, jkun intitolat, għal raġuni leġittima u qawwija fl-interess tas-sitwazzjoni partikolari tiegħu, li jagħmel oġġezzjoni għall-ipproċessar ta’ data dwaru; billi Stati Membri jistgħu, iżda, jistabbilixxu dispożizzjonijiet nazzjonali kontrarji;

(45) Whereas, in cases where data might lawfully be processed on grounds of public interest, official authority or the legitimate interests of a natural or legal person, any data subject should nevertheless be entitled, on legitimate and compelling grounds relating to his particular situation, to object to the processing of any data relating to himself; whereas Member States may nevertheless lay down national provisions to the contrary;

46. Billi l-protezzjoni tad-drittijiet u l-libertajiet ta’ suġġetti tad-data għall-ipproċessar ta’ data personali teħtieġ li jittieħdu miżuri tekniċi u ta’ organizzazzjoni xierqa, kemm meta d-disinn tas-sistema ta’ l-ipproċessar ikun qed isir, kemm waqt l-ipproċessar innifsu, partikolarment biex tinżamm is-sigurtà u għalhekk ma jkunx hemm ipproċessar mhux awtoriżżat; billi hija r-responsabbiltà ta’ l-Istati Membri li jassiguraw li l-kontrolluri iħarsu dawn il-miżuri; billi dawn il-miżuri għandhom jassiguraw livell xieraq ta’ sigurtà, meħud kont l-iktar teknika avvanzata u l-ispejjeż għall-implimentazzjoni tagħhom għar-riskji li jkun hemm fl-ipproċessar u n-natura tad-data li għandha tkun protetta;

(46) Whereas the protection of the rights and freedoms of data subjects with regard to the processing of personal data requires that appropriate technical and organizational measures be taken, both at the time of the design of the processing system and at the time of the processing itself, particularly in order to maintain security and thereby to prevent any unauthorized processing; whereas it is incumbent on the Member States to ensure that controllers comply with these measures; whereas these measures must ensure an appropriate level of security, taking into account the state of the art and the costs of their implementation in relation to the risks inherent in the processing and the nature of the data to be protected;

47. Billi meta messaġġ li jkollu data personali jiġi trasmess permezz ta’ telekomunikazzjonijiet jew servizz ta’ posta elettronika, li l-għan waħdieni tagħhom huwa t-trasmissjoni ta’ dawk il-messaġġi, il-kontrollur għandu normalment jitqies, għall-fini tad-data personali li tkun tinsab fil-messaġġ, bħala l-persuna li mingħandu l-messaġġ ikollu l-bidu tiegħu, minflok il-persuna li toffri s-servizzi ta’ trasmissjoni; billi, iżda, dawk li joffru dawk is-servizzi għandhom normalment jitqiesu bħala kontrolluri dwar l-ipproċessar ta’ data personali addizzjonali meħtieġ biex is-servizz jitħaddem;

(47) Whereas where a message containing personal data is transmitted by means of a telecommunications or electronic mail service, the sole purpose of which is the transmission of such messages, the controller in respect of the personal data contained in the message will normally be considered to be the person from whom the message originates, rather than the person offering the transmission services; whereas, nevertheless, those offering such services will normally be considered controllers in respect of the processing of the additional personal data necessary for the operation of the service;

48. Billi l-proċeduri biex tkun notifikata l-awtorità ta’ superviżjoni huma maħsuba b’mod li jassiguraw li jkunu żvelati l-għanijiet u l-fatturi ewlenin ta’ operazzjoni ta’ proċessar biex ikun verifikat li l-operazzjonijiet ikunu jaqblu mal-miżuri nazzjonali meħuda skond din id-Direttiva;

(48) Whereas the procedures for notifying the supervisory authority are designed to ensure disclosure of the purposes and main features of any processing operation for the purpose of verification that the operation is in accordance with the national measures taken under this Directive;

49. Billi, biex ma jkunx hemm formalitajiet amministrattivi barra minn lokhom, eżenzjoni mill-obbligazzjoni ta’ notifika u simplifikazzjoni tan-notifika meħtieġa jistgħu ikunu provduti mill-Istati Membri f’każi meta l-ipproċessar aktarx li ma jkollux effett ħażin fuq id-drittijiet u l-libertajiet tas-suġġett tad-data, iżda li dan ikun skond il-miżuri meħuda minn Stat Membru li jispeċifikaw il-limiti tagħhom; billi eżenzjoni jew simplifikazzjoni tista’ wkoll tkun stabbilita minn Stati Membri meta persuna maħtura mill-kontrollur tassigura li meta jsir l-ipproċessar dan ma jkollox effett ħażin fuq id-drittijiet u l-libertajiet tas-suġġett tad-data; billi dan l-uffiċjal tal-protezzjoni tad-data, kemm jekk ikun impjegat tal-kontrollur u kemm jekk ma jkunx, għandu jkun f’pożizzjoni li jeżerċita l-funzjonijiet tiegħu b’indipendenza sħiħa;

(49) Whereas, in order to avoid unsuitable administrative formalities, exemptions from the obligation to notify and simplification of the notification required may be provided for by Member States in cases where processing is unlikely adversely to affect the rights and freedoms of data subjects, provided that it is in accordance with a measure taken by a Member State specifying its limits; whereas exemption or simplification may similarly be provided for by Member States where a person appointed by the controller ensures that the processing carried out is not likely adversely to affect the rights and freedoms of data subjects; whereas such a data protection official, whether or not an employee of the controller, must be in a position to exercise his functions in complete independence;

50. Billi eżenzjoni jew simplifikazzjoni tista’ tkun provduta fil-każi ta’ operazzjonijiet ta’ ipproċessar li l-iskop waħdieni tiegħu ikun iż-żamma ta’ reġistru maħsub, skond il-liġi nazzjonali, li jagħti informazzjoni lill-pubbliku u li jkun miftuħ għal konsultazzjoni mill-pubbliku jew minn persuna li turi interess leġittimu;

(50) Whereas exemption or simplification could be provided for in cases of processing operations whose sole purpose is the keeping of a register intended, according to national law, to provide information to the public and open to consultation by the public or by any person demonstrating a legitimate interest;

51. Billi, iżda, simplifikazzjoni jew eżenzjoni mill-obbligazzjoni li jkun hemm notifika m’għandhiex teħles lill-kontrollur mill-obbligazzjonijiet l-oħra li jinsabu f’din id-Direttiva;

(51) Whereas, nevertheless, simplification or exemption from the obligation to notify shall not release the controller from any of the other obligations resulting from this Directive;

52. Billi, f’dan il-kuntest, verifika ex post facto mill-awtoritajiet kompetenti għandha ġeneralment titqies bħala miżura suffiċjenti;

(52) Whereas, in this context, ex post facto verification by the competent authorities must in general be considered a sufficient measure;

53. Billi, iżda, ċerti operazzjonijiet ta’ ipproċessar aktarx li joħolqu riskji partikolari għad-drittijiet u l-libertajiet tas-suġġett tad-data minħabba n-natura tagħhom, l-iskop tagħhom jew il-miri tagħhom, bħalma huwa dak li jeskludi individwi minn xi dritt, benefiċċju jew kuntratt, jew minħabba l-użu speċifiku ta’ teknoloġiji ġodda; billi huma l-Istati Membri, li jispeċifikaw, jekk huma jkunu jridu, dawk ir-riskji fil-liġijiet tagħhom;

(53) Whereas, however, certain processing operation are likely to pose specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, such as that of excluding individuals from a right, benefit or a contract, or by virtue of the specific use of new technologies; whereas it is for Member States, if they so wish, to specify such risks in their legislation;

54. Billi dwar l-ipproċessar kollu magħmul fis-soċjetà, l-ammont li jista’ jġib miegħu dawn ir-riskji partikolari għandu jkun limitat ħafna; billi Stati Membri għandhom jipprovdu li l-awtorità ta’ superviżjoni jew l-uffiċjal ta’ protezzjoni tad-data, b’kooperazzjoni ma’ l-awtorità, jivverifikaw dak l-ipproċessar qabel ma jsir; billi wara din il-verifika minn qabel, l-awtorità ta’ superviżjoni tista’, skond il-liġi nazzjonali tagħha, tagħti opinjoni jew awtorizzazzjoni dwar l-ipproċessar; billi din il-verifika tista’ wkoll issir waqt it-tħejjija ta’ miżura tal-Parlament nazzjonali jew ta’ miżura msejsa fuq miżura leġislattiva bħal dik, li jkollha definizzjoni tan-natura ta’ l-ipproċessar u li tistabbilixxi protezzjoni xierqa;

(54) Whereas with regard to all the processing undertaken in society, the amount posing such specific risks should be very limited; whereas Member States must provide that the supervisory authority, or the data protection official in cooperation with the authority, check such processing prior to it being carried out; whereas following this prior check, the supervisory authority may, according to its national law, give an opinion or an authorization regarding the processing; whereas such checking may equally take place in the course of the preparation either of a measure of the national parliament or of a measure based on such a legislative measure, which defines the nature of the processing and lays down appropriate safeguards;

55. Billi, jekk il-kontrollur jonqos milli jirrispetta d-drittijiet tas-suġġett tad-data, il-liġi nazzjonali għandha tipprovdi rimedju ġuridiku; billi persuna li ssofri ħsara minħabba ipproċessar illegali għandha tingħata kumpens mill-kontrollur, li jista’ jkun meħlus minn dan l-obbligu jekk iġib prova li ma kienx responsabbli għal ħsara, partikolarment f’każ li hu jistabilixxi li s-suġġett tad-data kellu ħtija jew f’każ ta’ forza maġġuri; billi għandu jkun hemm sanzjoni għal kull persuna, kemm taħt il-liġi privata u dik pubblika, li tonqos milli tħares il-miżuri nazzjonali meħuda b’din id-Direttiva;

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

56. Billi t-tixrid ta’ data personali minn naħa għal oħra tal-fruntieri huma meħtieġ biex il-kummerċ internazzjonali jikber; billi l-protezzjoni ta’ l-individwu garantita fil-Komunità b’din id-Direttiva ma tfixkilx it-trasferiment ta’ data personali lil pajjiżi terzi li jassiguraw livell tajjeb ta’ protezzjoni; billi dan il-livell tajjeb ta’ protezzjoni mogħoti minn pajjiż terz għandu jkun eżaminat fid-dawl taċ-ċirkostanzi kollha li għandhom x’jaqsmu ma’ operazzjoni ta’ trasferiment jew ma’ għadd ta’ operazzjonijiet ta’ trasferiment;

(56) Whereas cross-border flows of personal data are necessary to the expansion of international trade; whereas the protection of individuals guaranteed in the Community by this Directive does not stand in the way of transfers of personal data to third countries which ensure an adequate level of protection; whereas the adequacy of the level of protection afforded by a third country must be assessed in the light of all the circumstances surrounding the transfer operation or set of transfer operations;

57. Billi, minn naħa l-oħra, m’għandux jitħalla jsir it-trasferiment ta’ data personali lil pajjiż terz li ma jassigurax livell tajjeb ta’ protezzjoni;

(57) Whereas, on the other hand, the transfer of personal data to a third country which does not ensure an adequate level of protection must be prohibited;

58. Billi għandu jkun hemm dispożizzjonijiet għal eżenzjonijiet minn din il-projbizzjoni f’ċerti ċirkostanzi meta s-suġġett tad-data jkun ta’ l-kunsens tiegħu, meta t-trasferiment ikun meħtieġ dwar kuntratt jew talba legali, meta tkun meħtieġa l-protezzjoni ta’ interess pubbliku ta’ importanza, per eżempju f’każi ta’ trasferimenti internazzjonali ta’ data bejn amministrazzjonijiet fiskali jew doganali jew bejn servizzi kompetenti għal affarijiet ta’ sigurtà soċjali, jew meta t-trasferiment ikun sar minn reġistru stabbilit b’liġi u maħsub biex il-pubbliku jew persuni li jkollhom interess leġittimu jikkonsultawh; billi f’dan il-każ dan it-trasferiment m’għandux jinkludi d-data kollha jew il-kategoriji kollha tad-data li tkun tinsab fir-reġistru u, meta r-reġistru jkun maħsub biex persuni li jkollhom interess leġittimu jikkonsultawh, it-trasferiment għandu jsir biss fuq it-talba ta’ dawk il-persuni jew jekk huma ser ikunu r-riċevituri;

(58) Whereas provisions should be made for exemptions from this prohibition in certain circumstances where the data subject has given his consent, where the transfer is necessary in relation to a contract or a legal claim, where protection of an important public interest so requires, for example in cases of international transfers of data between tax or customs administrations or between services competent for social security matters, or where the transfer is made from a register established by law and intended for consultation by the public or persons having a legitimate interest; whereas in this case such a transfer should not involve the entirety of the data or entire categories of the data contained in the register and, when the register is intended for consultation by persons having a legitimate interest, the transfer should be made only at the request of those persons or if they are to be the recipients;

