Complaint Case Notes

編號: 0014/2016/IP

標題: Domestic helper published former employer’s personal data

立案原因: Complaint


    A was the former domestic helper of the Complainant.  Since the Complainant’s wife publicly criticized A in a public discussion group of a social networking site, in order to make a clarification A sent a picture to her friend B. This picture showed the agreement of the employment termination that A had concluded with the Complainant.  B was asked by A to publish this picture on the same discussion group. Later, A, through her personal account, also posted the same picture to the said discussion group.
  The Complainant believed that both A and B contravened the Personal Data Protection Act (PDPA) and therefore requested the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to follow up.   


    The mentioned picture, which showed the agreement of the employment contract termination, contained the name, ID numbers, address and signature of the Complainant.  For this reason, such information of the Complainant should qualify as personal data under Article 4(1)(1) of the PDPA.  Since that picture was published in the public discussion group by both A and B, anyone who had access to the group could view the data therein.  This demonstrated A’s and B’s intent to disseminate the data to the public, and this should not be an exception as provided for in Article 3(2) of the PDPA.  Consequently the Complainant’s personal data, as published by both A and B, should be subject to the PDPA according to its Article 3(1).  
  Notwithstanding B claimed that he was asked by A to publish online the mentioned personal data, it would be B’s autonomous decision to publish it for A or not.  Once the data was published, B should assume the respective responsibility.  With regard to the processing of the Complainant’s personal data, B and A should have satisfied the criteria of legitimate processing as provided in Article 6 of the PDPA.  
  Before publishing the said data, both A and B failed to obtain the consent from the Complainant and therefore the criterion of legitimate data processing as based on the “data subject’s explicit consent”, set out in Article 6 of the PDPA, was not satisfied.  When the incident took place the employment relationship had already been terminated, thus such publishing of information by A and B, even for clarification, was unnecessary for the performance of the concerned labour contract.  As a consequence this should not be a situation to which Article 6(1) of the PDPA, or Article 6(2) to Article 6(4) should apply.    
  In an attempt to clarify the criticism against her left online by the Complainant’s wife, A published on the discussion group the agreement of the employment termination that she had signed with the Complainant.  However, it was unnecessary for the Complainant’s personal data to be published.  In addition, once the data was made public, any subsequent access and forwarding would become uncontrollable.   Based on the above, it showed that A’s interests should not override the interests of the Complainant.  To B, she was not a data subject of the incident and was unrelated to the tussle between A and the Complainant.  B, as induced by A, rashly published the Complainant’s personal data without having a clear understanding of the incident; in addition, B had no legitimate interests in this case.  After considering the above, the interests of both A and B did not override those of the Complainant, and therefore they failed to satisfy the criteria of legitimate data processing as set out in Article 6(5) of the PDPA.    
  To sum up, the publishing of the Complainant’s data, by A and B, on a social networking site failed to comply with Article 6 of the PDPA. 


    Although it was the first time A and B contravened the PDPA and they were cooperative during the investigations, it is impossible to restrict others’ forwarding of the Complainant’s data after the online publishing.  In addition, it is impossible to request anyone who had stored such data to delete them.  Moreover, A also made the Complainant’s personal data publicly accessible online twice.  Taking into account of the mentioned, the GPDP decided to, according to Article 33(2) of the PDPA, impose A and B the penalty of MOP$10000 and MOP 8000 respectively.  

Please refer to Article 3, 4, 6, and 33 of the Personal Data Protection Act.