Complaint Case Notes

編號: 0090/2016/IP

標題: Publishing referee’s data

立案原因: Complaint


    When A participated in a basketball competition, he felt dissatisfied with the unfair ruling given by the officiated referee, who was also the Complainant of the current case.  Afterwards, with his account on a networking site, Account X, A published the referee’s photo, taken during the event, in Group Y, one of the public discussion groups there.
  The Complainant believed that A was in breach of the PDPA (Personal Data Protection Act) and therefore requested the GPDP (Gabinete para a Protecção de Dados Pessoais) to investigate. 


    Under Article 4(1)(1) of the PDPA, as long as the said photo showing the image of the Complainant’s face, then it qualifies as personal data.  Since A’s personal account, Account X, on the social networking site was not established with access limitation, in addition that Group Y is a publicly accessible discussion group, which means anyone can access the posts therein.  This illustrated that A, through his account X on the networking site, created a post in Group Y to publish the photo of the Complainant that gave rise to intentional dissemination, and this did not fit for the purpose as Article 3(2) of the PDPA describes.  As such, the processing of the Complainant’s personal data by A is subject to the PDPA, according to its Article 3(1).
   In such an instance, A should have achieved any of the criteria of legitimate data processing laid down in Article 6 of the PDPA for processing the Complainant’s personal data.  Before publishing the said post, A had not obtained the prior consent from the data subject, set out in Article 6 of the PDPA, and therefore he failed to achieve the criterion of legitimate processing that is based on the “unambiguous consent of the data subject”.  Additionally, the published data, on the said website, could not be any of the situations as described in Paragraph (1) to (4) of Article 6 of the PDPA. 
  A published the mentioned photo in order to show his dissatisfaction over the referee’s judgment; this would not change the match result, however.  In the event of any disagreement over the referee’s discretion, A could file his complaint legally to the organizer, and it was unnecessary to publicize the Complainant’s photo online.  Revealing the said photo on the social networking site, to which the general public was accessible, would not satisfy A’s legal interests, quite the reverse the sequential accesses and forwarding of the photo by others would thrive uncontrollably. Taking into account of the varying interests concerned, the GPDP is in the view that A’s interests did not override those of the Complainant. Consequently A did not process the mentioned personal data based on the legitimate criteria as set out in Article 6(5) of the PDPA. 
   In sum, publicizing the mentioned data by A on the social networking site is a violation of Article 6 of the PDPA.  


    To sum up, A’s publicizing of the mentioned photo, by using his account with the social networking site, would give the Complainant’s personal data ungovernable forwarding and accesses by others.  Along the same line, this would also lead to others’ unruly storing of such data.   Considering that, however, it was A’s initial violation of the PDPA and his cooperativeness during the investigation, the PDPA decided to impose a penalty of MOP$8000 according to Article 33(2) of the PDPA, along with an additional penalty, in accordance with Article 43(1) of the same Law, to delete the respective post from the discussion group. 

Please refer to Article 3, 4, 6, 33 and 43 of the PDPA.