59. Billi jistgħu jittieħdu miżuri partikolari bħala kumpens għal nuqqas ta’ protezzjoni f’pajjiż terz f’każi meta l-kontrollur joffri protezzjoni xierqa; billi, wkoll, għandhom ikunu stabbiliti l-proċeduri għal negozjati bejn il-Komunità u dawk il-pajjiżi terzi;

(59) Whereas particular measures may be taken to compensate for the lack of protection in a third country in cases where the controller offers appropriate safeguards; whereas, moreover, provision must be made for procedures for negotiations between the Community and such third countries;

60. Billi, fi kwalunkwe każ, trasferimenti lil pajjiżi terzi jistgħu jsiru biss bi qbil sħiħ mad-dispożizzjonijiet adottati mill-Istati Membri skond din id-Direttiva, u partikolarment l-Artikolu 8 tagħha;

(60) Whereas, in any event, transfers to third countries may be effected only in full compliance with the provisions adopted by the Member States pursuant to this Directive, and in particular Article 8 thereof;

61. Billi Stati Membri u l-Kummissjoni, fil-qasam partikolari tagħhom ta’ kompetenza, għandhom jinkoraġġixxu lil għaqdiet tal-kummerċ u organizzazzjonijiet rappreżentattivi oħra interessati biex iħejju kodiċijiet ta’ kondotta biex iħaffu l-applikazzjoni ta’ din id-Direttiva, meħud kont tal-karatteristiċi speċifiċi ta’ l-ipproċessar magħmul f’ċerti setturi, u f’dak li għandu x’jaqsam mad-dispożizzjonijiet nazzjonali adottati għal l-implimentazzjoni tagħha;

(61) Whereas Member States and the Commission, in their respective spheres of competence, must encourage the trade associations and other representative organizations concerned to draw up codes of conduct so as to facilitate the application of this Directive, taking account of the specific characteristics of the processing carried out in certain sectors, and respecting the national provisions adopted for its implementation;

62. Billi t-twaqqif fi Stati Membri ta’ awtoritajiet ta’ superviżjoni, li jeżerċitaw il-funzjonijiet tagħhom b’independenza sħiħa, huwa kondizzjoni essenzjali għall-protezzjoni ta’ individwi fl-ipproċessar ta’ data personali;

(62) Whereas the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of personal data;

63. Billi dawk l-awtoritajiet għandu jkollhom il-mezzi meħtieġa biex iwettqu d-doveri tagħhom, magħduda setgħat ta’ investigazzjoni u intervent, partikolarment f’każi ta’ lmenti minn individwi, u setgħat li jibdew proċeduri legali; billi dawn l-awtoritajiet għandhom jgħinu biex tkun assigurata t-trasparenza ta’ l-ipproċessar fl-Istati Membri li fil-ġurisdizzjoni tagħhom huma jkunu jinsabu;

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, and powers to engage in legal proceedings; whereas such authorities must help to ensure transparency of processing in the Member States within whose jurisdiction they fall;

64. Billi l-awtoritajiet fid-diversi Stati Membri jkunu jeħtieġu li jgħinu lil xulxin fit-twettiq tad-doveri tagħhom biex jassiguraw li r-regoli ta’ protezzjoni jkunu rispettati kif jixraq fl-Unjoni Ewropea kollha;

(64) Whereas the authorities in the different Member States will need to assist one another in performing their duties so as to ensure that the rules of protection are properly respected throughout the European Union;

65. Billi, fuq il-livell tal-Komunità, għandu jkun hemm Grupp ta’ Ħidma dwar il-Protezzjoni ta’ Individwi fl-Ipproċessar ta’ Data Personali, u li jkun indipendenti għal kollox fit-twettiq tal-funzjonijiet tiegħu; billi, meħud kont tan-natura speċifika tiegħu, dan għandu jagħti pariri lill-Kummissjoni u, partikolarment, jaghti sehmu għall-applikazzjoni uniformi tar-regoli nazzjonali skond din id-Direttiva;

(65) Whereas, at Community level, a Working Party on the Protection of Individuals with regard to the Processing of Personal Data must be set up and be completely independent in the performance of its functions; whereas, having regard to its specific nature, it must advise the Commission and, in particular, contribute to the uniform application of the national rules adopted pursuant to this Directive;

66. Billi, dwar it-trasferiment ta’ data lil pajjiżi terzi, għall-applikazzjoni ta’ din id-Direttiva jeħtieġ li l-Kummissjoni tingħata setgħat ta’ implimentazzjoni u tkun stabbilita proċedura kif imsemmi fid-Direttiva tal-Kunsill 87/373/KEE [4];

(66) Whereas, with regard to the transfer of data to third countries, the application of this Directive calls for the conferment of powers of implementation on the Commission and the establishment of a procedure as laid down in Council Decision 87/373/EEC (1);

67. Billi kien intlaħaq ftehim fl-20 ta’ Diċembru, 1994, dwar modus vivendi bejn il-Parlament Ewropew, il-Kunsill u l-Kummissjoni dwar il-miżuri ta’ implimentazzjoni għal atti adottati skond il-proċedura msemmija fl-Artikolu 189b tat-Trattat tal-Komunità Ewropea;

(67) Whereas an agreement on a modus vivendi between the European Parliament, the Council and the Commission concerning the implementing measures for acts adopted in accordance with the procedure laid down in Article 189b of the EC Treaty was reached on 20 December 1994;

68. Billi l-prinċipji stabbiliti b’din id-Direttiva dwar il-protezzjoni tad-drittijiet u l-libertajiet ta’ individwi, l-iktar id-dritt għall-ħajja privata, f’dak li għandu x’jaqsam ma’ l-ipproċessar ta’ data personali, jista’ jingħatalhom suppliment jew kjarifika, partikolarment safejn għandhom x’jaqsmu ċerti setturi, b’regoli speċifiċi imsejsa fuq dawk il-prinċipji;

(68) Whereas the principles set out in this Directive regarding the protection of the rights and freedoms of individuals, notably their right to privacy, with regard to the processing of personal data may be supplemented or clarified, in particular as far as certain sectors are concerned, by specific rules based on those principles;

69. Billi Stati Membri għandhom jingħataw perjodu ta’ mhux iktar minn tlett snin mid-dħul fis-seħħ tal-miżuri nazzjonali għall-adozzjoni ta’ din id-Direttiva, biex japplikaw progressivament dawk ir-regoli nazzjonali ġodda għall-operazzjonijiet kollha ta’ ipproċessar li jkunu diġa inbdew; billi, sabiex titħaffef l-implimentazzjoni tagħhom bi spejjeż mill-inqas, Stati Membri għandhom jingħataw perjodu ieħor li jagħlaq 12-il sena wara d-data li fiha din id-Direttiva tkun ġiet adottata biex jassiguraw li l-iskedar manwali eżistenti jkun skond ċerti dispożizzjonijiet tad-Direttiva; billi, fejn data li tkun tinsab f’dawk is-sistemi ta’ skedar tkun pproċessata manwalment matul l-estensjoni ta’ dan il-perijodu, dawk is-sistemi għandhom ikunu skond id-dispożizzjonijiet meta jkun qed isir dak l-ipproċessar;

(69) Whereas Member States should be allowed a period of not more than three years from the entry into force of the national measures transposing this Directive in which to apply such new national rules progressively to all processing operations already under way; whereas, in order to facilitate their cost-effective implementation, a further period expiring 12 years after the date on which this Directive is adopted will be allowed to Member States to ensure the conformity of existing manual filing systems with certain of the Directive's provisions; whereas, where data contained in such filing systems are manually processed during this extended transition period, those systems must be brought into conformity with these provisions at the time of such processing;

70. Billi mhux meħtieġ li s-suġġett tad-data jerġa’ jagħti l-kunsens tiegħu biex il-kontrollur ikollu permess ikompli, wara li d-dispożizzjonijiet nazzjonali skond din id-Direttiva jidħlu fis-seħħ, jipproċessa kull data sensittiva meħtieġa biex isir kuntratt miftiehem bil-kunsens liberu u infurmat qabel id-dħul fis-seħħ ta’ dawn id-dispożizzjonijiet;

(70) Whereas it is not necessary for the data subject to give his consent again so as to allow the controller to continue to process, after the national provisions taken pursuant to this Directive enter into force, any sensitive data necessary for the performance of a contract concluded on the basis of free and informed consent before the entry into force of these provisions;

71. Billi din id-Direttiva mhix ta’ xkiel għal Stat Membru li jagħmel regolamenti dwar atti tal-kummerċ fl-interess ta’ konsumaturi li jkollhom ir-residenza tagħhom fit-territorju, iżda li dawk ir-regolamenti ma jkollhomx x’jaqsmu mal-protezzjoni ta’ individwi dwar l-ipproċessar ta’ data personali;

(71) Whereas this Directive does not stand in the way of a Member State's regulating marketing activities aimed at consumers residing in territory in so far as such regulation does not concern the protection of individuals with regard to the processing of personal data;

72. Billi din id-Direttiva tippermetti li meta jkunu implimentati il-prinċipji msemmija f’din id-Direttiva jittieħed kont tal-prinċipju ta’ aċċess pubbliku għal dokumenti uffiċjali,

(72) Whereas this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive,

ADOTTAW DIN ID-DIRETTIVA:

HAVE ADOPTED THIS DIRECTIVE:

Il-KAPITOLU I

DISPOSIZZJONIJIET ĠENERALI

L-Artikolu 1

CHAPTER I GENERAL PROVISIONS

Għan tad-Direttiva

1. Skond din id-Direttiva, Stati Membri għandhom jipproteġu d-drittijiet fundamentali u l-libertajiet ta’ persuna naturali, u partikolarment tad-dritt tagħhom għall-ħajja privata dwar l-ipproċessar ta’ data personali.

Article 1

2. Stati Membri m’għandhomx jirrestrinġu jew jipprojbixxu it-tixrid ħieles ta’ data personali bejn Stati Membri għal raġunijiet li jkollhom x’jaqsmu mal-protezzjoni mogħtija fil-paragrafu 1.

Object of the Directive

L-Artikolu 2

1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.

Definizzjonijiet

2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.

Għall-finijiet ta’ din id-Direttiva:

(a) "data personali" tfisser kull data li jkollha x’taqsam ma’ persuna naturali identifikata jew identifikabbli ("suġġett tad-data"); persuna identifikabbli huwa min jista’ jkun identifikat, direttament jew indirettament, partikolarment b’referenza għal numru ta’ identità jew għal fattur wieħed speċifiku jew aktar dwar l-identità fiżika, fiżjoloġika, mentali, ekonomika, kulturali jew soċjali tiegħu;

Article 2

(b) "ipproċessar ta’ data personali" ("ipproċessar") tfisser kull operazzjoni jew sett ta’ operazzjonijiet li jsiru fuq data personali, b’mezzi awtomatiċi jew mingħajrhom, bħalma huma l-ġbir, reġistrazzjoni, organizzazzjoni, ħażna, adattament jew bdil, rkupru, konsultazzjoni, użu, żvelar bi trasmissjoni, tixrid jew li xort’oħra jagħmlu l-ipproċessar disponibbli jew li jġibu allineament, taħlita, imblokk, tħassir jew distruzzjoni;

Definitions

(ċ) "sistema ta’ ħażna ta’ data personali" (‘sistema ta’ ħażna’) tfisser sett strutturat ta’ data personali li jkun aċċessibbli skond kriterji speċifiċi, kemm jekk ċentraliżżat, di-ċentraliżżat jew imferrex fuq bażi funzjonali jew ġeografika;

For the purposes of this Directive:

(d) "kontrollur" tfisser persuna naturali jew ġuridika, awtorità pubblika, aġenzija jew korp ieħor li waħdu jew flimkien ma’ oħrajn jiddetermina l-finijiet u l-mezzi ta’ l-ipproċessar ta’ data personali; meta l-finijiet u l-mezzi ta’ l-ipproċessar ikunu determinati minn liġijiet jew regolamenti nazzjonali jew tal-Komunità, il-kontrollur jew il-kriterji speċifiċi għan-nomina tiegħu jistgħu jkunu stabbiliti b’liġijiet nazzjonali jew tal-Komunità;

(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(e) "proċessur" tfisser persuna naturali jew ġuridika, awtorità pubblika, aġenzija jew korp ieħor li jipproċessa data personali f’isem il-kontrollur;

(b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(f) "parti terza" tfisser persuna naturali jew ġuridika, awtorità pubblika, aġenzija jew korp ieħor li ma jkunx is-suġġett tad-data, il-kontrollur, il-proċessur u l-persuna li, taħt l-awtorità diretta tal-kontrollur jew tal-proċessur, ikunu awtorizzati li jipproċessaw id-data;

(c) 'personal data filing system' ('filing system') shall mean any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis;

(g) "riċevitur" tfisser persuna naturali jew ġuridika, awtorità pubblika, aġenzija jew korp ieħor li lilha jkun żvelat data, kemm jekk tkun parti terza u wkoll jekk ma tkunx; iżda awtoritajiet li jistgħu jirċievu data fil-kuntest ta’ inkjesta partikolari m’għandhomx jitqiesu bħala riċevituri;

(d) 'controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;

(h) "il-kunsens tas-suġġett tad-data" tfisser indikazzjoni speċifika u infurmata tax-xewqa tiegħu mogħtija liberament li biha s-suġġett tad-data jaqbel li jsir l-ipproċessar ta’ data personali dwaru.

