Data privacy and personal data protection are two rights enshrined by the legal framework of the Macau Special Administrative Region (Macau SAR or MSAR), which covers these two separate but related rights in a systematic and extensive manner.
The most relevant pieces of legislation addressing data protection and data privacy issues in Macau are:
The latter is an ordinance inspired by European legislation on data protection, namely the European Union Data Protection Directive of 1995, and sets the legal framework for the protection of personal data in Macau SAR.
Other legislation affecting this area that should be noted includes:
Following the international trend for amendments and updates of legal frameworks on data protection matters, as well as the continued domestic and international interest in the area, it is also expected, that the PDPA may soon be amended to better deal with the implications and challenges of the digital age.
The OPDP is the government entity responsible and accountable for monitoring and enforcing compliance with PDPA provisions, and for establishing an adequate confidentiality system and monitoring its enforcement.
There are two different types of administrative process: notification and authorisation.
Under the PDPA, the data controller, or their representative, if any, must notify the public authority in writing within eight days after the start of carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes.
The public authority may authorise the simplification of, or exemption from, notification for particular categories of processing which, taking account of the data to be processed, are unlikely to adversely affect the rights and freedoms of the data subjects. In allowing this simplification or exemption, the authority will also consider the speed, economy and efficiency of the relevant processing.
The authorisation of simplification shall be published in the Official Gazette of the Macau SAR and must specify the purposes of the processing; the data or category of data to be processed; the category or categories of data subjects; the recipients, or categories of recipients, to whom the data may be disclosed; and the length of time the data is to be stored.
There are exemptions from notification, such as those for processing whose sole purpose is the keeping of a register which, according to laws or administrative regulations, is intended to provide information to the public and which is open to consultation by the public in general or by any person demonstrating a legitimate interest.
Processing of data deemed as sensitive – which includes data concerning political or philosophical beliefs, religious faith, trade union or political membership, racial or ethnic origin, and data concerning health or sex life, including genetic information – is subject to authorisation and can only be made if guarantees of non-discrimination and sufficient security measures (indicated in the PDPA) are provided; which, in the cases indicated in the law, include obtaining the data subject’s explicit consent. The same applies to processing of data relating to the credit and solvency of the concerned subject.
Applications for opinions, authorisations and notifications submitted to the OPDP shall include the following information:
Without prejudice to the right to submit a complaint to the public authority, according to the law any person may have recourse to administrative and legal means to guarantee compliance with provisions of laws and regulations in the area of personal data protection.
The OPDP is empowered to enforce those provisions of the PDPA that are of an administrative nature (see 2.5 Enforcement and Litigation), under the PDPA and the Chief Executive Dispatch No 83/2007. Criminal cases are reported to, and handled by, the Public Prosecutor’s Office.
The PDPA is strongly influenced by EU rules, which have long been considered the gold standard in data protection law, since its scope is quite similar to the laws of EU jurisdictions, particularly Portugal (which administered Macau until 1999). The law in force in this area is very similar to the one in force in Portugal until 2018, when the GDPR was enacted. Currently no multilateral obligations apply.
This issue does not arise in the Macau SAR jurisdiction.
As previously described, Macau SAR’s legal framework is strongly inspired by EU legislation and therefore utilises the same approach as other EU-influenced legal frameworks. The omnibus model is enshrined in the PDPA, with no specific rules for individual sectors of activity.
In terms of enforcement, two different phases have been known since the PDPA was enacted.
At first, despite enactment, Macau authorities were not proactive in terms of assessing data protection compliance. The legal framework was already in place but neither the Macau authorities nor the general population were sensitive in relation to the treatment and processing of personal data and to personal data protection.
In the second and more recent stage, despite no changes in the existing legal framework taking place, the approach of the Macau authorities has altered and, consequently, local government has become very proactive in terms of data protection rights.
There have been no relevant changes in the existing legal framework in the past 12 months.
Since its establishment, the OPDP has existed as a project team. However, it is often suggested that it may change to a commission, similar to those which exist to fight corruption or conduct audits; or even to an independent public bureau with administrative autonomy. However, it doesn’t seem likely that such a change will be tabled in the Macau legislature in the near future.
Data Protection Officers
The existing legal framework – including the OPDP guidelines – does not require the appointment of privacy or data protection officers. If private entities decide to create this position, they may freely proceed with their own rules, under the applicable principles and stipulations of the PDPA.
