Data protection in Malta is governed by the Data Protection Act (Cap. 586, 2018), which gives effect to and supplements the General Data Protection Regulation (Regulation (EU) 2016/679) and the Law Enforcement Directive (Directive (EU) 2016/680). The supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC), which enforces GDPR compliance, handles complaints and cooperates within the European Data Protection Board.
Cultural organisations engaging with personal data — ticketing operators, museums, libraries, broadcasters, audience-research bodies — operate within the same framework as other controllers and processors. The framework affects audience-database management, mailing lists, online-content services, image rights for performers and visitors, and the management of historical and archival records containing personal data.
Sector-specific tensions arise particularly around (i) the balance between public access to archival records and personal-data protection — addressed in part by the National Archives Act (Cap. 477, 2006) provisions on access and embargo, (ii) academic and journalistic exemptions under Article 85 GDPR, transposed through Cap. 586, and (iii) the use of biometric, locational and image data in interactive and immersive cultural experiences. The Processing of Personal Data (Education Sector) Regulations and similar subsidiary instruments establish sector-specific rules of relevance to arts education.
Comments are closed.