General Notification
Except where simplified notification or exemption of notification is allowed in a situation, under the following four types of circumstances a data controller shall notify the GPDP.
-
Personal data processing by automatic means
Article 21(1) of the PDPA
The controller or his representative, if any, must notify the public authority in writing within eight days after the initiation of carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes.Businesses using computer to store customer data
Shops installed surveillance camera system inside and outside the shop area
-
When a data subject is physically or legally incapable of giving his consent
Article 21(5) of the Personal Data Protection Act
When personal data are processed according to Article 7(3)(1), non-automatic personal data processing governed by Article 7(1) shall be notified to the GPDP.When a social service organization processes health data or other sensitive data of the elderlies for their health care services, if they cannot provide explicit consent, then the organization should notify the GPDP for the respective processing.
-
Obligation to notify the GPDP in regard to exemptions from providing information to data subjects
Article 10(5)(3) of the PDPA
When personal data are processed for statistical purposes or for the purposes of historical or scientific research, when the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law or administrative regulations, in which case notification to the public authority is required.Example A: When an academic organization for research has to process vast amount of personal data, but it was unable to efficiently provide the respective information to every data subject, or the cost of such provision is too high, then before the actual processing it should notify the GPDP.
Example B: In cases where no actual business or transactions are taking place , and where property registration information are collected for business marketing purposes, and there exists good reasons to believe that it is impossible to provide the respective information to the data subjects, then a real estate agent should notify the GPDP.
-
Transfer of personal data to a location outside the Macao SAR
Article 20(1) of the PDPA
When a data subject has given his explicit consent to the transfer, or where one of the following conditions is met, a transfer of personal data to a destination in which the legal system does not ensure an adequate level of protection within the meaning of paragraph 2 of the preceding Article may be allowed on condition that the public authority is notified.
(1) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject’s request;
(2) the transfer is necessary for the performance or conclusion of a contract concluded or to be concluded in the interests of the data subject between the controller and a third party;
(3) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise of defence of legal claims;
(4) the transfer is necessary in order to protect the vital interests of the data subject;
(5) the transfer is made from a register which according to laws or administrative regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, provided the conditions laid down in law for consultation are fulfilled in the particular case.When the network server of an organization locates outside the Macao SAR
When an organization uses the application on a server locates outside the MSAR to process personal data