Internal/External Privacy Policies
Under Article 15 of the PDPA, the controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected. Some of the major companies operating in Macau SAR – eg, gaming operators, banking and insurance institutions and concessionaires of public services, such as electricity or communications – are required by the OPDP to put in place data protection policies.
Requirement to Allow Data Subject Access to Data, Etc
Access to data
The PDPA assures the right of the data subject to information regarding the identity of the data controller or its representative, the purposes of processing and other ancillary information (Article 10 of the PDPA), as well as the right of access to all their data (Article 11 of the PDPA).
Correction and deletion
The right of access includes the right to rectify, delete or block data whose processing does not comply with the PDPA, including in regard to the incomplete or inexact character of that data (Article 11, paragraph 1, subparagraph 4 of the PDPA).
Objection to processing
The data subject has the right to object at any time, where lawful and serious reasons relating to their specific case obtain, to their data being the subject of processing, in which case, under that justified objection, the processing shall not concern such data (Article 12, paragraph 1 of the PDPA). Such “serious reasons” are deemed to include the objection to the sale of personal data.
Objection to marketing
The data subject also has the right to object, on request and free of charge, to the processing of personal data concerning them for direct marketing or any other form of commercial prospecting, and also has the right to be previously informed of any transfer of data to third parties for the purposes of direct marketing or use by third parties, as well as the right to object, free of charge, to that transfer or use (Article 12, paragraph 2 of the PDPA).
Use of Data Pursuant to Anonymisation
As described above, the data subject is entitled to refuse their own data being processed and/or marketed by the entities collecting their personal data.
The Concept of “Injury” or “Harm” in Data Protection Law
“Injury” or “harm” concepts shall be relevant for compensation purposes as, under standard liability rules, those suffering injuries and/or harms caused by third parties may be entitled to receive compensation for the losses or harms suffered. For the breach of PDPA provisions it shall not be mandatory to suffer the said losses or harms. Data processors using personal data without the consent of the data subject will be in immediate breach of the law regardless of the extent (or lack thereof) of the harms or injuries caused to the subject and, therefore, may be liable for such conduct.
The concept of “sensitive data” is defined under Article 7 of the PDPA, which prohibits the processing of personal data concerning political or philosophical beliefs, political or trade union membership, religious faith, private life, racial or ethnic origin, as well as the processing of data concerning a data subject's health and sex life, including genetic information, with the exceptions foreseen by the PDPA.
Under the PDPA, data shall be collected for specific, determined and lawful purposes which must be directly related to the activity of the data controller, and cannot be subsequently processed in a way that is incompatible with those purposes (Article 5, paragraph 1, and subparagraph 2 of the PDPA). Again, the processing of personal data may only be carried out if the data subject has given their unequivocal consent, or if the processing is necessary to the cases referred to in Article 6 of the PDPA. Hence, if the entity has declared, for example, that marketing communications are one of the purposes of processing, and if the data subject has given their consent to that purpose, such processing is lawful under the PDPA. Marketing communications include any means of marketing a certain product or service – ie, via voice communications, SMS, email, etc.
Macau citizens under the age of 18 do not have the capacity to provide the express consent required by the PDPA. Minors may be represented by parents provided that the data is not to be used for illegal purposes. Ultimately, the minor can be represented by the Public Prosecutor's Office if any disputes arise surrounding the consent provided by one or both of the parents.
Video and Television
The PDPA applies to video surveillance and to other means of capturing, processing and disseminating sounds and images capable of identifying individuals, whenever the controller is domiciled or headquartered in the MSAR, or uses a provider of access to computer and telematics networks established there (Article 3, paragraph 3 of the PDPA).
No other specific stipulations exist for video surveillance, apart from Law No 2/2012, which establishes the legal framework of video surveillance in public spaces by the security forces and services of the MSAR.
As the use of CCTV is a separate processing of data, it shall require a separate notification to the OPDP under the law.
Under the PDPA, the processing of data can only take place if the data subject has given their unequivocal consent to the transfer, or if that transfer is necessary under the cases provided by law.
As the consent of the data subject is not feasible in such situations, the PDPA also allows for the processing of data if such processing is necessary for pursuing the legitimate interests of the data controller or the third party to whom the data is communicated, insofar as the interests, rights, freedoms and guarantees of the data subject do not prevail.
Social Media, Search Engines, Large Online Platforms
There are no specific provisions for social media, search engines and large online platforms under the Macau legal framework. Two of the general data protection and privacy issues that might affect them are discussed below.
