Macau – Data Protection 2017

19 July, 2017

 

1 Relevant Legislation and Competent Authorities 
 

1.1        What is the principal data protection legislation?

 

Law no. 8/2005, of August 22 – Personal Data Protection Act (“Lei da Protecção de Dados Pessoais” in Portuguese, or LPDP) of the Macau Special Administrative Region (henceforth “MSAR”).

 

1.2        Is there any other general legislation that impacts data protection?

 

The Chief Executive Dispatch no. 83/2007, of March 12 (and ancillary legislation) created the Office for Personal Data Protection (“Gabinete de Protecção de Dados Pessoais” in Portuguese, or “GPDP”).

 

1.3        Is there any sector-specific legislation that impacts data protection?

 

Yes – Law no. 2/2012, of March 19, on the Legal Regime of video surveillance in public spaces (“Regime jurídico da videovigilância em espaços públicos” in Portuguese).

 

1.4        What is the relevant data protection regulatory authority(ies)?

 

The GPDP is the entity responsible for the monitoring and coordination of compliance with the LPDP, as well as for the establishment of an adequate confidentiality regime and the monitoring of its execution.

 

2 Definitions

 

2.1        Please provide the key definitions used in the relevant legislation:

 

“Personal Data”

 

“Personal Data” is defined as “any information of any kind and regardless of the respective format, pertaining to an identified or identifiable natural person.  An identifiable person is one who can be identified, directly or indirectly, namely by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity”.

 

“Sensitive Personal Data”

 

“Sensitive Personal Data” is referred to in article 7 of the LPDP, which prohibits the processing of personal data concerning political or philosophical beliefs, political or trade-union membership, religious faith, private life, racial or ethnic origin, as well as the processing of data concerning health and sex life, including genetic information, with the exceptions foreseen by the LPDP.

 

“Processing”

 

“[Data] Processing” is defined as “any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction”.

 

“Data Controller”

 

The term “Data Controller” doesn’t exist as such in the LPDP.  The closest definition pertains to “[entity] responsible for processing”, which is defined as “the natural or legal person, public authority, agency or any other body which alone or jointly with others, determines the purposes and means of the processing of personal data” (henceforth “data controller”).

 

“Data Processor”

 

The term “Data Processor” also does not exist as such in the LPDP.  The closest definition pertains to “subcontractor”, which is defined as “a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller”.

 

“Data Subject”

 

“Data Subject” is defined as “the individual person to which the data being processed pertains”.

 

Other key definitions – please specify (e.g., “Pseudonymous Data”, “Direct Personal Data”, “Indirect Personal Data”)

 

Other definitions provided by the LPDP include:

 

“personal data file” (“file”) is defined as “any structured set of personal data which are accessible according to specific criteria, regardless of the form or type of their creation, storage and organisation”;

 

“third party” is defined as “any natural or legal person, public authority, agency or any other body other than the data subject, the data controller, the subcontractor or the persons who, under the direct authority of the data controller or of the subcontractor, are authorised to process the data”;

 

“recipient” is defined as “a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a legal stipulation or of a regulatory requirement of organic nature shall not be regarded as recipients”;

 

“data subject’s consent” is defined as “any freely given specific and informed indication of his/her wishes by which the data subject signifies his agreement to personal data relating to him being processed”; and

 

“interconnection of data” is defined as “data processing which consists in the possibility of correlating data in a file with the data in a file or files kept by another or other controllers, or kept by the same controller for other purposes”.

 

3 Key Principles 
 

3.1        What are the key principles that apply to the processing of personal data?

 

Transparency

 

Data processing shall be made in a transparent way and in strict compliance with the respect of privacy (article 2).

 

Lawful basis for processing

 

Data shall be processed in a lawful way and in compliance with the principle of good faith, as well as with the principles enunciated in article 2 of the LPDP, which include the respect of rights, freedoms and guarantees in the MSAR, in international instruments and in existing legislation (article 5, paragraph 1, subparagraph 1 of the LPDP).

