Law note · Malta
GDPR Article 22 and Cap. 586, Automated Decisions in Malta
cite Regulation (EU) 2016/679, Art. 22; Data Protection Act, Cap. 586
stage In effect
since 2018-05-25
reviewed 2026-08-24
General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing, restated by Cap. 586 without narrowing per secondary commentary. Subsidiary Legislation 586.11 sets the digital age of consent at 13, a national exercise of the GDPR Article 8 discretion, which permits a range from 13 to 16.
What it asks of an app
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Malta within one month of receipt.
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Malta, under General Data Protection Regulation (GDPR) Article 22.
- Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Subsidiary Legislation 586.11.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: Secondary commentary (Linklaters, Mondaq), not independently confirmed against Cap. 586's own text this pass