Right to be forgotten (or of erasure)
There is no such specific right under the Macau legal framework. Nevertheless, data shall be kept in a way which allows the identification of its owner only for the duration necessary for the purposes of collection or subsequent processing (Article 5, paragraph 1, subparagraph 5 of the PDPA). This means that retention time shall not be unlimited but restricted to the scope of collection. To an extent it may qualify as a right similar to the “right to be forgotten”.
Hate speech, disinformation, abusive material, political manipulation
These types of matters are treated under the Macau legal framework but are not dealt with specifically by the PDPA or by similar legislation. These matters are addressed by the Macau Criminal Code, under which such conduct may be considered a criminal offence and subject to pecuniary or imprisonment penalties.
Rights to object to sale of data, tracking, etc
The data subject has the right to object at any time, where lawful and serious reasons relating to their specific case obtain, to their data being the subject of processing, in which case, under that justified objection, the processing shall not concern such data (Article 12, paragraph 1 of the PDPA). The concept of “serious reasons” is deemed to include the objection to the sale of personal data.
Other Key Examples
Financial data – the processing of data regarding credit and solvency is subject to the authorisation of the OPDP using the same process as is employed for sensitive data.
Health data – this is considered sensitive data and subject to authorisation.
The internet – privacy policies are not required but consent shall be given by the owner of the data.
The data subject has the right to object, on request and free of charge, to the processing of personal data concerning them for direct marketing or any other form of commercial prospecting, and also has the right to be previously informed of any transfer of data to third parties for the purposes of direct marketing or use by third parties, as well as the right to object, free of charge, to such transfer or use (Article 12, paragraph 2 of the PDPA).
Online advertisements using, for instance, the data subject's personal email, without the prior express consent of the data subject, may be subject to administrative offence procedures and to the payment of a fee.
Any advertisement using email accounts obtained without the consent of the data subject may be subject to administrative offence procedures.
There are no special laws or considerations regarding workplace privacy in Macau SAR. The general data protection laws are applicable to this specific matter.
In order to start proceedings relating to alleged violations, the OPDP must first take into account the actions of the alleged infringers, including the type of action and the intention of the agent, under the general administrative standards.
Non-compliance with the special security measures set out in Article 16 of the PDPA – for sensitive data processing and for the creation and maintenance of records regarding suspicion of illegal activity, criminal offences and administrative offences – is an administrative offence which may entail a fine between MOP4,000 and MOP40,000.
Although the PDPA provides penalties for undue access, as well as for tampering with, or destruction of, personal data, it does not specifically provide for security breaches by the data controller. It should be noted, however, that the PDPA mandates that the data controller shall present the notification/authorisation request with a general description of the security measures indicated in 2.1 Omnibus Laws and General Requirements (Internal/External Privacy Policies), so that the OPDP may evaluate the adequacy of such measures. If the OPDP notifies the above-mentioned entity to address any insufficiency in the security measures and no remedy is taken, then a fine of between MOP2,000 and MOP20,000 for individuals and of between MOP10,000 and MOP100,000 for legal persons may be imposed. Other potential enforcement penalties are outlined below.
Civil Non-compliance with the PDPA
Non-compliance with notification of data processing in breach of the terms set out in Article 23 of the PDPA, providing false information after notification by the OPDP and maintaining access to open data transmission networks for data controllers which do not comply with the provisions of the PDPA are all punishable by administrative sanction. This will take the form of a fine between MOP2,000 and MOP20,000 for individuals and of between MOP10,000 and MOP100,000 for legal persons; the fines are increased to twice the amount indicated above if the data is subject to previous authorisation.
Non-compliance with stipulations of the PDPA regarding:
involve an administrative sanction of a fine between MOP4,000 and MOP40,000.
Non-compliance with stipulations of the PDPA regarding:
involve an administrative sanction of a fine between MOP8,000 and MOP80,000.
Criminal Non-compliance with the PDPA
Non-compliance with stipulations of the PDPA regarding:
involve a criminal sanction of imprisonment up to one year or a fine up to 120 days. Fines which are set in days are under the discretion of the court – each day's fine corresponds to an amount between MOP50 and MOP10,000, which the court shall set according to the economic and financial situation of the convicted person and their personal expenses. The sanction is increased to twice the duration indicated above if the data involved is sensitive (Article 7 of the PDPA) or if illegal activities, criminal offences and administrative offences are suspected (Article 8 of the PDPA).