 

Article 6 of the LPDP further provides that the processing of personal data may only be carried out if the data subject has given his/her unequivocal consent, or if the processing is necessary to the:

 

• execution of contracts or contracts in which the data subject is a party or prior to the formation of the contract or declaration of negotiation will be made at his request;
• compliance with legal obligation to which the controller is subject;
• protection of vital interests of the data subject, if he/she is physically or legally incapable of giving his/her consent;
• execution of a mission of public interest or in the exercise of powers of public authority in which the controller (or a third party to whom the data are transmitted) is invested; and
• pursuit of legitimate interests of the controller or third party to whom the data are transmitted, provided that the interests or rights, freedoms and guarantees of the data subject shall not prevail.

 

Purpose limitation

 

Data shall be collected for specific, determined and lawful purposes, which are directly related to the activity of the data controller, and cannot subsequently be processed in a way that is incompatible with those purposes (article 5, paragraph 1, subparagraph 2 of the LPDP).

 

Data minimisation

 

No specific stipulation – this principle is included in article 5, paragraph 1, subparagraph 3 of the LPDP (see “Proportionality” above).

 

Proportionality

 

Data shall be adequate, pertinent and non-excessive in relation to the purposes for which they are collected and processed (article 5, paragraph 1, subparagraph 3 of the LPDP).

 

Retention

 

Data shall be kept in a way which allows the identification of its owner only for the duration necessary for the purposes of collection or subsequent processing (article 5, paragraph 1, subparagraph 5 of the LPDP).

 

Other key principles – please specify

 

The LPDP also stipulates that data shall be exact and, if necessary, shall be updated, with the obligation to ensure that inexact or incomplete data are erased or amended, in compliance with the purposes for which data was collected or subsequently processed (article 5, paragraph 1, subparagraph 5 of the LPDP).

 

4 Individual Rights 
 

4.1        What are the key rights that individuals have in relation to the processing of their personal data?

 

Access to data

 

The LPDP guarantees the right of the data subject to information regarding the identity of the data controller or its representative, the purposes of processing and other ancillary information (article 10 of the LPDP), as well as the right of access to all his/her data (article 11 of the LPDP).

 

Correction and deletion

 

The right of access includes the right to rectify, delete or block data which processing does not comply with the LPDP, namely in regards to the incomplete or inexact character of those data (article 11, paragraph 1, subparagraph 4 of the LPDP).

 

Objection to processing

 

The data subject has the right to object at any time, under lawful and serious reasons relating to his/her specific case, that his/her data  be the subject of processing, in which case, under justified objection, the processing shall not concern those data (article 12, paragraph 1 of the LPDP).

 

Objection to marketing

 

The data subject also has the right to object, on request and free of charge, to processing of personal data concerning him/her for direct marketing or any other form of commercial prospecting, and also has the right to be previously informed of any transfer of data to third parties for the purposes of direct marketing or usage for third parties, as well as the right to object, free of charge, to such transfer or usage (article 12, paragraph 2 of the LPDP).

 

Complaint to relevant data protection authority(ies)

 

The LPDP provides for the possibility to submit a complaint to the GPDP, without prejudice to the possibility of resorting to administrative or jurisdictional means to guarantee the compliance with legal and regulatory provisions (article 28 of the LPDP).

 

Other key rights – please specify

 

The LPDP also includes the right not to be subject to automated individual decisions (article 13 of the LPDP) and the right to an indemnity in cases of illegal processing of data or of any act infringing legal or regulatory provisions regarding data protection (article 14 of the LPDP).

 

5 Registration Formalities and Prior Approval 
 

5.1        In what circumstances is registration or notification required to the relevant data protection regulatory authority(ies)? (E.g., general notification requirement, notification required for specific processing activities.)

 

Any data processing is subject to notification of the GPDP, to be made within eight days of the start of such processing by the data controller or by its representative (article 21, paragraph 1 of the LPDP).

