Complaint Case Notes

編號: 0117/2016/IP

標題: Make-up school asked models to sign agreement to take portrait photos of promotional uses

立案原因: Complaint


      The current case stemmed from a student, who is a friend of the Complainant, of Make-up School A (hereinafter as School A). The Complainant mentioned that she was invited, by her friend, as a model for the make-up class exam. During the exam period, according to the Complainant, School A mentioned that it would lower the students’ exam grades if the models refused to sign the titled agreement. This agreement also collected identity information from the models and the Complainant believed that these incidents violated the PDPA (Personal Data Protection Act) and therefore requested the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to follow up.


      When the models were present, School A distributed the mentioned agreement and asked them to also fill in their names, ID numbers, contact numbers and email, in addition to collecting their ID copies. The processing of the models’ personal data by School A should be regulated by the PDPA under its Article 4(1)(1) and 3(1).
    The mentioned personal data as collected by the agreement, according to School A, aimed at future contacts and verifying the identities of the signatories, namely the models. The processing of personal data by School A was lawful, specified and legitimate. The types of personal data as collected were also compatible with the processing purposes; therefore violations of Article 5(1)(2) and 5(1)(3) of the PDPA were not justified.
    On the other hand, the personal data processing undertaken by School A should fulfill any of the criteria of legitimate data processing as set out in Article 6 of the PDPA. If the models voluntarily signed the agreement and submitted their personal data, the mentioned data processing was legitimate on the basis of the “data subjects’ explicit consent”, which was one of the criteria of legitimate data processing as Article 6 of the PDPA governs. With regard to the lowering of exam grades if the models refused signing the agreement, as the Complainant mentioned, the GPDP, in order to ascertain whether the agreements were forced to be signed, tried to obtain more information from some of the randomly selected models. However, no evidence proved what the Complainant mentioned. On the other hand, Article 4(1)(9) of the PDPA requires “consent of a data subject” must be based on his clear indication of wishes that was also specific, informed and via his free choice. In view of the current case, the GPDP also reminded School A that the agreement must be distributed to the models before the exam actually starts and, to ensure the validity of the data subjects’ consent, this agreement should also specify clearly any possible consequences if the models refuse to sign. Meanwhile, to better safeguard the right to information enjoyed by the data subjects, the GPDP also requested School A to specify in the agreement the information as required by Article 10(1) of the PDPA.


      The GPDP has already informed the Complainant and School A of the investigation result. This case was closed.

Please refer to Article 3, 4, 5, 6 and 10 of the Personal Data Protection Act.