Access in any way to personal data whose access is forbidden to said individual/entity is forbidden. The sanction is increased to twice the duration indicated when access:
Such access is punishable with a criminal sanction of imprisonment up to one year or a fine up to 120 days, unless otherwise provided by special law. The sanction is increased to twice the duration indicated in the cases provided.
Deletion, destruction, damaging, suppression or modification of personal data without proper authorisation, rendering the data unusable or affecting its ability to be used is punishable with a criminal sanction: imprisonment up to two years or a fine up to 240 days, unless otherwise provided by special law. The sanction is increased to twice the duration indicated if the damage resulting therefrom is particularly serious. If the agent acts with negligence, the sanction is, in both of the cases provided above, imprisonment for up to one year or a fine up to 120 days.
Qualified disobedience regarding notification to interrupt, cease or block the processing of personal data, or in cases of:
involve a criminal sanction of imprisonment for up to two years or a fine up to 240 days.
The general rules of the Macau Civil Code and the Macau Civil Procedure Code also apply for alleged privacy or data protection violations.
The Criminal Code and the Criminal Procedure Code are the two relevant laws in relation to access to data for law enforcement agencies. In both cases, access to data is subject to approval by a court judge.
Regarding the processing of personal data relating to persons suspected of illegal activities, criminal and administrative offences, and to decisions applying penalties, security measures, fines and additional penalties, the law allows for such processing, subject to the observance of the provisions for the protection of data and the security of information, when such processing is necessary for pursuing the legitimate purposes of the controller, provided the fundamental rights and freedoms of the data subject are not overridden.
As noted in 3.1 Laws and Standards for Access to Data for Serious Crimes, the Criminal Code and the Criminal Procedure Code are the two relevant laws in relation to access to data for the investigation of crimes. In both cases, access to data is subject to approval by a court judge. The same standards apply to issues of national security.
This issue does not arise in the Macau SAR jurisdiction.
The most discussed privacy issues in Macau relate to the widely expected change to the status of the OPDP (see 1.8 Significant Pending Changes, Hot Topics and Issues). The importance and visibility of data protection matters in Macau civil society, as well as the public authorities' commitment to addressing these issues, would justify granting the OPDP the status (as well as the relevant powers) of a commission, similar to the ones existing for corruption and public audit matters.
Another topic of discussion is the publication of the list of jurisdictions that ensure an adequate level of data protection. This list has been referred to in the PDPA since its enactment but, as of March 2021, is yet to be released.
The transfer of personal data overseas can only take place in accordance with PDPA provisions and provided that the jurisdiction to which the data is going to be transferred ensures an adequate level of protection. This level of protection may be assessed by the OPDP on a case-by-case basis (Article 19 of the PDPA) but, in practice, the OPDP doesn’t assess the adequacy of the level or protection guaranteed by the import jurisdiction. All cases are assessed under Article 20 of the PDPA on derogations (see 4.2 Mechanisms That Apply to International Data Transfers). Under the PDPA there is no provision enabling the publication of a list of jurisdictions capable of ensuring the level of protection that is imposed by the PDPA.
The transfer of data overseas may be possible under the various exceptions provided by the PDPA. These include the necessity of such a transfer for the formation of a contract between the data subject and the data controller and for preliminary measures for the formation of that contract at the request of the data subject, among others.
However, the most common exception to the rule indicated above is the obtaining of the data subject’s express and unequivocal consent to such a transfer (Article 20, paragraph 1 of the PDPA).
As no list of jurisdictions ensuring an adequate level of protection currently exists in Macau, the transfer of personal data abroad is subject to previous authorisation by the OPDP, as indicated in 4.1 Restrictions on International Data Issues. If express and unequivocal consent from the data subject is obtained, or if the situation under analysis falls under one of the exceptions provided by the PDPA, a simple notification is sufficient and complies with the legal provisions.
No timeframe currently exists for the procedure for assessing of the level of protection of a given legal order by the OPDP.
The international transfer of data is subject to the requirements referred to in 4.1 Restrictions on International Data Issues.
This issue does not arise in the Macau SAR jurisdiction.
Organisations collecting or transferring data in connection with foreign government data requests, foreign litigation proceedings (eg, civil discovery) or internal investigations are not exempted from the standard requirements set out under the PDPA and shall be subject to the same penalties in case of breach of the existing laws.