 

If there is transfer of personal data to a destination outside the MSAR, the opinion of the GPDP must be sought to confirm if such destination ensures an adequate level of protection.  However, if the data subject has given his/her unequivocal consent to the transfer, or if that transfer is necessary under the cases provided by law – i.e., it is necessary for the formation of a contract between the data subject and the data controller, for preliminary measures for the formation of said contract by request of the data subject, among others (articles 19, paragraph 1 and 20, paragraph 1 of the LPDP).

 

The processing of sensitive data or of data related to credit and solvency of its subjects, the interconnection of personal data and the usage of personal data for purposes which are not decisive to the collection of such data are subject to previous authorisation by the GPDP, without prejudice to legal or regulatory exceptions (article 22).

 

5.2        On what basis are registrations/notifications made? (E.g., per legal entity, per processing purpose, per data category, per system or database.)

 

As previously indicated, any data processing (see “[data] processing” definition in paragraph 2.1 above) is subject to notification of the GPDP, regardless of the entity responsible for the processing.

 

5.3        Who must register with/notify the relevant data protection authority(ies)? (E.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation.)

 

The data controller or its representative has the obligation to notify the GPDP, as per article 21, paragraph 1 of the LPDP.

 

5.4        What information must be included in the registration/notification? (E.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes.)

 

Any requests for an opinion or authorisation, as well as notifications, sent to the GPDP shall contain the following information (article 23 of the LPDP):

 

• name and address of the data controller and, if applicable, its representative;
• purpose of data processing;
• a description of the categories of data subjects and data or categories of personal data concerning said data subjects;
• recipients or categories of recipients to whom the data may be disclosed and under which conditions;
• entity in charge of the processing of data, if not the data controller;
• possible interconnection of processing of personal data;
• personal data storage period;
• form and conditions for data subjects to have knowledge or to amend their respective personal data;
• expected data transfers to third countries or territories; and
• general description enabling a preliminary assessment of the suitability of measures taken to ensure the adequate level of protection under the LPDP.

 

In case of sensitive data processing (article 7, paragraph 2 of the LPDP), of the creation and maintenance of records regarding suspicions of illegal activities, criminal offences and administrative offences (article 8, paragraph 1 of the LPDP), and of requests for authorisation, as well as those pertaining to records of processing of personal data shall indicate, at least:

 

• the person responsible for the file and, where appropriate, his representative;
• the categories of personal data processed;
• the purposes for which the data are intended and the categories of entities to whom it may be transmitted;
• how the right of access and of rectification of data can be exercised;
• possible interconnections of processing of personal data; and
• expected data transfers to third countries or territories.

 

5.5        What are the sanctions for failure to register/notify where required?

 

The lack of notification or authorisation request as provided by the LPDP entails a fine between 2,000 and 20,000 MOP for individuals and a fine between 10,000 and 100,000 MOP for legal persons.

 

The fines are increased to twice the amount indicated above if the data are subject to previous authorisation.

 

5.6        What is the fee per registration (if applicable)?

 

Currently, no fee is required.

 

5.7        How frequently must registrations/notifications be renewed (if applicable)?

 

This is not applicable.

 

5.8        For what types of processing activities is prior approval required from the data protection regulator?

 

As indicated above, the processing of sensitive data or of data related to credit and solvency of its subjects, the interconnection of personal data and the usage of personal data for purposes which are not decisive to the collection of such data are subject to previous authorisation by the GPDP, without prejudice to legal or regulatory exceptions (article 22).

 

5.9        Describe the procedure for obtaining prior approval, and the applicable timeframe.

 

The submission of a previous authorisation request is similar to the notification procedure, without prejudice to the information indicated in paragraph 5.4 above.  Once the authorisation request is approved, it shall be published in the Official Gazette of the MSAR, specifying the purposes of the processing, the data or categories of data to be processed, the category or categories of data holders, the recipients or categories of recipients to whom the data may be disclosed and the data storage period.

No timeframe currently exists for the procedure of prior approval.

 

6 Appointment of a Data Protection Officer 
 

6.1        Is the appointment of a Data Protection Officer mandatory or optional? 

 

Optional – such possibility is not previewed by the LPDP.