(e) 'processor' shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;

L-Artikolu 3

(f) 'third party' shall mean any natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process the data;

Skop

(g) 'recipient' shall mean a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a particular inquiry shall not be regarded as recipients;

1. Din id-Direttiva għandha tkun applikabbli għall-ipproċessar ta’ data personali fl-intier tiegħu jew parti minnu b’mezzi awtomatiċi, u għall-ipproċessar b’mezzi oħra mhux awtomatiċi ta’ data personali li tagħmel parti minn sistema ta’ skedar jew li tkun maħsuba li tagħmel parti minn sistema ta’ skedar.

(h) 'the data subject's consent' shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.

2. Din id-Direttiva m’għandhiex tapplika għall-ipproċessar ta’ data personali:

- fil-kors ta’ attività li ma tkunx skond il-finijiet ta’ liġi tal-Komunità, bħalma huma dawk provduti fit-Titoli V u VI tat-Trattat dwar l-Unjoni Ewropea, u fi kwalunkwe każ għal operazzjonijiet ta’ ipproċessar dwar sigurtà pubblika, difiża, sigurtà ta’ l-Istat (magħdud il-ġid ekonomiku ta’ l-Istat meta l-operazzjoni ta’ l-ipproċessar tkun dwar materji ta’ sigurtà ta’ l-Istat) u l-attivitajiet ta’ l-Istat fl-oqsma tal-liġi kriminali,

Article 3

- minn persuna naturali meta fil-kors ta’ attività purament personali jew domestika.

Scope

L-Artikolu 4

1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

Il-Liġi nazzjonali applikabbli

2. This Directive shall not apply to the processing of personal data:

1. Kull Stat Membru għandu japplika d-dispożizzjonijiet nazzjonali li hu jadotta skond din id-Direttiva għall-ipproċessar ta’ data personali meta:

- in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,

(a) l-ipproċessar isir fil-kuntest ta’ l-attivitajiet ta’ stabbiliment tal-kontrollur fit-territorju ta’ l-Istat Membru; meta l-istess kontrollur ikun stabbilit fit-territorju ta’ diversi Stati Membri, hu għandu jieħu l-miżuri meħtieġa biex jassigura li kull wieħed minn dawk l-istabbilimenti jkunu konformi ta’ l-obbligazzjonijiet meħtieġa mill-liġi nazzjonali li tkun tapplika;

- by a natural person in the course of a purely personal or household activity.

(b) il-kontrollur ma jkunx stabbilit fit-territorju ta’ l-Istat Membru, imma f’post fejn il-liġi nazzjonali ta’ dak l-Istat tkun tapplika skond il-liġi pubblika internazzjonali;

(ċ) il-kontrollur ma jkunx stabbilit fit-territorju tal-Komunità u, għall-finijiet ta’ l-ipproċessar ta’ data personali jagħmel użu minn tagħmir, awtomatizzat jew xort’oħra, li jkun jinsab fit-territorju ta’ l-imsemmi Stat Membru, sakemm dak it-tagħmir jintuża biss għal għanijiet ta’ trasmissjoni fit-territorju tal-Komunità.

Article 4

2. Fiċ-ċirkostanzi msemmija fil-paragrafu 1 (ċ), il-kontrollur għandu jinnomina rappreżentant stabbilit fit-territorju ta’ dak l-Istat Membru, bla ħsara għal azzjonijiet legali li jistgħu jinbdew kontra l-kontrollur innifsu.

National law applicable

Il-KAPITOLU II

1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:

REGOLI ĠENERALI DWAR IL-LEGALITÀ TA’ L-IPPROĊESSAR TA’ DATA PERSONALI

(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;

L-Artikolu 5

(b) the controller is not established on the Member State's territory, but in a place where its national law applies by virtue of international public law;

Stati Membri għandhom, fil-limiti tad-dispożizzjonijiet ta’ dan il-Kapitolu, jistabbilixxu b’iktar preċiżjoni il-kondizzjonijiet li bihom l-ipproċessar ta’ data personali jkun skond il-liġi.

(c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.

TAQSIMA I

2. In the circumstances referred to in paragraph 1 (c), the controller must designate a representative established in the territory of that Member State, without prejudice to legal actions which could be initiated against the controller himself.

PRINĊIPJI DWAR IL-KWALITÀ TAD-DATA

L-Artikolu 6

CHAPTER II GENERAL RULES ON THE LAWFULNESS OF THE PROCESSING OF PERSONAL DATA

1. Stati Membri għandhom jipprovdu li data personali għandu jkun:

(a) ipproċessat b’mod ġust u skond il-liġi;

Article 5

(b) miġbur għal finijiet speċifiċi, espliċiti u leġittimi u mhux ipproċessat aktar b’mod li ma jkunx kompatibbli ma dawk il-finijiet. Ippoċessar iktar ta’ data għal finijiet storiċi, ta’ statistika jew xjentifiċi m’għandux jitqies bħala inkompatibbli sakemm dak l-Istat Membru jagħti protezzjoni xierqa;

Member States shall, within the limits of the provisions of this Chapter, determine more precisely the conditions under which the processing of personal data is lawful.

(ċ) adekwat, rilevanti u mhux eċċessiv għall-finijiet li għalih jinġab u/jew jiġi iktar ipproċessat;

SECTION I

(d) eżatt u, fejn meħtieġ, jinżamm aġġornat; għandu jsir dak kollu raġjonevoli biex ikun assigurat li data li ma tkunx eżatta jew mhux kompleta, meħud kont tal-finijiet li għalihom kien inġabar jew li għalihom ikun sar iktar ipproċessar, jitħassar jew jissewwa;

PRINCIPLES RELATING TO DATA QUALITY

(e) miżmum b’mod li jippermetti l-identifikazzjoni tas-suġġetti tad-data għal mhux iktar milli jkun meħtieġ għall-finijiet li għalihom id-data tkun inġabret jew li għalihom tkun iktar ipproċessata. Stati Membri għandhom jistabbilixxu protezzjoni xierqa għal data personali maħżuna għal perijodi itwal għal użu storiku, ta’ statistika jew xjentifiku.

2. Għandu jkun il-kontrollur li jassigura konformità mal-paragrafu 1.

Article 6

TAQSIMA II

1. Member States shall provide that personal data must be:

KRITERJI BIEX L-IPPROĊESSAR TA’ DATA JKUN LEĠITTIMU

(a) processed fairly and lawfully;

L-Artikolu 7

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;

Stati Membri għandhom jipprovdu li data personali jista’ jkun ipproċessat biss jekk:

(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;

(a) is-suġġett tad-data jkun ta l-kunsens tiegħu b’mod ċar; jew

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;

(b) l-ipproċessar ikun meħtieġ biex isir kuntratt li tiegħu s-suġġett tad-data jkun parti jew biex jittieħdu passi fuq talba tas-suġġett tad-data qabel ma jagħmel kuntratt; jew

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.

(ċ) l-ipproċessar ikun meħtieġ biex titħares obbligazzjoni legali li s-suġġett tagħha jkun il-kontrollur; jew

2. It shall be for the controller to ensure that paragraph 1 is complied with.

(d) l-ipproċessar ikun meħtieġ biex jipproteġi l-interessi vitali tas-suġġett tad-data; jew

SECTION II

(e) l-ipproċessar ikun meħtieġ biex isir ħidma fl-interess pubbliku jew fl-eżerċizzju ta’ awtorità pubblika vestita fil-kontrollur jew f’parti terza li lilha jkun żvelat id-data; jew

CRITERIA FOR MAKING DATA PROCESSING LEGITIMATE

(f) l-ipproċessar ikun meħtieġ għall-finijiet ta’ l-interessi leġittimi li jkollu l-kontrollur jew il-parti terza jew il-partijiet li lilhom ikun żvelat id-data, ħlief meta dawk l-interessi jiġu wara l-interessi ta’ drittijiet u libertajiet fundamentali tas-suġġett tad-data li jkun jeħtiġilhom protezzjoni skond l-Artikolu 1(1).

TAQSIMA III

Article 7

KATEGORIJI SPEĊJALI TA’ IPPROĊESSAR

Member States shall provide that personal data may be processed only if:

L-Artikolu 8

(a) the data subject has unambiguously given his consent; or

L-ipproċessar ta’ kategoriji speċjali ta’ data

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

1. Stati Membri għandhom jipprojbixxu l-ipproċessar ta’ data personali li tiżvela l-oriġini razzjali jew etnika, opinjonijiet politiċi, twemmin reliġjuż jew filosofiku, sħubija trade-unjonistika, u l-ipproċessar ta’ data dwar saħħa jew ħajja sesswali.

(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or

2. Il-paragrafu 1 m’għandux japplika fejn:

(d) processing is necessary in order to protect the vital interests of the data subject; or

(a) is-suġġett tad-data jkun ta l-kunsens espliċitu tiegħu għall-ipproċessar ta’ dak id-data, ħlief jekk il-liġijiet ta’ l-Istat Membru jipprovdu li l-projbizzjoni msemmija fil-paragrafu 1 ma tkunx tista’ titneħħa minkejja li s-suġġett tad-data jkun ta l-kunsent tiegħu; jew

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or

(b) l-ipproċessar ikun meħtieġ għall-finijiet tat-twettiq ta’ l-obbligazzjonijiet u d-drittijiet speċifiċi tal-kontrollur fil-qasam tal-liġi ta’ l-impjiegi sakemm dan ikun awtoriżżat mill-liġi nazzjonali li tipprovdi għal protezzjoni adekwata; jew

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).

(ċ) l-ipproċessar ikun meħtieġ biex jipproteġi l-interessi vitali tas-suġġett tad-data jew ta’ xi persuna oħra meta s-suġġett tad-data jkun fiżikament jew legalment inkapaċi li jagħti l-kunsens tiegħu; jew

SECTION III

(d) l-ipproċessar isir fil-kors ta’ l-attivitajiet legittimi tiegħu b’garanziji xierqa minn fondazzjoni, għaqda jew xi korp ieħor li ma jagħmilx profitt b’għanijiet politiċi, filosofiċi, reliġjużi jew trade-unjonistiċi u bil-kondizzjoni li l-ipproċessar ikun biss dwar il-membri tal-korp jew il-persuni li jkollhom kuntatt regulari miegħu b’rabta ma l-għanijiet tiegħu, u li d-data ma tkunx żvelata lil parti terza mingħajr il-kunsens tas-suġġett tad-data, jew

SPECIAL CATEGORIES OF PROCESSING

(e) l-ipproċessar ikun dwar data li b’mod ċar ikun sar pubbliku mis-suġġett tad-data jew li jkun meħtieġ biex ikunu stabbiliti, eżerċitati jew protetti talbiet legali.

3. Il-Paragrafu 1 m’għandux japplika meta l-ipproċessar tad-data jkun meħtieġ għall-għanijiet ta’ mediċina preventiva, dijanjosi medika, l-għoti ta’ kura jew trattament jew l-amministrazzjoni ta’ servizzi tas-saħħa, u meta dak id-data tkun pproċessata minn professjonista tas-saħħa li jkun suġġett skond il-liġijiet nazzjonali jew regoli stabbiliti minn korpi nazzjonali kompetenti għall-obbligazzjoni tas-sigriet professjonali jew minn persuna oħra li wkoll tkun suġġetta għall-istess obbligazzjoni ta’ segretezza.

Article 8

4. Bla ħsara għad-dispożizzjonijiet ta’ protezzjoni xierqa, Stati Membri jistgħu, għall-finijiet ta’ interess pubbliku sostanzjali, jistabbilixxu eżenzjonijiet b’żjieda ma dawk stabbiliti f’Paragrafu 2 permezz ta’ liġi nazzjonali jew b’deċiżjoni ta’ l-awtorità ta’ superviżjoni.