This issue does not arise in the Macau SAR jurisdiction.
Big Data Analytics
Big data constitutes an example of the interconnection of data, which is defined as “data processing which consists in the possibility of correlating data in a file, with the data in a file or files kept by another or other controllers, or kept by the same controller for other purposes”.
As stated in 2.5 Enforcement and Litigation, the interconnection of data is subject to previous authorisation by the OPDP, without prejudice to legal or regulatory exceptions (Articles 9 and 22 of the PDPA).
Under the PDPA, profiles involving the personal data of individuals shall be built and processed in a lawful way and in compliance with the principle of good faith, as well as with the principles enunciated in Article 2 of the PDPA, which include the respect of rights, freedoms and guarantees in Macau SAR, and in international instruments and in existing legislation (Article 5, paragraph 1, subparagraph 1 of the PDPA).
Article 6 of the PDPA further provides that the processing of personal data may only be carried out if the data subject has given their unequivocal consent, or if the processing is necessary for:
Other Key Principles
The PDPA stipulates that data shall be exact and, if necessary, shall be updated, with the obligation to ensure that inexact or incomplete data is erased or amended, in compliance with the purposes for which that data was collected or subsequently processed (Article 5, paragraph 1, subparagraph 5 of the PDPA).
Purpose limitation – data shall be collected for specific, determined and lawful purposes, which are directly related to the activity of the data controller, and cannot subsequently be processed in a way that is incompatible with those purposes (Article 5, paragraph 1, subparagraph 2 of the PDPA).
Data minimisation – no specific stipulation, this principle is included in Article 5, paragraph 1, subparagraph 3 of the PDPA (see “Proportionality” below).
Proportionality – data shall be adequate, pertinent and non-excessive in relation to the purposes for which it is collected and processed (Article 5, paragraph 1, subparagraph 3 of the PDPA).
Retention – data shall be kept in a way which allows the identification of its owner only for the duration necessary for the purposes of collection or subsequent processing (Article 5, paragraph 1, subparagraph 5 of the PDPA).
Facial recognition, biometric data and geolocation – despite the absence of specific provisions in the Macau SAR applicable legislation, systems that contain these features shall be considered as personal data collecting and processing systems and therefore should follow the same operational requirements.
Drones – these devices are subject to the limitations referred to above if collecting personal data. In addition, there are requirements imposed by Macau Civil Aviation authorities, who limit the operation of the devices and require the issuance of an appropriate licence.
Disinformation and other online harms – the matter of disinformation has been partially addressed, but outside the scope of personal data protection. In this regard, “civil protection” legislation was passed, making the spread of false rumours during emergency situations a criminal offence.
Pursuant to the Macau SAR authorities increasing concern with data protection matters, most relevant corporations in Macau – including gaming operators, banks, insurance companies and public services concessionaires – have also increased their awareness of the topic, which in many cases has also made these players change their attitude towards the matter. It is therefore now common to find internal policies supervising the use and processing of personal data within some of these entities and it is also common to find some appointing data protection officers despite the absence of a legal requirement to enact either of these measures.
There are no significant audits, investigations or penalties imposed for alleged privacy or data protection violations.
The legal standards are those included in the Macau Administrative Procedure Code and any investigation or audit shall follow the legal principles.
There are no specific regulations on this matter in Macau.
It is possible, under certain circumstances, for penalties to be published after the relevant court decisions have been taken. Such disclosure shall be considered an accessory sanction to the principal penalty imposed.
The Cybersecurity law was recently enacted. Under this Act, private operators of “critical public infrastructure” are required to notify their respective regulators of any “cybersecurity incidents”. This is deemed to cover significant personal data leakage but doesn’t necessarily imply a notification to the OPDP or to the data subjects.
There is no expectation that the PDPA will be revised in the near future in order to put it in line with the EU's General Data Protection Regulation.
The Personal Data Protection Act of Macau (PDPA) was enacted in 2005. It is an almost literal transposition of a Portuguese Act of 1998, and thus follows closely the provisions of the European Union Directive on Personal Data Protection of 1995. In addition, the Act on Video Surveillance in Public Areas was enacted in 2012 by Law No 2/2012.
No independent public authority has yet been established, though, and this is the most significant deviation from the Portuguese Act.