 

6.2        What are the sanctions for failing to appoint a mandatory Data Protection Officer where required?

 

This is not applicable.

 

6.3        What are the advantages of voluntarily appointing a Data Protection Officer (if applicable)?

 

This is not applicable.

 

6.4        Please describe any specific qualifications for the Data Protection Officer required by law. 

 

This is not applicable.

 

6.5        What are the responsibilities of the Data Protection Officer, as required by law or typical in practice?

 

This is not applicable.

 

6.6        Must the appointment of a Data Protection Officer be registered/notified to the relevant data protection authority(ies)?

 

This is not applicable.

 

7 Marketing and Cookies 
 

7.1        Please describe any legislative restrictions on the sending of marketing communications by post, telephone, email, or SMS text message. (E.g., requirement to obtain prior opt-in consent or to provide a simple and free means of opt-out.)

 

As indicated above, data shall be collected for specific, determined and lawful purposes, which are directly related to the activity of the data controller, and cannot subsequently be processed in a way that is incompatible with those purposes (article 5, paragraph 1, subparagraph 2 of the LPDP).

 

Also, as stated in paragraph 3.1 above, the processing of personal data may only be carried out if the data subject has given his/her unequivocal consent, or if the processing is necessary to the cases referred to in article 6 of the LPDP.

 

Hence, if the entity has declared marketing communications as one of the purposes of processing, and if the data subject has given his/her consent to such purpose, such processing is lawful under the LPDP.

 

7.2        Is the relevant data protection authority(ies) active in enforcement of breaches of marketing restrictions?

 

This is not applicable.

 

7.3        Are companies required to screen against any “do not contact” list or registry?

 

This is not applicable.

 

7.4        What are the maximum penalties for sending marketing communications in breach of applicable restrictions?

 

If the measures indicated in question 7.1 have not been taken, the entity responsible for treatment is liable to an administrative offence, punishable with a fine between 8,000 and 80,000 MOP, for the non-compliance with the obligations under article 6 of the LPDP (article 33 of the LPDP).

 

7.5        What types of cookies require explicit opt-in consent, as mandated by law or binding guidance issued by the relevant data protection authority(ies)?

 

The LPDP does not specifically provide for this case – hence, opt-in consent must be sought with the data subject.

 

7.6        For what types of cookies is implied consent acceptable, under relevant national legislation or binding guidance issued by the relevant data protection authority(ies)?

 

The LPDP does not specifically provide for this case – see previous answer.

 

7.7        To date, has the relevant data protection authority(ies) taken any enforcement action in relation to cookies?

 

This is not applicable.

 

7.8        What are the maximum penalties for breaches of applicable cookie restrictions?

 

This is not applicable.

 

8 Restrictions on International Data Transfers 
 

8.1        Please describe any restrictions on the transfer of personal data abroad.

 

The transfer of personal data abroad can only take place under the stipulations of the LPDP and only if the legal order to which data are transferred ensures an adequate level of protection.  Such level of protection is assessed by the GPDP on a case-by-case basis (article 19 of the LPDP).

 

8.2        Please describe the mechanisms companies typically utilise to transfer personal data abroad in compliance with applicable transfer restrictions.

 

The transfer of data abroad may be possible under the exceptions provided by the LPDP, which include the need of such transfer for the formation of a contract between the data subject and the data controller and for preliminary measures for the formation of said contract by request of the data subject, among others.

 

However, the most common exception to the rule indicated above is the obtaining of data subject’s unequivocal consent to the transfer (article 20, paragraph 1 of the LPDP).

 

8.3        Do transfers of personal data abroad require registration/notification or prior approval from the relevant data protection authority(ies)? Describe which mechanisms require approval or notification, what those steps involve, and how long they take.

 

As no list of legal orders ensuring an adequate level of protection currently exists, the transfer of personal data abroad is subject to previous authorisation by the GPDP, as indicated above.  If unequivocal consent of the data subject is obtained, or if the situation under analysis falls under one of the exceptions provided by the LPDP, a simple notification is enough.