The processing of special categories of data

5. L-ipproċessar ta’ data dwar offiżi, kundanni kriminali jew miżuri ta’ sigurtà jista’ jsir biss taħt il-kontroll ta’ awtorità uffiċjali, jew jekk tkun hemm provduta protezzjoni speċifiċa xierqa taħt il-liġi nazzjonali, skond derogi li jistgħu jingħataw mill-Istat Membru permezz ta’ dispożizzjonijiet nazzjonali li jipprovdu għal protezzjoni speċifiċa xierqa. Iżda reġistru komplut ta’ kundanni kriminali jista’ jinżamm biss taħt il-kontroll ta’ awtorità uffiċjali.

1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

Stati Membri jistgħu jipprovdu li data dwar sanzjonijiet amministrattivi jew sentenzi f’każi ċivili għandhom ukoll ikunu pproċessati taħt il-kontroll ta’ awtorità uffiċjali.

2. Paragraph 1 shall not apply where:

6. Derogi mill-Paragrafu 1 li huma provduti fil-Paragrafi 4 u 5 għandhom ikunu nnotifikati lill-Kummissjoni.

(a) the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject's giving his consent; or

7. Stati Membri għandhom jiddeterminaw il-kondizzjonijiet li bihom numru ta’ identifikazzjoni nazzjonali jew mezz ieħor ta’ identifikazzjoni ta’ applikazzjoni ġenerali jistgħu jkun pproċessati.

(b) processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law in so far as it is authorized by national law providing for adequate safeguards; or

L-Artikolu 9

(c) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consent; or

L-ipproċessar ta’ data personali u libertà ta’ l-espressjoni

(d) processing is carried out in the course of its legitimate activities with appropriate guarantees by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subjects; or

Stati Membri għandhom jipprovdu għal eżenzjonijiet jew derogi mid-dispożizzjonijiet ta’ dan il-Kapitolu, il-Kapitolu IV u l-Kapitolu V dwar l-ipproċessar ta’ data personali magħmul biss għal għanijiet ġurnalistiċi jew għall-iskop ta’ espressjoni artistika jew letterarja jekk dawn ikunu meħtieġa biss biex jirrikonċiljaw id-dritt tal-ħajja parivata mar-regoli li jirregolaw il-libertà ta’ l-espressjoni.

(e) the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims.

TAQSIMA IV

3. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.

INFORMAZJONI LI GĦANDHA TINGĦATA LIS-SUĠĠETT TAD-DATA

4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.

L-Artikolu 10

5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.

Informazzjoni f’każi ta’ ġbir ta’ data mingħand is-suġġet tad-data

Member States may provide that data relating to administrative sanctions or judgements in civil cases shall also be processed under the control of official authority.

Stati Membri għandhom jipprovdu li l-kontrollur jew ir-rappreżentant tiegħu għandhom jagħtu lis-suġġett tad-data li mingħandu tinġabar id-data dwaru nnifsu, għall-inqas bl-informazzjoni li ġejja, ħlief meta huwa jkun diga jaf biha:

6. Derogations from paragraph 1 provided for in paragraphs 4 and 5 shall be notified to the Commission.

(a) l-identità tal-kontrollur jew tar-rappreżentant tiegħu, jekk ikun hemm;

7. Member States shall determine the conditions under which a national identification number or any other identifier of general application may be processed.

(b) l-għanijiet ta’ l-ipproċessar li għalih id-data tkun maħsuba;

(ċ) informazzjoni oħra bħal

Article 9

- ir-riċevituri jew kategoriji ta’ riċevituri tad-data,

Processing of personal data and freedom of expression

- jekk tweġibiet għall-mistoqsijiet ikunux obbligatorji jew voluntarji, kif ukoll dwar x’aktarx ikunu l-konsegwenzi fin-nuqqas ta’ tweġiba,

Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.

- l-eżistenza tad-dritt ta’ aċċess għal u d-dritt ta’ rettifika ta’ data dwaru

SECTION IV

sakemm din l-informazzjoni tkun meħtieġa, meħud kont taċ-ċirkostanzi speċifiċi li fihom id-data jkun inġabar, biex ikun garantit ipproċessar ġust dwar is-suġġett tad-data.

INFORMATION TO BE GIVEN TO THE DATA SUBJECT

L-Artikolu 11

Informazzjoni meta d-data ma jkunux inkiseb mis-suġġet tad-data

Article 10

1. Meta d-data ma tkunx inkisbet mis-suġġett tad-data, Stati Membru għandhom jipprovdu li l-kontrollur jew ir-rappreżentant tiegħu għandhom fil-mument li jibdew ir-reġistrazzjoni tad-data personali, jew jekk ikun maħsub li d-data tiġi żvelata lil parti terza, mhux aktar tard miż-żmien li d-data tkun żvelata l-ewwel darba, jagħtu lis-suġġett tad-data għall-inqas l-informazzjoni li ġejja, ħlief meta huwa jkun diġa jaf biha:

Information in cases of collection of data from the data subject

- l-identità tal-kontrollur jew tar-rappreżentant tiegħu, jekk ikun hemm;

Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:

- l-għanijiet ta’ l-ipproċessar;

(a) the identity of the controller and of his representative, if any;

- informazzjoni oħra bħal

(b) the purposes of the processing for which the data are intended;

- il-kategoriji tad-data in kwistjoni,

(c) any further information such as

- ir-riċevituri jew il-kategoriji ta’ riċevituri,

- the recipients or categories of recipients of the data,

- l-eżistenza tad-dritt ta’ aċċess għal u d-dritt ta’ rettifika ta’ data dwaru

- whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply,

sakemm dik l-informazzjoni tkun meħtieġa, meħud kont taċ-ċirkostanzi speċifiċi li fihom id-data jkun inġabar, biex ikun garantit ipproċessar ġust dwar is-suġġett tad-data.

- the existence of the right of access to and the right to rectify the data concerning him

2. Il-Paragrafu 1 m’għandux japplika fejn, partikolarment għal ipproċessar għall-finijiet ta’ statistika jew għall-finijiet ta’ riċerka storika jew xjentifika, ma jkunx possibbli li tingħata dik l-informazzjoni jew biex tingħata jkun meħtieġ sforz sproporzjonat jew jekk ir-reġistrazzjoni jew l-iżvelar ikunu espressament meħtieġa bil-liġi. F’dawn il-każi Stati Membri għandhom jipprovdu protezzjoni xierqa.

in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject.

TAQSIMA V

DRITT TAS-SUĠĠETT TAD-DATA GĦAL AĊĊESS GĦAD-DATA

Article 11

L-Artikolu 12

Information where the data have not been obtained from the data subject

Dritt ta’ aċċess

1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:

Stati Membri għandhom jiggarantixxu lil kull suġġett tad-data d-dritt li jikseb mingħand il-kontrollur:

(a) the identity of the controller and of his representative, if any;

(a) mingħajr restrizzjoni f’perjodi raġjonevoli u mingħajr dewmien jew spejjeż eċċessivi:

(b) the purposes of the processing;

- konferma jekk data dwaru tkunx qed tiġi pproċessata, u għall-inqas informazzjoni dwar l-għanijiet ta’ l-ipproċessar, il-kategoriji tad-data in kwistjoni, u r-riċevituri jew kategoriji ta’ riċevituri li lilhom ikun żvelat id-data,

(c) any further information such as

- komunikazzjoni lilu b’mod li tinftiehem tad-data li tkun qed tiġi pproċessata u informazzjoni oħra li jkun hemm dwar l-oriġini tiegħu,

- the categories of data concerned,

- għarfien tar-raġuni għal kull ipproċessar awtomatiku tad-data dwaru, għall-inqas fil-każ ta’ deċiżjonijiet awtomatizzati imsemmija fl-Artikolu 15(1);

- the recipients or categories of recipients,

(b) skond kif jixraq, ir-rettifika, tħassir jew imblokk ta’ data li l-ipproċessar tiegħu ma jkunx skond id-dispożizzjonijiet ta’ din id-Direttiva, partikolarment minħabba n-natura mhux kompluta jew mhux eżatta tad-data;

- the existence of the right of access to and the right to rectify the data concerning him

(ċ) notifika lill-partijiet terzi li lilhom id-data tkun żvelata dwar kull rettifika, tħassir jew imblokk li jkunu saru skond (b), sakemm din tkun tista’ ssir jew ma tkunx titlob sforz sproporzjonat.

in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject.

TAQSIMA VI

2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law. In these cases Member States shall provide appropriate safeguards.

EŻENZJONIJIET U RESTRIZZJONIJIET

SECTION V

L-Artikolu 13

THE DATA SUBJECT'S RIGHT OF ACCESS TO DATA

Eżenzjonijiet u restrizzjonijiet

1. Stati Membri jistgħu jadottaw miżuri leġislattivi biex jirrestrinġu l-finijiet ta’ l-obbligazzjonijiet u d-drittijiet provduti fl-Artikoli 6(1), 10, 11 (1), 12 u 21 meta dawn ir-restrizzjonijiet jikkostitwixxu miżuri meħtieġa li jagħtu protezzjoni lil:

Article 12

(a) sigurtà nazzjonali;

Right of access

(b) difiża;

Member States shall guarantee every data subject the right to obtain from the controller:

(ċ) sigurtà pubblika;

(a) without constraint at reasonable intervals and without excessive delay or expense:

(d) prevenzjoni, investigazzjoni, sejbien u prosekuzzjoni ta’ offiżi kriminali jew il-ksur ta’ etika ta’ professjonijiet regolati;

- confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,

(e) interess ekonomiku jew finanzjarju ta’ importanza għal Stat Membru jew għall-Unjoni Ewopea, magħduda affarijiet monetarji, fiskali jew ta’ l-estmi;

- communication to him in an intelligible form of the data undergoing processing and of any available information as to their source,

(f) monitoraġġ, spezzjoni jew funzjoni regolatorja marbuta, ukoll jekk kulltant, ma’ l-eżerċizzju ta’ awtorità uffiċjali fil-każi msemmija f’ (ċ), (d) u (e);

- knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15 (1);

(g) il-protezzjoni tas-suġġett tad-data jew tad-drittijiet u l-libertajiet ta’ l-oħrajn.

(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;

2. Bla ħsara għal protezzjoni legali adekwata, partikolarment li d-data ma tkunx użata biex jittieħdu miżuri jew deċiżjonijiet dwar individwi partikolari, Stati Membi jistgħu, meta jkun jidher ċar li ma jkunx hemm riskju li d-dritt għall-ħajja privata tas-suġġett tad-data tinkiser, jirrestrinġu b’miżuri leġistattivi id-drittijiet provduti fl-Artikolu 12 meta d-data tkun ipproċessata biss għal għanijiet ta’ riċerka xjentifika jew biex jinżamm f’għamla personali għal żmien li ma jaqbiżx dak meħtieġ għall-iskop waħdieni tal-ħolqien ta’ statistika.

(c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.

TAQSIMA VII

SECTION VI

ID-DRITT TAS-SUĠĠETT TAD-DATA LI JAGĦMEL OĠĠEZZJONI

EXEMPTIONS AND RESTRICTIONS

L-Artikolu 14

Id-dritt tas-suġġett tad-data li jagħmel oġġezzjoni

Article 13

Stati Membri għandhom jagħtu lis-suġġett tad-data d-dritt:

Exemptions and restrictions

(a) li, bla ħsara għal dak provdut fil-liġijiet nazzjonali, mill-inqas fil-każi msemmija fl-Artikolu 7(e) u (f), jagħmel oġġezzjoni f’kull żmien kontra l-ipproċessar ta’ data dwaru għal raġunijiet gravi u leġittimi dwar is-sitwazzjoni partikolari tiegħu. Meta jkun hemm oġġezzjoni ġustifikata, l-ipproċessar mibdi mill-kontrollur jista’ ma jibqax juża dak id-data;

1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6 (1), 10, 11 (1), 12 and 21 when such a restriction constitutes a necessary measures to safeguard:

(b) li, fuq talba tiegħu u mingħajr ħlas, jagħmel oġġezzjoni kontra l-ipproċessar ta’ data personali dwaru li l-kontrollur jistenna li jkun ipproċessat għall-fini ta’ bejgħ dirett fis-suq, jew li jkun mgħarraf qabel ma d-data personali tkun żvelata għall-ewwel darba lil partijiet terzi jew użat f’isimhom għal l-għanijiet ta’ bejgħ dirett fis-suq, u li jingħata espressament id-dritt li jagħmel oġġezzjoni mingħajr ħlas kontra dak l-iżvelar jew użu.

(a) national security;

Stati Membri għandhom jieħdu l-miżuri meħtieġa biex jassiguraw li s-suġġett tad-data tkun taf bl-eżistenza tad-dritt imsemmi fl-ewwel sub-paragrafu ta’ (b).