The role of regulator has been assigned to the Office for Personal Data Protection (OPDP), which was established only in 2007 by the Chief Executive Dispatch No 83/2007, as a “project team”, directly under the authority of the Chief Executive and lacking both a permanent legal basis and the status of an independent authority. It has remained a temporary body, established for renewable fixed terms, which were initially of three years, and have been shortened to two-year terms since 2016. In this vein, the OPDP was admitted in 2011 to the Global Privacy Assembly (formerly known as the International Conference of Data Protection and Privacy Commissioners) as an Observer, rather than as a Member.
The OPDP is empowered to enforce those provisions of the PDPA that are of an administrative nature. Criminal cases are reported to, and handled by, the Public Prosecutor’s Office.
The legislative process for establishing an independent public authority has been the subject of some discussion over the years, but there has been no real progress, and none should be expected in 2021. This may be related to an interpretation of the Basic Law of Macau that considers that only the Basic Law may create independent authorities, thus excluding the possibility of local legislation to that effect.
As to the substantive law, it should be noted that the government has not addressed any priorities on the development of personal data protection in the Government Policy Guidelines for 2021, and it doesn’t seem likely that this situation will change in the near future.
Since its enactment in 2005, the PDPA has never been amended. Despite the significant evolution of the European legal texts from which the PDPA took much of its inspiration, the official stance on this subject is that no immediate amendment is required and that any upcoming changes to the PDPA should be met with “wide social consensus”.
It remains to be seen how Macau will deal with matters such as mandatory notification of data breaches, or the requirement for large or public data controllers to set up privacy officers.
Regarding data breaches, it should be noted that the OPDP, while acknowledging that the PDPA has no related provision on this matter, has only stated that the new Cybersecurity Act (Law No 13/2019) already stipulates that the private operators of critical infrastructure have a duty to report any cybersecurity incidents to their respective regulators – however, no specific obligation is set forth in the Cybersecurity Act regarding either the OPDP or the data subjects.
Another relevant matter is the assessment of costs/benefits regarding the notification procedures. Under the PDPA, all data controllers are required to notify the OPDP within eight days of starting the processing of personal data, without prejudice to the cases where prior authorisation must be sought. The actual benefits of this system have been questioned in Europe, following the experience gained under the 1995 Directive and, as a result, it was not kept in the GDPR.
In Macau, the related administrative burden has increased over the years, from an average of 472 notifications per year for the period 2010–2014 to an average of 850 notifications per year for the period 2015–2019.
If we take into account that the acceptance of the notification by the OPDP does not carry any assessment of the legality of the processing itself, it seems reasonable that the European experience on this subject might be considered, and possibly lead to abolishing the duty of notification altogether.
These are examples of legal issues that have not yet been addressed in Macau and there is little expectation that they will be discussed by the Legislative Assembly in the near future.
The OPDP publishes annual reports and these offer some insight on the its approach to enforcement. Two distinct phases have been observed in this regard.
Abuses, by some operators, have been on the rise in recent years, across a range of business areas, including marketing through mobile media, pushing the offer of real estate deals and heavily promoting beauty products and services.
The total annual amount of fines applied for all offences by the OPDP, which was MOP270,000 (USD33,750) in 2018, rose to MOP929,000 (USD116,125) in 2019 and jumped to over MOP12 million (USD1.5 million) just for the 11 first months of 2020.
In addition to the fines, the OPDP has also issued, in three cases, a “public censure of the controller by the public authority”, as provided by the PDPA. These three operators were fined MOP3.24 million (USD405,000), MOP1.08 million (USD135,000) and MOP870,000 (USD108,750), respectively.
The strongly reactive attitude of the OPDP towards these offences is likely to continue unabated.
Transfer of Personal Data to Jurisdictions outside Macau – “White List”
Given the small geographical size of Macau, and the intense business relations between Macau and Mainland China or Hong Kong, and other jurisdictions, a frequent complaint by data controllers over the years has been the lack of a so-called white list of jurisdictions for the purpose of transferring personal data. This is not likely to change in the near future.
The provision in the PDPA (Article 19) that apparently allows for such white lists has been directly transposed from the Portuguese Act of 1998. However, the Portuguese provision was enacted on the assumption that the European Commission would fulfil this role (on the advice of the Working Party of Article 29, at that time). In fact, the wording of Article 19(2) of the Macau PDPA is clearly a case-by-case provision, originally intended (in Portugal) for those situations where the European Commission had not declared, with regard to data transfers, that “the legal system in the destination to which they are transferred ensures an adequate level of protection”.
