TM flouting more Data Protection legislation – expert


Tista' taqra bil- Malti.

After revealing that Transport Malta’s Memorandum of Understanding (MoU) with the Police is probably in breach of the law, can now also reveal that Malta’s transport regulator is also flouting other sections of the General Data Protection Regulations (GDPR).

The legal expert contacted by said that “it is worrying that a public authority of this sort is clearly not yet compliant with an EU Regulation that contemplates fines of up to €20 million for non-compliance, though the highest fine so far levied locally is €5,000”.

Besides these probable infringements, this newsroom discovered that the telephone number given on TM’s website for its Data Protection Officer is not active. Moreover, this newsroom’s calls on the phone number of the Office of Data Protection of the Police were not answered.

First case of probable breaching of the law

Newsbook contacted an expert in data protection regulations after Government announced that the police will now have access to the video material recorded by 60 cameras which Transport Malta operates all over Malta and Gozo, and by a further 250 which will be installed on the traffic network in the coming months.

The legal expert who spoke to Newsbook on condition of anonymity said that in such cases the law mandates that a Data Protection Impact Assessment needs to be carried out before the operations can start, adding that this assessment needs to be greenlighted by the Information and Data Protection Commissioner.

Data Protection Commissioner Saviour Cachia told that he was not consulted before the Police and TM embarked on this project, a clear by-passing of the legislation.

Read: Police and TM likely breaking the law – expert

From bad to worse: more breaches discovered

Newsbook’s investigations reveal that the situation is worse than first thought to be as TM is probably flouting other aspects of the Data Protection regulations.  tried to contact TM’s Data Protection Officer (DPO) on the telephone number given on TM’s website. It transpired that the telephone number is not active. Although the GDPR requires that the identity of the DPO be published, his or her name is nowhere to be seen on the website.

This newsroom then phoned TM on Thursday. An employee informed us that she could not pass our call to the officer in charge of data protection. We were asked for our telephone number so that we would be contacted by TM. Up to the time of publication of this report, no call was forthcoming.

The legal expert contacted by this newsroom said that “Transport Malta’s privacy policy on its website makes no mention of how it captures traffic of personal data and what it does with it. In this sense, it is in breach of Article 14 GDPR.”

The legal expert contacted by this newsroom said that TM’s policy does not mention how it is collecting data beyond its ordinary functions such as the processing of licenses.

“How is it processing data collected through traffic cameras?  Who has access to it?  How long is it being kept?  What are the reasons for which it is being collected? Where is it being kept? To whom can it be transferred?”

He concluded that “there are loads of questions that are unanswered, and it’s worrying that a public authority of this sort is clearly not yet compliant with an EU Regulation that contemplates fines of up to €20 million for non-compliance.”

No safeguards regarding accessing of data by the Police

He added that there is no mention anywhere of what safeguards have been taken to eliminate or otherwise limit the accessing of personal data by the Police in cases where there is no suspicion of a crime.

“What policies have the Police put in place in order to ensure that there is no abuse of this data by individual police officers. For instance, what’s stopping a policeman from monitoring where his wife went shopping on a random Tuesday?”, he asked. tried phoning the Office of Data Protection of the Police. We phoned the number given on their website, but no one answered.

TM is not alone

This is not the first time that Transport Malta has been accused of similar actions. In September of last year, reported that a number of regulatory authorities and government entities responsible for the enforcement of laws and regulations governing several important sectors have been flouting instead of observing regulations. Besides TM, those accused of such actions included Infrastructure Malta, the Medical Council, Ambjent Malta and the Institute of Tourism Studies.

Read also: Regulatory authorities flouting regulations