(b) defence;

L-Artikolu 15

(c) public security;

Deċiżjonijiet individwali awtomatizzati

(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;

1. Stati Membri għandhom jagħtu d-dritt li persuna ma tkunx suġġetta għal deċiżjoni li jkollha effetti legali fuqha jew li teffetwaha sewwa u li tkun imsejsa biss fuq ipproċessar awtomatizzat ta’ data maħsuba biex jagħmel valutazzjoni ta’ ċerti aspetti personali dwarha, bħalma huma ħilitha fuq il-post tax-xogħol, jekk għandhiex mezzi biex jagħmlu tajjeb għaliha, kemm hija ta’ min jafdaha, kondotta, eċċ.

(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;

2. Bla ħsara għall-Artikoli l-oħra ta’ din id-Direttiva, Stati Membri għandhom jipprovdu li persuna tista’ tkun suġġetta għal deċiżjoni bħal dik imsemmija fil-Paragrafu 1 jekk dik id-deċiżjoni:

(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);

(a) tittieħed fil-kors biex jinbeda jew jitwettaq kuntratt, sakemm it-talba biex jinbeda jew jitwettaq il-kuntratt, magħmula mis-suġġett tad-data, tkun ġiet sodisfatta jew li jkun hemm miżuri tajbin biżżejjed biex jagħtu protezzjoni lill-interessi leġitimi tiegħu, bħalma huma arranġamenti li jħalluh jesprimi lilu nnifsu; jew

(g) the protection of the data subject or of the rights and freedoms of others.

(b) tkun awtoriżżata b’liġi li tistabbilixxi wkoll miżuri biex jagħtu protezzjoni lill-interessi leġittimi tas-suġġett tad-data.

2. Subject to adequate legal safeguards, in particular that the data are not used for taking measures or decisions regarding any particular individual, Member States may, where there is clearly no risk of breaching the privacy of the data subject, restrict by a legislative measure the rights provided for in Article 12 when data are processed solely for purposes of scientific research or are kept in personal form for a period which does not exceed the period necessary for the sole purpose of creating statistics.

TAQSIMA VIII

SECTION VII

KONFIDENZJALITÀ U SIGURTÀ TA’ l-IPPROĊESSAR

THE DATA SUBJECT'S RIGHT TO OBJECT

L-Artikolu 16

Konfidenzjalità ta’ l-Ipproċessar

Article 14

Kull persuna li taġixxi bl-awtorità tal-kontrollur jew tal-proċessur, magħdud il-proċessur innifsu, li jkollu aċċess għal data personali, m’għandhiex tipproċessaha ħlief fuq struzzjonijiet tal-kontrollur, sakemm ma jkunx meħtieġ li tagħmel hekk mill-liġi.

The data subject's right to object

L-Artikolu 17

Member States shall grant the data subject the right:

Sigurtà ta’ l-ipproċessar

(a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;

1. Stati Membri għandhom jipprovdu li l-kontrollur għandu jimplimenta miżuri tekniċi u organizzattivi xierqa biex jagħtu protezzjoni lil data personali kontra distruzzjoni aċċidentali jew illegali jew telf aċċidentali, tibdil, żvelar jew aċċess mhux awtorizzat, partikolarment meta l-ipproċessar ikollu x’jaqsam mat-trasmissjoni ta’ data fuq network, u kontra kull forma oħra illegali ta’ ipproċessar.

(b) to object, on request and free of charge, to the processing of personal data relating to him which the controller anticipates being processed for the purposes of direct marketing, or to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses.

Meħud kont ta’ l-iktar teknika avvanzata u n-nefqa biex ikunu implimentati, dawn il-miżuri għandhom jassiguraw livell xieraq ta’ sigurtà kontra r-riskji li l-ipproċessar u n-natura tad-data li għandha tkun protetta iġibu magħhom.

Member States shall take the necessary measures to ensure that data subjects are aware of the existence of the right referred to in the first subparagraph of (b).

2. L-Istati Membri għandhom jipprovdu li meta l-ipproċessar isir f’isem il-kontrollur, huwa għandu jagħżel proċessur li jagħti garanziji suffiċjenti dwar miżuri tekniċi ta’ sigurtà u miżuri organizzattivi li jirregolaw l-ipproċessar li jkollu jsir, u għandu jassigura li jitħarsu dawk il-miżuri.

3. L-ipproċessar permezz ta’ proċessur għandu jkun regolat permezz ta’ kuntratt jew att legali li jżomm lill-proċessur responsabbli lejn il-kontrollur u li jistipula partikolarment illi:

Article 15

- l-proċessur għandu jaġixxi biss fuq struzzjoni tal-kontrollur,

Automated individual decisions

- l-obbligazzjonijiet imsemmija fil-Paragrafu 1, kif imfissra fil-liġi ta’ l-Istat Membru li fiħ il-proċessur ikun stabbilit, għandhom jorbtu wkoll lill-proċessur.

1. Member States shall grant the right to every person not to be subject to a decision which produces legal effects concerning him or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc.

4. Għall-fini taż-żamma ta’ prova, dawk il-partijiet tal-kuntratt jew att legali li jitkellmu dwar il-protezzjoni ta’ data u l-ħtiġijiet dwar il-miżuri msemmija fil-Paragrafu 1 għandhom ikunu bil-miktub jew f’għamla oħra ekwivalenti.

2. Subject to the other Articles of this Directive, Member States shall provide that a person may be subjected to a decision of the kind referred to in paragraph 1 if that decision:

TAQSIMA IX

(a) is taken in the course of the entering into or performance of a contract, provided the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or that there are suitable measures to safeguard his legitimate interests, such as arrangements allowing him to put his point of view; or

NOTIFIKA

(b) is authorized by a law which also lays down measures to safeguard the data subject's legitimate interests.

L-Artikolu 18

SECTION VIII

Obbligazzjoni ta’ notifika lill-awtorità ta’ superviżjoni

CONFIDENTIALITY AND SECURITY OF PROCESSING

1. Stati Membri għandhom jipprovdu li l-kontrollur jew ir-rappreżentant tiegħu, jekk ikun hemm, għandu jinnotifika lill-awtorità ta’ superviżjoni msemmija fl-Artikolu 28, qabel ma jagħmel l-operazzjoni parzjali jew kollha ta’ l-ipproċessar awtomatiku jew sett ta’ operazzjonijiet bħal dawn maħsuba biex jaqdu skop wieħed jew diversi għanijiet relatati.

2. Stati Membri jistgħu jipprovdu għal simplifikazzjoni ta’, jew eżenzjoni minn, notifika, fil-każi biss li ġejjin u skond il-kondizzjonijiet li ġejjin:

Article 16

- meta, għal kategoriji ta’ operazzjonijiet ta’ ipproċessar li, meħud kont tad-data li tkun ser tiġi pproċessata, aktarx li ma jeffetwawx ħażin id-drittijiet u l-libertajiet tas-suġġetti tad-data, jispeċifikaw l-għanijiet ta’ l-ipproċessar, id-data jew kategoriji ta’ data li jkunu qed tiġi pproċessata, il-kategorija jew kategoriji tas-suġġett tad-data, ir-riċevituri jew kategoriji ta’ riċevituri li lilhom ikun ser jiġi żvelat id-data u għal kemm żmien id-data għanha tkun maħżuna, u/jew

Confidentiality of processing

- meta l-kontrollur, b’konformità mal-liġi nazzjonali li tirregolah, jaħtar uffiċjal tal-protezzjoni ta’ data personali, responsabbli partikolarment:

Any person acting under the authority of the controller or of the processor, including the processor himself, who has access to personal data must not process them except on instructions from the controller, unless he is required to do so by law.

- li jassigura b’mod indipendenti l-applikazzjoni interna tad-dispożizzjonijiet nazzjonali meħuda skond din id-Direttiva

- għaż-żamma tar-reġistru ta’ operazzjonijiet ta’ ipproċessar li l-kontrollur ikun għamel, li jkun fihom dik l-informazzjoni msemmija fl-Artikolu 21(2),

Article 17

biex b’dan jassigura li l-operazzjonijiet ta’ l-ipproċessar aktarx ma jkunux ser iħallu effett ħażin fuq id-drittijiet u l-libertajiet tas-suġġetti tad-data.

Security of processing

3. Stati Membri Membri jistgħu jipprovdu li l-Paragrafu 1 ma jkunx japplika għall-ipproċessar li l-iskop waħdieni tiegħu ikun iż-żamma ta’ reġistru li skond liġijiet jew regolamenti ikun maħsub li jagħti informazzjoni lill-pubbliku u li jkun miftuħ għal konsultazzjoni jew mill-pubbliku in ġenerali jew minn persuna li turi interess leġittimu.

1. Member States shall provide that the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

4. Stati Membru jistgħu jipprovdu għal eżenzjoni mill-obbligazzjoni ta’ notifika jew simplifikazzjoni tan-notifika fil-każ ta’ operazzjonijiet ta’ ipproċessar msemmija fl-Artikolu 8(2)(d).

Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.

5. Stati Membri jistgħu jistipulaw li l-operazzjonijiet kollha jew uħud minnhom ta’ l-ipproċessar mhux awtomatiku li jkollhom li fihom ikollha x’taqsam data personali għandhom ikunu notifikati, jew jipprovdu li dawn l-operazzjonijiet ta’ l-ipproċessar ikunu suġġetti għal notifika simplifikata.

2. The Member States shall provide that the controller must, where processing is carried out on his behalf, choose a processor providing sufficient guarantees in respect of the technical security measures and organizational measures governing the processing to be carried out, and must ensure compliance with those measures.

L-Artikolu 19

3. The carrying out of processing by way of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating in particular that:

Kontenut tan-notifika

- the processor shall act only on instructions from the controller,

1. Stati Membri għandhom jispeċifikaw l-informazzjoni li għandha tingħata fin-notifika. Din għandha tinkludi mill-inqas:

- the obligations set out in paragraph 1, as defined by the law of the Member State in which the processor is established, shall also be incumbent on the processor.

(a) l-isem u l-indirizz tal-kontrollur jew tar-rapreżentant tiegħu, jekk ikun hemm;

4. For the purposes of keeping proof, the parts of the contract or the legal act relating to data protection and the requirements relating to the measures referred to in paragraph 1 shall be in writing or in another equivalent form.

(b) l-iskop jew l-għanijiet ta’ l-ipproċessar;

SECTION IX

(ċ) deskrizzjoni tal-kategorija jew kategoriji tas-suġġett tad-data, u tad-data jew kategoriji ta’ data dwarhom;

NOTIFICATION

(d) ir-riċevituri jew kategoriji ta’ riċevituri li lilhom tista’ tkun żvelata id-data;

(e) trasferimenti proposti tad-data lil pajjiżi terzi;

Article 18

(f) deskrizzjoni ġenerali li tippermetti li jsir eżami preliminari dwar kemm ikunu xierqa l-miżuri meħuda skond l-Artikolu 17 biex jassiguraw is-sigurtà ta’ l-ipproċessar.

Obligation to notify the supervisory authority

2. Stati Membri għandhom jispeċifikaw il-proċeduri li bihom tibdil li jista’ jaffetwa l-informazzjoni msemmija fil-Paragrafu 1 għandhom ikunu notifikati lill-awtorità ta’ superviżjoni.

1. Member States shall provide that the controller or his representative, if any, must notify the supervisory authority referred to in Article 28 before carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes.

L-Artikolu 20

2. Member States may provide for the simplification of or exemption from notification only in the following cases and under the following conditions:

Verifika minn qabel

- where, for categories of processing operations which are unlikely, taking account of the data to be processed, to affect adversely the rights and freedoms of data subjects, they specify the purposes of the processing, the data or categories of data undergoing processing, the category or categories of data subject, the recipients or categories of recipient to whom the data are to be disclosed and the length of time the data are to be stored, and/or

1. Stati Membri għandhom jiddeterminaw l-operazzjonijiet ta’ ipproċessar li aktarx jista’ jkollhom riskji speċifiċi għad-drittijiet u l-libertajiet tas-suġġett tad-data, u għandhom jivverifikaw li dawn l-operazzjonijiet ta’ ipproċessar ikunu eżaminati qabel ma jinbdew.

- where the controller, in compliance with the national law which governs him, appoints a personal data protection official, responsible in particular:

2. Verifiki bħal dawn minn qabel għandhom isiru mill-awtorità ta’ superviżjoni wara li tkun waslet notifika mingħand il-kontrollur jew l-uffiċjal tal-protezzjoni tad-data, li, f’każ ta’ dubju, għandu jikkonsulta ma’ l-awtorità ta’ superviżjoni.

- for ensuring in an independent manner the internal application of the national provisions taken pursuant to this Directive

3. Stati Membri jistgħu wkoll jagħmlu verifiki bħal dawn fil-qafas ta’ tħejjija jew ta’ miżura tal-Parlament nazzjonali jew ta’ miżura msejsa fuq miżura leġislattiva bħal dik, li tagħti tifsira tan-natura ta’ l-ipproċessar u tagħti l-protezzjoni xierqa.