It goes without saying that the OPDP would face extreme difficulties in assessing that adequacy on a case-by-case basis “in light of all the circumstances surrounding a data transfer operation or set of data transfer operations” and giving “particular consideration (…) to the nature of the data, the purpose and duration of the proposed processing operation or operations, the place of origin and place of final destination, the rules of law, both general and sectoral, in force in the destination in question and the professional rules and security measures which are complied with in that destination” (as per Article 19 of the PDPA).
The OPDP has always solved this problem by resorting in every case to Article 20 of the PDPA (Derogations), which allows for transfers, even where “the legal system does not ensure an adequate level of protection”, provided that “the data subject has given his consent unambiguously to the proposed transfer” and in a number of other limited circumstances (as per Article 20 of the PDPA).
Given the likelihood of no amendment to the PDPA in the near future, it is not expected that the situation on a white list will change.
Data Combination (Interconnection)
The PDPA subjects the processing of personal data involving “data combination” to prior checking and authorisation by the OPDP. It also makes it a criminal offence to “promote or carry out an illegal combination of personal data”, punishable with imprisonment not exceeding one year or a fine not exceeding 120 days (double maxima if sensitive data is involved). This would be the case should the controller fail to secure the said authorisation.
The OPDP has granted 96 authorisations for data combination since 2007, 79 of which concerned controllers in the public administration of Macau. Of the 17 remaining (private sector) authorisations, 14were issued to banks, the most recent having been in 2013.
The trend for the processing of personal data by means of data combination in the public administration has been continuously reinforced by the inclusion, in many of the organic laws of public bureaus and bodies, of provisions allowing data combination for the fulfilment of their statutory duties, which is a legal waiver of the need to seek authorisation from the OPDP (under Article 9, paragraph 1 of the PDPA).
While it is not easy to draw a full picture of the current personal data combination situation in the public sector, it may be assumed that it has become commonplace and will continue to extend to residual and/or new areas in the near future, although not in the private sector, where processing by means of data combination continues to be the exception.
The pandemic brought a whole new scenario to the field of personal data protection and Macau has not been exempt from its consequences in this regard, despite having remained largely untouched by COVID-19, as of March 2021.
The OPDP issued one “generic authorisation” on the subject of “Exemption of Notification and Simplified Notification for the Collection and Processing of the Data of Individuals Entering and Exiting Venues for the Prevention and Control of Infectious Diseases”.
Under this authorisation, the OPDP waived the need for notification of collection of personal data (identification information, information relating to the prevention and control of infectious diseases, information relating to entering and exiting venues), establishing a general retention period of six months for this data and provided that the data is not transferred to a jurisdiction outside Macau.
If the data is to be transferred to a jurisdiction outside Macau, the required notification shall be in a simplified format, supplied by the OPDP.
The government has made a “Health Code” declaration available via a mobile phone app, in which the data subjects type in their ID information, along with a declaration of symptoms (or lack thereof) and recent travel locations, upon which a colour coded QR code is displayed on the device and must be saved into the device’s storage for later retrieval (it is currently valid for six hours). In practical terms, almost every individual in Macau needs to get a “Health Code” daily, for carrying out routine activities.
For gaining access to public buildings, casinos and quite a few other venues, the data subject has the burden of producing their “Health Code”.
Recently, the indication of the general area of residence within Macau has been added as a required field, for the purpose of possible contact tracing.
This seems to be covered by the “generic authorisation” mentioned above and we cannot exclude that other categories of data may eventually be added to the scope of personal data processing under the same.
The Unitary Police Service of Macau (the overall co-ordinator of police authorities in the region) has reported the conclusion of phase four of its video surveillance programme, “Eyes in the Sky”. Under this programme, a total of 1,620 video cameras have been set up in public places. Moreover, an additional 980 cameras are planned for phases five and six, to be installed during 2022 and 2023.
The authorities started, from August 2020, testing the use of facial recognition and vehicle licence plate recognition software, on 200 selected cameras. The official report on these tests is that they gave “satisfactory” results.
As to the retention period of the collected data, the authorities have stated that, under normal circumstances (ie, if no criminal investigation is involved) all the data is automatically erased 60 days after collection.
Under the 2012 Act, the OPDP’s prior opinion is required for each camera, regarding the location, the angle of coverage and its width of field. The OPDP regularly confirms that this has been carried out. However, the particulars of the process are not disclosed to the public.