 

No timeframe currently exists for the procedure of assessment of the level of protection of a given legal order by the GPDP.

 

9 Whistle-blower Hotlines 
 

9.1        What is the permitted scope of corporate whistle-blower hotlines under applicable law or binding guidance issued by the relevant data protection authority(ies)? (E.g., restrictions on the scope of issues that may be reported, the persons who may submit a report, the persons whom a report may concern.)

 

No provisions exist in the LPDP regarding whistle-blower hotlines nor binding guidance issued by the GPDP.  As indicated in paragraph 4.1 above, the LPDP provides for the possibility to submit a complaint to the GPDP, without prejudice to the possibility of resorting to administrative or jurisdictional means to guarantee the compliance with legal and regulatory provisions (article 28 of the LPDP).

 

9.2        Is anonymous reporting strictly prohibited, or strongly discouraged, under applicable law or binding guidance issued by the relevant data protection authority(ies)? If so, how do companies typically address this issue?

 

No provisions exist in the LPDP regarding this issue, and to the best of our knowledge, there is no binding guidance on this matter.

 

9.3        Do corporate whistle-blower hotlines require separate registration/notification or prior approval from the relevant data protection authority(ies)? Please explain the process, how long it typically takes, and any available exemptions.

 

This is not applicable.

 

9.4        Do corporate whistle-blower hotlines require a separate privacy notice?

 

This is not applicable.

 

9.5        To what extent do works councils/trade unions/employee representatives need to be notified or consulted?

 

This is not applicable.

 

10 CCTV and Employee Monitoring 
 

10.1      Does the use of CCTV require separate registration/notification or prior approval from the relevant data protection authority(ies)? 

 

The LPDP applies to video surveillance and to other means of capturing, processing and disseminating sounds and images to identify persons, whenever the controller is domiciled or headquartered in the MSAR, or uses a provider of access to computer and telematic networks established there (article 3, paragraph 3 of the LPDP).

 

No other specific stipulations exist for video surveillance, with the exception of Law no. 2/2012, of March 19, which establishes the legal framework of video surveillance in public spaces by the security forces and services of the MSAR.

As the use of CCTV is a separate processing of data, it shall require a separate notification to the GPDP under the law.

 

10.2      What types of employee monitoring are permitted (if any), and in what circumstances?

 

No specific provision exists on this matter.

 

10.3      Is consent or notice required? Describe how employers typically obtain consent or provide notice.

 

Under the LPDP, the processing of data can only take place if the data subject has given his/her unequivocal consent to the transfer, or if that transfer is necessary under the cases provided by law (see paragraph 3.1 above).

 

As the consent of the data subject is not feasible in such situation, the LPDP also allows for the processing of data if such processing is necessary for pursuing legitimate interests of the data controller or third party to whom the data are communicated, insofar as the interests or rights, freedoms and guarantees of the data subject do not prevail.

 

10.4      To what extent do works councils/trade unions/employee representatives need to be notified or consulted?

 

No specific provision exists on this matter.

 

10.5      Does employee monitoring require separate registration/notification or prior approval from the relevant data protection authority(ies)? 

 

No specific provision exists on this matter.

 

If the monitoring constitutes a set of processing under the LPDP, then it is possible to submit a single notification under article 21, paragraph 1 of said law.

 

11 Processing Data in the Cloud 
 

11.1      Is it permitted to process personal data in the cloud? If so, what specific due diligence must be performed, under applicable law or binding guidance issued by the relevant data protection authority(ies)?

 

No specific provision exists on this matter – the stipulations of the LPDP (namely those concerning security and confidentiality of data processing, as well as those regarding the transfer of personal data to a destination outside the MSAR) shall apply.

 

11.2      What specific contractual obligations must be imposed on a processor providing cloud-based services, under applicable law or binding guidance issued by the relevant data protection authority(ies)?

 

No specific provision exists on this matter – see answer above.

