MGA: Update to the Incident Reporting Requirements
Reading Time: 2 minutes
The Malta Gaming Authority (MGA) has released an important update regarding the Incident Reporting mechanism available to its licensees. In this article, we will provide you with all the relevant information and procedures for submitting an Incident Report through the updated reporting instrument called the ‘Technical – Information Security Incident’.
Notification Obligations as per Gaming Authorisations and Compliance Directive
According to Articles 37(2)(c) and (d) of the Gaming Authorisations and Compliance Directive (Directive 3 of 2018), licensees are required to promptly notify the MGA in the following situations:
(c) Any breach of the licensee’s information security that compromises the confidentiality of players’ information;
(d) Any breach of the licensee’s information security that results in players being unable to access their accounts for more than twelve (12) hours.
Licensees must submit an Incident Report to inform the MGA about any information security breaches that meet the above criteria. It is crucial to note that licensees should also consider their obligations under the General Data Protection Regulation (EU/2016/679) and other applicable legislation.
The Technical – Information Security Incident Reporting Process
The Technical – Information Security Incident reporting option can be accessed through the “New/Change” dropdown menu on the Licensee Portal. When selected, users will be directed to the relevant sections of the ‘Technical – Information Security Incident’ reporting form. They must fill in all compulsory fields and submit any necessary documentation to the MGA.
Once an Incident Report is submitted, it will undergo a thorough review by the MGA. If any missing information is identified, the MGA will request further clarification from the licensee. Licensees must address any pending clarifications promptly to ensure a smooth process.
If the MGA determines that no further clarifications are necessary, the Incident Report will be closed, and all relevant documentation will be securely filed for record-keeping purposes.
Please note that Incident Reports left in ‘Draft’ form (i.e., opened but not effectively submitted) for a period of ninety (90) days will be automatically discarded.