Complaint Case Notes

編號: 0129/2015/IP

標題: Publishing the personal data of debtor’s child

立案原因: Complaint


    A and B were friends, and the latter was the guarantor of the former’s loan.  Later, A went missing and B paid the loan for him after the loan was defaulted on.  To locate A, B doxed him by publishing his photo, in which his underage son C also appeared, on a public discussion group of a social networking site. 
  C’s mother believed that publishing C’s data online was a violation of the Personal Data Protection Act (PDPA) and therefore requested the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to follow up.


    B published a photo that showed the face of C, and this qualified as the latter’s personal data according to Article 4(1)(1) of the PDPA.  According to B, he intended to collect his debt and therefore published the mentioned photo on a online public discussion group, which was, however, accessible by all respective users, this showed that B intended to disseminate the photo and therefore this was out of the scope of Article 3(2) of the PDPA.  According to Article 3(1) of the same Law, B’s publishing of the photo should be subject to the PDPA.  
   With regard to B’s processing of personal data, it should be based on any of the criteria of legitimate data processing as set out in Article 6 of the PDPA.  Since C is underage (menor), and the Macao Civil Code laid down that C’s alieni juris (incapacity/incapacidade) should be made up for (suprimento) with his parent’s parental rights (poder paternal). Before B published C’s photo, the latter’s parents had never given their consent to the publishing; as a consequence the former failed to achieve the criterion of legitimate data processing—the explicit of consent given by the data subject—as set out by Article 6 of the PDPA.  Furthermore, B’s publishing of C’s personal data on a social networking site did not fall within the ambit of Article 6(1) to 6(4) of the PDPA.
   B was trying to locate A, and he thus published the said photo; but C was not related to the money disputes between these two parties.  In other words, it was unnecessary for B to publish C’s photo. Not only the publishing of the mentioned photo could not fulfill B’s legal interests, but also he had very little control over others’ subsequent accessing and forwarding of the said data.   Since B did not have any lawful interests in publishing the said photo and therefore failed to satisfy the criterion of legitimate data processing as governed by Article 6(5) of the PDPA. 
   To sum up, B’s publishing of C’s personal data on a public website contravened Article 6 of the PDPA. 


    B’s publishing of the personal data of C in a public discussion group, of a social networking site, made subsequent forwarding by others uncontrollable, and asking those who had stored such data to delete them was beyond the bounds of possibility.  Considering that it was B’s initial offense and he was cooperative during the investigation, the GPDP decided to impose a penalty of MOP$8000 according to Article 33(2) of the PDPA.

Please refer to Article 3, 4, 6 and 33 of the Personal Data Protection Act.