Consultation over Isle of MTV registration
MTA processing personal data for ‘marketing purposes on consent’
A consultation process has been entered into between the Malta Tourism Authority (MTA) and the office of the Information and Data Protection Commissioner to ensure that the necessary safeguards are in place for the processing of personal data for Isle of MTV ticket registration.
Privacy concerns were raised following the announcement that those who wish to attend this year’s Isle of MTV concert in Floriana have to register online in order to receive their tickets.
A ticketing system has been introduced for the first time, with the event remaining free of charge.
The MTA has justified the ticketing system for safety and security purposes, saying that once the number of registrations for tickets reaches the maximum safe number of people who can fit inside the Floriana granaries, no more tickets will be issued. There is an option of opting out from allowing the MTA to gain access to the registration details.
A prominent IT lawyer, Antonio Ghio, as well as a former Data Protection Tribunal chairperson who had been appointed under the previous Labour administration Dr Lynn Zahra both expressed serious concerns with the government having access to this data, especially in view of the vast majority of attendees being minors. Zahra questioned whether minors would understand the implications of sharing such personal details and therefore whether they would think of ‘opting out’.
The Malta Independent wrote to Information and Data Protection commissioner Saviour Cachia to enquire about the ongoing debate on government having access to such data due to registration for a concert.
Cachia clarified that in this instance, the MTA is the data controller, “insofar as personal data is forwarded to them by the Isle of MTV (MTV) of those data subjects who give their consent by opting in.”
He said, “MTV is a data controller on its own behalf in the UK territory which, of course, falls outside our jurisdiction.”
Cachia said that the MTA are, “basing the processing of personal data for marketing purposes on consent, which is a valid legal basis both under our Data Protection Act and also the General Data Protection Regulations (GDPR – EU data protection laws coming into force in May 2018).”
He highlighted how all data controllers must have a retention policy determining retention periods, however the requirement for data subjects to be informed of those retention periods will be introduced through the new GDPR coming into force on 25 May 2018.
“Having said all this, MTA and this Office have already entered into a consultation process with regards to the issue under debate, with the aim to ensure the necessary safeguards in these processing operations.”
In order to register for the popular event, one must input their email address, their name and surname. Underneath, one particular box which users may tick or opt out of reads:
“By ticking this box I hereby agree to MTV passing my details to the Malta Tourism Authority so that I can receive news and updates on future events. *Those wishing to unsubscribe from receiving news and updates about future events can send an email to info@visitmalta.com.”
Another reads: “By clicking ‘Submit’ I confirm that I am aged 14 or over and have parent or legal guardian consent to provide my information if I am under 18. I have read and accept the Terms and Conditions and Privacy Policy. Terms and conditions and privacy policy.”