- for keeping the register of processing operations carried out by the controller, containing the items of information referred to in Article 21 (2),

L-Artikolu 21

thereby ensuring that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations.

Pubbliċità lil operazzjonijiet ta’ ipproċessar

3. Member States may provide that paragraph 1 does not apply to processing whose sole purpose is the keeping of a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person demonstrating a legitimate interest.

1. Stati Membri għandhom jieħdu miżuri biex jassiguraw li operazzjonijiet ta’ ipproċessar jingħataw pubbliċità.

4. Member States may provide for an exemption from the obligation to notify or a simplification of the notification in the case of processing operations referred to in Article 8 (2) (d).

2. Stati Membri għandhom jipprovdu li għandu jinżamm reġistru mill-awtorita ta’ superviżjoni dwar operazzjonijiet ta’ ipproċessar notifikati skond l-Artikolu 18.

5. Member States may stipulate that certain or all non-automatic processing operations involving personal data shall be notified, or provide for these processing operations to be subject to simplified notification.

Ir-reġistru għandu jkun fih mill-inqas l-informazzjoni msemmija fl-Artikolu 19(1)(a) sa (e).

Ir-reġistru jista’ jkun spezzjonat minn kull persuna.

Article 19

3. Stati Membri għandhom jipprovdu, f’dak li għandu x’jaqsam ma’ operazzjonijiet ta’ ipproċessar li ma jkunux jeħtieġu notifika, li kontrolluri jew korp ieħor maħtur mill-Istati Membri jagħmlu disponibbli għall-inqas l-informazzjoni msemmija fl-Artikolu 19(1)(a) sa (e) f’għamla xierqa lil kull persuna li titlobha.

Contents of notification

Stati Membri jistgħu jipprovdu li din id-dispożizzjoni ma tkunx tapplika għall-ipproċessar li l-iskop waħdieni tiegħu jkun iż-żamma ta’ reġistru li skond liġijiet jew regolamenti jkun maħsub li jagħti informazzjoni lill-pubbliku u li jkun miftuħ għal konsultazzjoni jew mill-pubbliku in ġenerali jew minn kull persuna li ġġib prova ta’ interess leġittimu.

1. Member States shall specify the information to be given in the notification. It shall include at least:

Il-KAPITOLU III

(a) the name and address of the controller and of his representative, if any;

RIMEDJI ĠUDIZZJARJI, RESPONSABBILTÀ U SANZJONIJIET

(b) the purpose or purposes of the processing;

L-Artikolu 22

(c) a description of the category or categories of data subject and of the data or categories of data relating to them;

Rimedji

(d) the recipients or categories of recipient to whom the data might be disclosed;

Bla ħsara għal kull rimedju amministrattiv li dwaru tista’ ssir dispożizzjoni, inter alia quddiem l-awtorità ta’ superviżjoni msemmija fl-Artikolu 28, qabel ma ssir referenza lill-awtorità ġudizjarja, Stati Membri għandhom jipprovdu għad-dritt ta’ kull persuna għal rimedju ġudizjarju għal kull ksur tad-drittijiet garantiti lilha bil-liġi nazzjonali li tkun tapplika għall-ipproċessar in kwistjoni.

(e) proposed transfers of data to third countries;

L-Artikolu 23

(f) a general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 17 to ensure security of processing.

Responsabbilità

2. Member States shall specify the procedures under which any change affecting the information referred to in paragraph 1 must be notified to the supervisory authority.

1. Stati Membri għandhom jipprovdu li persuna li tkun sofriet ħsara minħabba operazzjoni ta’ ipproċessar illegali jew att li ma jkunx jaqbel mad-dispożizzjonijiet nazzjonali adottati skond din id-direttiva, għandha tkun intitolata li tirċievi kumpens mill-kontrollur għal ħsara li tkun sofriet.

2. Il-kontrollur jista’ jkun eżentat minn din ir-responsabblità, kollha jew parti minnha, jekk hu jagħti prova li ma kienx responsabbli għall-inċident li ta lok għall-ħsara.

Article 20

L-Artikolu 24

Prior checking

Sanzjonijiet

1. Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing operations are examined prior to the start thereof.

L-Istati Membri għandhom jadottaw miżuri xierqa biex jassiguraw l-implementazzjoni sħieħa tad-dispożizzjonijiet ta’ din id-Direttiva u għandhom partikolarment jistabbilixxu s-sanzjonijiet li għandhom jingħataw f’każ ta’ ksur tad-dispożizzjonijiet adottati skond din id-Direttiva.

2. Such prior checks shall be carried out by the supervisory authority following receipt of a notification from the controller or by the data protection official, who, in cases of doubt, must consult the supervisory authority.

Il-KAPITOLU IV

3. Member States may also carry out such checks in the context of preparation either of a measure of the national parliament or of a measure based on such a legislative measure, which define the nature of the processing and lay down appropriate safeguards.

TRASFERIMENT TA’ DATA PERSONALI LIL PAJJIŻI TERZI

L-Artikolu 25

Article 21

Prinċipji

Publicizing of processing operations

1. L-Istati Membri għandhom jipprovdu li t-trasferiment lil pajjiż terz ta’ data personali li tkun qed tiġi pproċessata jew li tkun maħsuba li tiġi pproċessata wara trasferiment jista’ jsir biss jekk, bla ħsara għal konformità mad-dispożizzjonijiet nazzjonali adottati skond id-dispożizzjonijiet l-oħra ta’ din id-Direttiva, il-pajjiż terz jassigura livell adekwat ta’ protezzjoni.

1. Member States shall take measures to ensure that processing operations are publicized.

2. Jekk il-livell ta’ protezzjoni mogħti minn pajjiż terz ikunx adekwat għandu jiġi eżaminat fid-dawl taċ-ċirkostanzi kollha li jkollhom x’jaqsmu ma’ operazzjoni ta’ trasferiment ta’ data jew sett ta’ operazzjonijiet ta’ trasferiment ta’ data; għandu jittieħed kont partikolarment tan-natura tad-data, l-għan u t-tul ta’ żmien ta’ l-operazzjoni jew operazzjonijiet proposti ta’ l-ipproċessar, il-pajjiż ta’ oriġini u l-pajjiż tad-destinazzjoni finali, ir-regoli tal-liġi, kemm ġenerali kif ukoll settorjali, fis-seħħ fil-pajjiż terz in kwistjoni u r-regoli professjonali u l-miżuri ta’ sigurtà li jitħarsu f’dak il-pajjiż.

2. Member States shall provide that a register of processing operations notified in accordance with Article 18 shall be kept by the supervisory authority.

3. L-Istati Membri u l-Kummissjoni għandhom jgħarrfu lil xulxin b’każi fejn iqisu li pajjiż terz ma jkunx qed jassigura livell adekwat ta’ protezzjoni skond it-tifsira tal-Paragrafu 2.

The register shall contain at least the information listed in Article 19 (1) (a) to (e).

4. Meta l-Kummissjoni ssib, skond il-proċedura pprovduta fl-Artikolu 31(2), li pajjiż terz ma jkunx qed jassigura livell adekwat ta’ protezzjoni skond it-tifsira tal-Paragrafu 2 ta’ dan l-Artikolu, Stati Membri għandhom jieħdu l-miżuri meħtieġa biex ma jħallux li jsir trasferiment ta’ data ta’ l-istess tip lill-pajjiż terz in kwistjoni.

The register may be inspected by any person.

5. Meta jkun jaqbel, il-Kummissjoni għandha tidħol f’negozjati bil-għan li ssib rimedju għas-sitwazzjoni li tirriżulta minn dak li tkun sabet skond il-Paragrafu 4.

3. Member States shall provide, in relation to processing operations not subject to notification, that controllers or another body appointed by the Member States make available at least the information referred to in Article 19 (1) (a) to (e) in an appropriate form to any person on request.

6. Il-Kummissjoni tista’ tikkonkludi, skond il-proċedura msemmija fl-Artikolu 31(2), li pajjiż terz ikun qed jassigura livell adekwat ta’ protezzjoni skond it-tifsira tal-paragrafu 2 ta’ dan l-Artikolu, permezz tal-liġi domestika tiegħu jew ta’ l-impenji internazzjonali li jkun daħal għalihom, partikolarment meta jintemmu n-negozjati msemmija fil-paragrafu 5, għall-protezzjoni tal-ħajja privata u tal-libertajiet u d-drittijiet bażiċi ta’ l-individwu.

Member States may provide that this provision does not apply to processing whose sole purpose is the keeping of a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can provide proof of a legitimate interest.

Stati Membri għandhom jieħdu l-miżuri meħtieġa biex ikunu konformi mad-deċiżjoni tal-Kummissjoni.

L-Artikolu 26

CHAPTER III JUDICIAL REMEDIES, LIABILITY AND SANCTIONS

Derogi

1. B’deroga għall-Artikolu 25 u bla ħsara għal dak provdut mod ieħor fil-liġi domestika li tirregola każi partikolari, Stati Membri għandhom jipprovdu li trasferiment jew sett ta’ trasferimenti ta’ data personali lil pajjiż terz, li ma jassigurax livell adekwat ta’ protezzjoni skond it-tifsira ta’ l-Artikolu 25(2), ikunu jistgħu isiru bil-kondizzjoni li:

Article 22

(a) is-suġġett tad-data jkun ta l-kunsens tiegħu mingħajr ambigwità għat-trasferiment propost; jew

Remedies

(b) it-trasferiment ikun meħtieġ biex isir kuntratt bejn is-suġġett tad-data u l-kontrollur jew għall-implimentazzjoni ta’ miżuri pre-kontrattwali meħuda bi tweġiba għal talba tas-suġġett tad-data; jew

Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question.

(ċ) it-trasferiment ikun meħtieġ għal-konklużjoni jew biex isir kuntratt magħmul fl-interess tas-suġġett tad-data, bejn il-kontrollur u parti terza; jew

(d) it-trasferiment ikun meħtieġ jew legalment mitlub minħabba raġunijiet ta’ interess pubbliku ta’ importanza, jew biex ikunu stabbiliti, eżerċitati jew protetti talbiet legali; jew

Article 23

(e) it-trasferiment ikun meħtieġ għall-protezzjoni ta’ interessi vitali tas-suġġett tad-data; jew

Liability

(f) it-trasferiment isir minn reġistru li skond liġijiet jew regolamenti jkun maħsub li jagħti informazzjoni lill-pubbliku u li jkun miftuħ għal konsultazzjoni mill-pubbliku in ġenerali jew minn persuna li turi interess leġittimu, sakemm il-kondizzjonijiet imsemmija fil-liġi għal konsultazzjoni jitħarsu fil-każ partikolari.

1. Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.

2. Bla ħsara għall-paragrafu 1, Stat Membru jista’ jawtorizza trasferiment jew sett ta’ trasferimenti ta’ data personali lil pajjiż terz li ma jassigurax livell adekwat ta’ protezzjoni skond it-tifsira ta’ l-Artikolu 25(2), meta l-kontrollur jipprovdi ħarsien biżżejjed għall-protezzjoni tal-ħajja privata u tad-drittijiet u l-libertajiet fundamentali ta’ l-individwu u għall-eżerċizzju tad-drittijiet relattivi; ħarsien bħal dak jista’ partikolarment jirriżulta minn klawsoli kontrattwali xierqa.

2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not responsible for the event giving rise to the damage.

3. L-Istat Membru għandu jgħarraf lill-Kummissjoni u lill-Istati Membri l-oħra bl-awtorizzazzjoni li hu jagħti skond il-paragrafu 2.

Jekk Stat Membru jew il-Kummissjoni jagħmlu oġġezzjoni għal raġunijiet ġustifikati li jkollhom x’jaqsmu mal-protezzjoni tad-drittijiet u l-libertajiet fundamentali tal-ħajja privata ta’ l-individwu, il-Kummissjoni għandha tieħu miżuri xierqa skond il-proċedura msemmija fl-Artikolu 31(2).

Article 24

Stati Membri għandhom jieħdu l-miżuri meħtieġa biex ikunu komformi mad-deċiżjoni tal-Kummissjoni.

Sanctions

4. Meta l-Kummissjoni tiddeċiedi, skond il-proċedura msemmija fl-Artikolu 31(2), li ċerti klawsoli kontrattwali standard joffru protezzjoni biżżejjed kif mitluba skond il-paragrafu 2, Stati Membri għandhom jieħdu l-miżuri meħtieġa biex ikunu konformi mad-deċiżjoni tal-Kummissjoni.

The Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Directive.

Il-KAPITOLU V

KODIĊIJIET TA’ KONDOTTA

CHAPTER IV TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

L-Artikolu 27

1. L-Istati Membri u l-Kummissjoni għandhom jinkoraġġixxu t-tħejjija ta’ kodiċijiet ta’ kondotta maħsuba biex jagħtu sehemhom għall-implimentazzjoni xierqa tad-dispożizzjonijiet nazzjonali adottati mill-Istati Membri skond din id-Direttiva, meħud kont tal-karatteristiċi speċifiċi tad-diversi setturi.

