Complaint Case Notes

編號: 0135/2015/IP

標題: Publicizing others’ personal data on a social networking website

立案原因: Complaint


    Complainant of the current case complained to the GPDP (Office for Personal Data Protection) that her photo was uploaded to, without her consent, the user account of K, who is the spouse of A, with a social networking site.  A also created a post, with the said photo, and left negative comments.  The Complainant believed that this was a violation of the PDPA (Personal Data Protection Act) and therefore requested the GPDP to investigate. 


    During the investigations, A pointed out that his wife, K, rarely came home early and seldom took care of the family and believed that he embroiled in such a bad marriage only because of the Complainant. Therefore he uploaded a photo, showing both his wife and the Complainant, to her social networking account through the respective application on her unwanted mobile phone.  In this photo, only the image of the spouse was blurred, but not that of the Complainant.   
  The photo uploaded by A clearly revealed the Complainant’s image and can be used to identify her identity; therefore this should be classified as the “personal data” that Article 4(1)(1) of the PDPA governs.  This photo was uploaded without establishing any privacy restrictions, which means it was visible to anyone online.  This revealed A’s intention to disseminate such information and showed that he did not care whether the image was widely accessible or not.  As such, the current case should be treated as the “systematic communication and dissemination” that Article 3(2) describes.  According to Article 3(1) of the same Law, A’s publicizing of the Complainant’s photo on the social networking site is an automatic processing of personal data that is subject to the PDPA. 
  The publicizing of the said photo should be under any of the legally governed conditions, regulated by Article 6 of the PDPA, so that the respective data processing is legitimate.  On the contrary, the said photo was publicized without the Complainant’s consent and also proven is that the current case does not involve the performance of contract, compliance with a legal obligation, protection of the anyone who is physically or legally incapable of giving his consent, a task carried out in the public interests or in the exercise of official authority, etc.  As a consequence, paragraphs (1) to (4) of Article 6 do not apply and the processing of personal data of the current case would be legitimate only if it fulfilled Article 6(5) of the PDPA. 
  A enjoys freedom of speech and has the right to comment on the Complainant, but this is not an absolute right that the Complainant’s right to image and right to reputation have to be disrespected. A vented out his frustration and decided to publicize the Complainant’s personal data online, resulting in damages to the legally protected interests of the Complainant.  In addition, publicizing personal data on social networking sites will ensue uncontrollable consequences—any user can access, forward, save and comment on the respective post.  Considering the different interests the current case involved, A’s interests were not found prevailing over those of the Complainant, and therefore A failed to legitimize his processing of personal data according to Article 6(5) of the PDPA.
  To sum up, A’s publicizing of the said photo on the social networking site violated Article 6 of the PDPA and constituted an administrative offense.


    Considering that it was the first time A violated the PDPA and the cooperativeness during the investigations, in addition to the removal of the post, the GPDP decided to impose a penalty of MOP$8,000 according to Article 33(2) of the same Law.

Please refer to Article 3, 4, 6 and 33 of the Personal Data Protection Act.