 

12 Big Data and Analytics 
 

12.1      Is the utilisation of big data and analytics permitted? If so, what due diligence is required, under applicable law or binding guidance issued by the relevant data protection authority(ies)?

 

“Big data” constitutes a case of interconnection of data, which is defined as “data processing which consists in the possibility of correlating data in a file with the data in a file or files kept by another or other controllers, or kept by the same controller for other purposes”.

 

As stated above, interconnection of data is subject to previous authorisation by the GPDP, without prejudice to legal or regulatory exceptions (articles 9 and 22 of the LPDP).

 

13 Data Security and Data Breach 
 

13.1      What data security standards (e.g., encryption) are required, under applicable law or binding guidance issued by the relevant data protection authority(ies)?

 

In accordance with the LPDP, the data controller shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss, unauthorised disclosure or access, inter alia, when processing involves transmission over a network, and against any form of unlawful processing, having regard to the available technical knowledge and to the costs resulting from its implementation, an adequate level of security with regard to the risks involved with the processing and the nature of the data to be protected (article 15, paragraph 1 of the LPDP).

 

The LPDP also provides for special security measures in case of sensitive data processing and of the creation and maintenance of records regarding suspicions of illegal activities, criminal offences and administrative offences (articles 7 paragraph 2, 8 paragraph 1 and 16 paragraph 1 of the LPDP), namely appropriate measures to:

 

• prevent unauthorised access to the premises used for the processing of such data (control of entry to the premises);
• prevent data carriers from being read, copied, altered or removed by an unauthorised person (control of data carriers);
• prevent unauthorised entry, as well as unauthorised disclosure, alteration or deletion of inserted personal data (insertion control);
• prevent automated data processing systems from being used by unauthorised persons through data transmission facilities (monitoring of use);
• ensure that authorised persons can only access the data covered by the authorisation (access control);
• ensure the verification of entities to whom personal data may be transmitted through data transmission facilities (transmission control);
• ensure that there is a posteriori verification, within a period appropriate to the nature of the processing, to be laid down in the rules applicable to each sector, of the personal data to be introduced, when and by whom (introduction control); and
• prevent the data from being read, copied, altered or disposed of in an unauthorised manner during the transmission of personal data and in the transport of its medium (transport control).

 

Also, the LPDP requires that the systems must ensure the logical separation of data on health and sexual life, including genetic data, from other personal data (article 16, paragraphs 1 and 3 of the LPDP).

 

In case of sensitive data indicated in article 7 of the LPDP, the GPDP may require the encryption of data for transmissions over a network, if said transmission may imperil rights, freedoms and guarantees of the data subjects (article 16, paragraph 4 of the LPDP).

 

13.2      Is there a legal requirement to report data breaches to the relevant data protection authority(ies)? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expects voluntary breach reporting.

 

No specific provision exists on this matter.

 

13.3      Is there a legal requirement to report data breaches to individuals? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expects voluntary breach reporting.

 

Without prejudice to the right of information, which may be exercised by the data subject, no specific provision exists on this matter.

 

13.4      What are the maximum penalties for security breaches?

 

The non-compliance with the special security measures for sensitive data processing and for the creation and maintenance of records regarding suspicions of illegal activities, criminal offences and administrative offences, set out in article 16 of the LPDP and described in question 13.1 above, is an administrative offence which may entail a fine between 4,000 and 40,000 MOP.

 

Although the LPDP provides penalties for undue access, as well as for tampering or destruction of personal data, it does not specifically provide for security breaches by the data controller.  It should be noted, however, that the LPDP mandates that the data controller shall present the notification/authorisation request with a general description of the security measures indicated in question 13.1 above, so that the GPDP may evaluate the adequacy of such measures.  If the GPDP notifies the abovementioned entity to address any insufficiency in the security measures and no remedy is taken, then a fine between 2,000 and 20,000 MOP for individuals and a fine between 10,000 and 100,000 MOP for legal persons may be imposed.

 

14 Enforcement and Sanctions 
 

14.1      Describe the enforcement powers of the data protection authority(ies).