Article 25

2. Stati Membri għandhom jagħmlu provvedimenti għal għaqdiet tal-kummerċ u għal korpi oħra li jirrappreżentaw kategoriji oħra ta’ kontrolluri li jkunu ħejjew abbozzi ta’ kodiċijiet nazzjonali jew li jkollhom il-ħsieb li jemendaw jew jestendu kodiċijiet nazzjonali eżistenti biex ikunu jistgħu jibgħatuhom għall-opinjoni ta’ l-awtorità nazzjonali. Stati Membri għandhom jagħmlu provvedimenti għal din l-awtorità biex taċċerta, fost ħwejjeġ oħra, jekk l-abbozzi mibgħuta lilha jkunux skond il-provvedimenti nazzjonali adottati skond din id-Direttiva.

Principles

Jekk tħoss li jkun sewwa, l-awtorità għandha ssaqsi għall-opinjonijiet tas-suġġetti tad-data jew tar-rapreżentanti tagħhom.

1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.

3. Abbozzi ta’ kodiċijiet tal-Komunità, u emendi jew estensjonijiet għal kodiċijiet eżistenti tal-Komunità, jistghu jintbagħtu lill-Grupp ta’ Ħidma msemmi fl-Artikolu 29. Dan il-Grupp ta’ Ħidma għandu jiddeċiedi, fost ħwejjeġ oħra, jekk l-abbozzi mibgħuta lilu jkunux jaqblu mad-dispożizzjonijiet nazzjonali adottati skond din id-Direttiva. Jekk tħoss li jkun sewwa, l-awtorità għandha ssaqsi għall-opinjonijiet tas-suġġetti tad-data jew tar-rappreżentanti tagħhom. Il-Kummissjoni tista’ tassigura li l-kodiċijiet li jkunu ġew approvati mill-Grupp ta’ Ħidma jingħataw pubbliċità xierqa.

2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.

Il-KAPITOLU VI

3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.

AWTORITÀ TA’ SUPERVIŻJONI U GRUPP TA’ ĦIDMA GĦALL-PROTEZZJONI TA’ INDIVIDWI FL-IPPROĊESSAR TA’ DATA PERSONALI

4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.

L-Artikolu 28

5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.

Awtorità ta’ superviżjoni

6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.

1. Kull Stat Membru għandu jipprovdi li awtorità pubblika waħda jew aktar ikunu responsabbli tas-sorveljanza ta’ l-applikazzjoni fit-territorju tiegħu tad-dispożizzjonijiet adottati mill-Istati Membri skond din id-Direttiva.

Member States shall take the measures necessary to comply with the Commission's decision.

Dawn l-awtoritajiet għandhom jaġixxu b’indipendenza sħiħa fl-eżerċizzju tal-funzjonijiet fdati lilhom.

2. Kull Stat Membru għandu jipprovdi li l-awtoritajiet ta’ superviżjoni jiġu kkonsultati meta jkunu qed iħejju miżuri amministrattivi jew regolamenti li jkollhom x’jaqsmu mal-protezzjoni tad-drittijiet u l-libertajiet ta’ l-individwu fl-ipproċessar ta’ data personali.

Article 26

3. Kull awtorità għandha jkollha partikolarment:

Derogations

- setgħat investigattivi, bħalma huma setgħat ta’ aċċess għal data li tagħmel parti mis-suġġett ta’ operazzjonijiet ta’ ipproċessar u setgħat għal ġbir ta’ l-informazzjoni kollha meħtieġa biex twettaq id-dmirijiet tagħha ta’ superviżjoni,

1. By way of derogation from Article 25 and save where otherwise provided by domestic law governing particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2) may take place on condition that:

- setgħat effettivi ta’ intervent, bħalma hu, per eżempju, dak li tagħti opinjonijiet qabel ma jsiru operazzjonijiet ta’ ipproċessar, skond l-Artikolu 20, u li tassigura li dawn l-opinjonijiet ikollhom pubblikazzjoni sewwa, li tordna l-imblokk, tħassir jew distruzzjoni ta’ data, li ma tħallix għal xi żmien jew għal dejjem milli jsir ipproċessar, li twissi jew twiddeb lill-kontrollur, jew li tirreferi l-kwistjoni lill-parlamenti nazzjonali jew istituzzjonijiet pubbliċi oħra,

(a) the data subject has given his consent unambiguously to the proposed transfer; or

- is-setgħa li tidħol fi proċeduri legali meta d-dispożizzjonijiet nazzjonali adottati skond din id-Direttiva jkunu ġew miksura jew li tressaq dan il-ksur quddiem l-awtoritajiet ġudizzjarji.

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request; or

Deċiżjonijiet ta’ l-awtorità ta’ superviżjoni li jagħtu lok għal ilmenti jistgħu jkunu appellati fil-qrati.

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or

4. Kull awtorità ta’ superviżjoni għandha tisma’ talbiet maghmulin minn kull persuna, jew minn għaqda li tirrappreżenta lil dik il-persuna, dwar il-protezzjoni tad-drittijiet jew libertajiet tagħha fl-ipproċessar ta’ data personali.

(d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or

Il-persuna kkonċernata għandha tkun mgħarrfa bir-riżultat tat-talba. Kull awtorità ta’ superviżjoni għandha, partikolarment, tisma’ talbiet għal verifiki dwar il-legalità ta’ ipproċessar ta’ data mressqa minn kull persuna meta d-dispożizzjonijiet nazzjonali adottati skond l-Artikolu 13 ta’ din id-Direttiva jkunu japplikaw. Il-persuna għandha f’kull każ tkun mgħarrfa li tkun saret verifika.

(e) the transfer is necessary in order to protect the vital interests of the data subject; or

5. Kull awtorità ta’ superviżjoni għandha tħejji f’intervalli regolari rapport dwar l-attivitajiet tagħha. Ir-rapport għandu jkun ippubblikat.

(f) the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.

6. Kull awtorità ta’ superviżjoni hija kompetenti, tkun liema tkun il-liġi nazzjonali li tkun applika għall-ipproċessar in kwistjoni, li teżerċita, fit-territorju ta’ l-Istat Membru tagħha nfisha, is-setgħat mogħtija lilha skond il-paragrafu 3. Kull awtorità tista’ tintalab li teżerċita s-setgħat tagħha minn awtorità ta’ Stat Membru ieħor.

2. Without prejudice to paragraph 1, a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.

L-awtoritajiet ta’ superviżjoni għandhom jikkooperaw ma xulxin f’dak li jkun meħtieġ biex iwettqu dmirijiethom, partikolarment billi jaqsmu flimkien kull informazzjoni utli.

3. The Member State shall inform the Commission and the other Member States of the authorizations it grants pursuant to paragraph 2.

7. Stati Membri għandhom jipprovdu li l-membri u l-impjegati ta’ l-awtorità ta’ superviżjoni, ukoll wara t-tmiem ta’ l-impjieg tagħhom, li jkunu obbligati li jżommu s-sigriet professjonali dwar informazzjoni konfidenzjali li jkollhom aċċess għaliha.

If a Member State or the Commission objects on justified grounds involving the protection of the privacy and fundamental rights and freedoms of individuals, the Commission shall take appropriate measures in accordance with the procedure laid down in Article 31 (2).

L-Artikolu 29

Member States shall take the necessary measures to comply with the Commission's decision.

Grupp ta’ Ħidma għall-Protezzjoni ta’ Individwi dwar Ipproċessar ta’ Data Personali.

4. Where the Commission decides, in accordance with the procedure referred to in Article 31 (2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.

1. Grupp ta’ Ħidma għall-Protezzjoni ta’ Individwi fir-Rigward ta’ l-Ipproċessar ta’ Data Personali, minn hawn ‘il quddiem imsejjaħ ‘il-Grupp ta’ Ħidma’, qed ikun b’dan stabbilit.

Dan għandu jkollu funzjoni konsultattiva u għandu jkun indipendenti.

CHAPTER V CODES OF CONDUCT

2. Il-Grupp ta’ Ħidma għandu jkun magħmul minn rappreżentant ta’ l-awtorità ta’ superviżjoni jew awtoritajiet nominati minn kull Stat Membru, u minn rappreżentant ta’ l-awtorità jew awtoritajiet imwaqqfa għall-istituzzjonijiet u l-korpi tal-Komunità, u minn rappreżentant tal-Kummissjoni.

Kull membru tal-Grupp ta’ Ħidma għandu jkun nominat mill-istituzzjoni, awtorità jew awtoritajiet li huwa jirrappreżenta. Meta Stat Membru jkun innomina aktar minn awtorità ta’ superviżjoni waħda, dawn għandhom jinnominaw rappreżentant konġunt. L-istess għandu japplika għall-awtoritajiet stabbiliti għall-istituzzjonijiet jew korpi tal-Komunità.

Article 27

3. Il-Grupp ta’ Ħidma għandu jieħu deċiżjonijiet b’maġġoranza sempliċi tar-rappreżentanti ta’ l-awtoritajiet ta’ superviżjoni.

1. The Member States and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper implementation of the national provisions adopted by the Member States pursuant to this Directive, taking account of the specific features of the various sectors.

4. Il-Grupp ta’ Ħidma għandu jaħtar il-president tiegħu. Il-ħatra ta’ president tkun għall-perjodu ta’ sentejn. Il-ħatra tiegħu tista’ tkun imġedda.

2. Member States shall make provision for trade associations and other bodies representing other categories of controllers which have drawn up draft national codes or which have the intention of amending or extending existing national codes to be able to submit them to the opinion of the national authority.

5. Is-segretarjat tal-Grupp ta’ Ħidma għandu jkun provdut mill-Kummissjoni.

Member States shall make provision for this authority to ascertain, among other things, whether the drafts submitted to it are in accordance with the national provisions adopted pursuant to this Directive. If it sees fit, the authority shall seek the views of data subjects or their representatives.

6. Il-Grupp ta’ Ħidma għandu jadotta ir-regoli tal-proċedura tiegħu.

3. Draft Community codes, and amendments or extensions to existing Community codes, may be submitted to the Working Party referred to in Article 29. This Working Party shall determine, among other things, whether the drafts submitted to it are in accordance with the national provisions adopted pursuant to this Directive. If it sees fit, the authority shall seek the views of data subjects or their representatives. The Commission may ensure appropriate publicity for the codes which have been approved by the Working Party.

7. Il-Grupp ta’ Ħidma għandu jikkunsidra, fuq inizjattiva tiegħu innifsu jew fuq talba ta’ rappreżentant ta’ l-awtoritajiet ta’ superviżjoni jew fuq talba tal-Kummissjoni, il-punti ta’ l-aġenda mogħtija lilu mill-president tiegħu,.

L-Artikolu 30

CHAPTER VI SUPERVISORY AUTHORITY AND WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA

1. Il-Grupp ta’ Ħidma għandu:

(a) jeżamina kull kwistjoni dwar l-applikazzjoni tal-miżuri nazzjonali adottati skond din id-Direttiva biex jagħti sehmu għall-applikazzjoni uniformi ta’ dawn il-miżuri;

Article 28

(b) jagħti opinjoni lill-Kummissjoni dwar il-livell ta’ protezzjoni fil-Komunità u f’pajjiżi terzi;

Supervisory authority

(ċ) jagħti parir lill-Kummissjoni dwar emendi proposti għal din id-Direttiva, dwar miżuri addizzjonali jew speċifiċi biex jipproteġu d-drittijiet u l-libertajiet ta’ persuni naturali fl-ipproċessar ta’ data personali u ta’ miżuri oħra proposti mill-Komunità li jeffettwaw dawk id-drittijiet u libertajiet;

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

(d) jagħti opinjoni dwar kodiċijiet ta’ kondotta mħejjija fuq il-livell tal-Komunità.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Jekk il-Grupp ta’ Ħidma jsib li jkun hemm diverġenzi bejn il-liġijiet jew il-prattika ta’ Stati Membri li jistgħu jeffettwaw l-ekwivalenza ta’ protezzjoni ta’ persuni fl-ipproċessar ta’ data personali fil-Komunità, hija għandha tgħarraf b’dan lill-Kummissjoni.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Il-Grupp ta’ Ħidma jista’ jagħmel, fuq inizjattiva tiegħu innifsu, rakkomandazzjonijiet fuq kull haġa li jkollha x’taqsam mal-protezzjoni tal-persuna dwar l-ipproċessar ta’ data fil-Komunità.

3. Each authority shall in particular be endowed with:

4. L-opinjonijiet u r-rakkomandazzjonijiet tal-Grupp ta’ Ħidma għandhom jintbagħtu lill-Kummissjoni u lill-kumitat imsemmi fl-Artikolu 31.

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

5. Il-Kummissjoni għandha tgħarraf lil Grupp ta’ Ħidma dwar l-azzjoni li tkun ħadet b’riżultat ta’ l-opinjonijiet u rakkomandazzjonijiet tiegħu. Għandha tagħmel dan f’rapport li għandu jintbagħat ukoll lill-Parlament Ewropew u lill-Kunsill. Ir-rapport għandu jkun ippubblikat.

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

6. Il-Grupp ta’ Ħidma għandu jħejji rapport annwali fuq is-sitwazzjoni dwar il-protezzjoni ta’ persuni naturali fl-ipproċessar ta’ data personali fil-Komunità u f’pajjiżi terzi, li huwa għandu jibgħat lill-Kummissjoni, lill-Parlament Ewropew u lill-Kunsill. Ir-rapport għandu jkun ippubblikat.

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Il-KAPITOLU VII

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

MIŻURI TA’ IMPLIMENTAZZJONI TAL-KOMUNITÀ

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

L-Artikolu 31

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

Il-Kumitat

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

1. Il-Kummissjoni għandha tkun assistita minn kumitat magħmul mir-rappreżentanti tal-Istati Membri u mmexxi mir-rappreżentant tal-Kummissjoni.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

2. Ir-raprezentant tal-Kummissjoni għandu jibgħat lill-kumitat abbozz tal-miżuri li jkunu ser jittiehdu. Il-kumitat għandu jagħti l-opinjoni tiegħu fuq l-abbozz f’perjodu ta’ żmien li l-president jista’ jordna skond l-urġenza tal-każ.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

L-opinjoni għandha tingħata mill-maġġoranza msemmija fl-Artikolu 148(2) tat-Trattat. Il-voti tar-rappreżentanti ta’ l-Istati Membri fi ħdan il-kumitat għandhom ikunu peżati skond kif stabbilit f’dak l-Artikolu. Il-president m’għandux vot.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.

Il-Kummissjoni għandha tadotta miżuri li għandhom japplikaw mill-ewwel. Iżda jekk dawn il-miżuri ma jkunux skond l-opinjoni tal-kumitat, il-Kummissjoni għandha tikkomunikahom mill-ewwel lill-Kunsill. F’dak il-każ:

- il-Kummissjoni għandha tipposponi l-applikazzjoni tal-miżuri li hija tkun ħadet għal perjodu ta’ tlett xhur mid-data tal-komunikazzjoni,

Article 29

- il-Kunsill, b’maġġoranza kwalifikata, jista’ jieħu deċiżjoni differenti matul il-perjodu ta’ żmien imsemmi fl-ewwel vers.

Working Party on the Protection of Individuals with regard to the Processing of Personal Data

DISPOSIZZJONIJIET FINALI

1. A Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as 'the Working Party', is hereby set up.

L-Artikolu 32

It shall have advisory status and act independently.

1. Stati Membri għandhom idaħħlu fis-seħħ liġijiet, regolamenti u dispożizzjonijiet amministrattivi meħtieġa biex ikunu konformi ma’ din id-Direttiva mhux iktar tard mill-għeluq ta’ tlett snin mid-data fi fiha tiġi adottata.

2. The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State and of a representative of the authority or authorities established for the Community institutions and bodies, and of a representative of the Commission.

Meta Stati Membri jadottaw dawn il-miżuri, dawn għandhom jagħmlu referenza għal din id-Direttiva jew ikollhom magħhom referenza bħal din meta jiġu ppubblikati uffiċjalment. Il-metodi li bihom issir din ir-referenza għandhom ikunu stabbiliti mill-Istati Membri.

Each member of the Working Party shall be designated by the institution, authority or authorities which he represents. Where a Member State has designated more than one supervisory authority, they shall nominate a joint representative. The same shall apply to the authorities established for Community institutions and bodies.

2. Stati Membri għandhom jassiguraw li ipproċessar li diġa jkun qed isir fid-data meta d-dispożizzjonijiet nazzjonali adottati skond din id-Direttiva jidħlu fis-seħħ, jinġieb konformi ma’ dawn id-dispożizzjonijiet fi żmien tlett snin minn dik id-data.

3. The Working Party shall take decisions by a simple majority of the representatives of the supervisory authorities.

B’deroga għas-subparagrafu preċedenti, Stati Membri jistgħu jipprovdu li l-ipproċessar ta’ data li hija diġà miżmuma f’sistemi ta’ skedar manwali fid-data tad-dħul fis-seħħ tad-dispożizzjonijiet nazzjonali adottati fl-implimentazzjoni ta’ din id-Direttiva għandhom jinġiebu konformi ma’ l-Artikoli 6, 7 u 8 ta’ din id-Direttiva fi żmien 12-il sena mid-data li fiha tkun ġiet adottata. Stati Membri għandhom, iżda, jagħtu lis-suġġett tad-data d-dritt li jikseb, fuq talba tiegħu u partikolarment fiż-żmien li huwa jkun qed jeżerċita d-dritt tiegħu ta’ aċċess, ir-rettifika, tħassir jew imblokk ta’ data li ma tkunx kompleta, ikun żbaljat jew maħżun b’mod li ma jkunx jaqbel ma’ l-għanijiet leġittimi meħuda mill-kontrollur.

4. The Working Party shall elect its chairman. The chairman's term of office shall be two years. His appointment shall be renewable.

3. B’deroga għall-paragrafu 2, Stati Membri jistgħu jipprovdu, taħt protezzjoni xierqa, li data miżmum għall-għan waħdieni ta’ riċerka storika ma jkunx jeħtieġlu li jkun konformi ma’ l-Artikoli 6, 7 u 8 ta’ din id-Direttiva.

5. The Working Party's secretariat shall be provided by the Commission.

4. L-Istati Membri għandhom jikkomunikaw lill-Kummissjoni it-test tad-dispożizzjonijiet tal-liġi domestika li huma jadottaw fil-qasam li għandu x’jaqsam ma’ din id-Direttiva.

6. The Working Party shall adopt its own rules of procedure.

L-Artikolu 33

7. The Working Party shall consider items placed on its agenda by its chairman, either on his own initiative or at the request of a representative of the supervisory authorities or at the Commission's request.

Il-Kummissjoni għandha tibgħat rapport lill-Kunsill u lill-Parlament Ewropew, f’intervalli regolari, li jibdew jgħoddu mhux iktar tard minn tlett snin wara d-data msemmija fl-Artikolu 32(1), dwar l-implimentazzjoni ta’ din id-Direttiva, waqt li tehmeż mar-rapport, jekk ikun meħtieġ, proposti u emendi xierqa. Ir-rapport għandu jkun ippubblikat.

Il-Kummissjoni għandha teżamina, partikolarment, l-applikazzjoni ta’ din id-Direttiva fl-ipproċessar ta’ data audio-viżiva li jkollu x’jaqsam ma’ persuni naturali, u għandha tibgħat proposti xierqa li jidher li jkunu meħtieġa, meħud kont ta’ l-żviluppi fit-teknloġija ta’ l-informatika u fid-dawl tal-progress li jkun sar fis-soċjeta ta’ l-informazzjoni.

Article 30

L-Artikolu 34

1. The Working Party shall:

Din id-Direttiva hija indirizzata lill-Istati Membri.

(a) examine any question covering the application of the national measures adopted under this Directive in order to contribute to the uniform application of such measures;

(b) give the Commission an opinion on the level of protection in the Community and in third countries;

Magħmula fil-Lussemburgu, l-24 ta’ Ottubru, 1995.

(c) advise the Commission on any proposed amendment of this Directive, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data and on any other proposed Community measures affecting such rights and freedoms;

Għall-Parlament Ewropew

(d) give an opinion on codes of conduct drawn up at Community level.

Il-President

2. If the Working Party finds that divergences likely to affect the equivalence of protection for persons with regard to the processing of personal data in the Community are arising between the laws or practices of Member States, it shall inform the Commission accordingly.

K. Haensch

3. The Working Party may, on its own initiative, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the Community.

Għall-Kunsill

4. The Working Party's opinions and recommendations shall be forwarded to the Commission and to the committee referred to in Article 31.

Il-President

5. The Commission shall inform the Working Party of the action it has taken in response to its opinions and recommendations. It shall do so in a report which shall also be forwarded to the European Parliament and the Council. The report shall be made public.

L. Atienza serna

6. The Working Party shall draw up an annual report on the situation regarding the protection of natural persons with regard to the processing of personal data in the Community and in third countries, which it shall transmit to the Commission, the European Parliament and the Council. The report shall be made public.

[1] ĠU C 277, tal-5.11.1990, p. 3. u ĠU C 311, tas-27.11.1992, p. 30

[2] ĠU C 159, tas-17.6.1991, p. 38.

CHAPTER VII COMMUNITY IMPLEMENTING MEASURES

[3] Opinjoni tal-Parlament Ewropew tal-11 ta’ Marzu, 1992 (ĠU C 94, tat-13.4.1992, p. 198),konfermata fit-2 ta’ Diċembru, 1993 (ĠU C 342, ta’ l-20.12.1993, p. 30); Pożizzjoni komuni tal-Kunsill ta’ l-20 ta’ Frar, 1995 (ĠU C 93, tat-13.4.1995, p. 1) u Deċiżjoni tal-Parlament Ewropew tal-15 ta’ Ġunju, 1995 (ĠU C 166, tat-3.7.1995).

[4] ĠU L 197, tat-18.7.1987, p. 33.

Article 31

--------------------------------------------------

The Committee

1. The Commission shall be assisted by a committee composed of the representatives of the Member States and chaired by the representative of the Commission.

2. The representative of the Commission shall submit to the committee a draft of the measures to be taken. The committee shall deliver its opinion on the draft within a time limit which the chairman may lay down according to the urgency of the matter.

The opinion shall be delivered by the majority laid down in Article 148 (2) of the Treaty. The votes of the representatives of the Member States within the committee shall be weighted in the manner set out in that Article. The chairman shall not vote.

The Commission shall adopt measures which shall apply immediately. However, if these measures are not in accordance with the opinion of the committee, they shall be communicated by the Commission to the Council forthwith. It that event:

- the Commission shall defer application of the measures which it has decided for a period of three months from the date of communication,

- the Council, acting by a qualified majority, may take a different decision within the time limit referred to in the first indent.

FINAL PROVISIONS

Article 32

1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive at the latest at the end of a period of three years from the date of its adoption.

When Member States adopt these measures, they shall contain a reference to this Directive or be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by the Member States.

2. Member States shall ensure that processing already under way on the date the national provisions adopted pursuant to this Directive enter into force, is brought into conformity with these provisions within three years of this date.

By way of derogation from the preceding subparagraph, Member States may provide that the processing of data already held in manual filing systems on the date of entry into force of the national provisions adopted in implementation of this Directive shall be brought into conformity with Articles 6, 7 and 8 of this Directive within 12 years of the date on which it is adopted. Member States shall, however, grant the data subject the right to obtain, at his request and in particular at the time of exercising his right of access, the rectification, erasure or blocking of data which are incomplete, inaccurate or stored in a way incompatible with the legitimate purposes pursued by the controller.

3. By way of derogation from paragraph 2, Member States may provide, subject to suitable safeguards, that data kept for the sole purpose of historical research need not be brought into conformity with Articles 6, 7 and 8 of this Directive.

4. Member States shall communicate to the Commission the text of the provisions of domestic law which they adopt in the field covered by this Directive.

Article 33

The Commission shall report to the Council and the European Parliament at regular intervals, starting not later than three years after the date referred to in Article 32 (1), on the implementation of this Directive, attaching to its report, if necessary, suitable proposals for amendments. The report shall be made public.

The Commission shall examine, in particular, the application of this Directive to the data processing of sound and image data relating to natural persons and shall submit any appropriate proposals which prove to be necessary, taking account of developments in information technology and in the light of the state of progress in the information society.

Article 34

This Directive is addressed to the Member States.

Done at Luxembourg, 24 October 1995.

For the European Parliament

The President

K. HAENSCH

For the Council

The President

L. ATIENZA SERNA

(1) OJ No C 277, 5. 11. 1990, p. 3 and OJ No C 311, 27. 11. 1992, p. 30.

(2) OJ No C 159, 17. 6. 1991, p 38.

(3) Opinion of the European Parliament of 11 March 1992 (OJ No C 94, 13. 4. 1992, p. 198), confirmed on 2 December 1993 (OJ No C 342, 20. 12. 1993, p. 30); Council common position of 20 February 1995 (OJ No C 93, 13. 4. 1995, p. 1) and Decision of the European Parliament of 15 June 1995 (OJ No C 166, 3. 7. 1995).

(1) OJ No L 197, 18. 7. 1987, p. 33.