Complaint Case Notes

編號: 0105/2016/IP and 0106/2016/IP

標題: Personal argument published on social networking site

立案原因: Complaint


    Complainant A and B, who were couple, got into an oral argument with a driver who named C.  A friend of C took photos with his mobile phone during the altercation.  Later, A and B discovered that C disclosed the quarrel in a public online discussion group, along with three photos respectively showing A’s and B’s faces (A’s eyes were concealed and B’s face were masked) and the motorcycle that A was driving (but the last digit of the licence plate numbers was shielded).  In addition, in the same post C also published a photo, as a comment, that masked A’s lower half face instead of his eyes.  
  Later, after C had deleted the mentioned post, on the same day another post, created by account X, showed the screenshots of the post (including the photos of A and B) that C earlier created.  In response to others’ comments C also made quite a number of comments, and in one of which he disclosed the complete licence-plate numbers of A’s motorcycle. 
  Both A and B believed that C’s disclosure of their personal data, without their consent, was a violation of the Personal Data Protection Act (PDPA) and therefore asked the GPDP (Gabinete para a Protecção de Dados Pessoais) to follow up. 


    At the beginning, C edited the images before publishing them online post though, later he published another photo that revealed the lower half of A’s face in the post comments.  By merging these two photos, complete facial features of A would be revealed.  Additionally, C, in another post that created by Account X, revealed the complete licence-plate numbers of A’s motorcycle.  All these data established A’s identity and therefore should qualify as personal data.  Although C masked B’s face in one of the photos that he published online and the comments he made also revealed that A and B were couple—this would lead to indirect recognition of B’s identity, particularly by the relatives—and B’s personal data was also published accordingly. 
  The personal data of both A and B were published by C in a public online discussion group; in other words, any users of the discussion group could access the respective personal data and this demonstrated C’s intention to disseminate.  As such, Article 3(2) of the PDPA should not apply and consequently C’s processing of the data should be regulated by the same Law.  As a result, C should have achieved the legitimate criteria in Article 6 before disclosing publicly the concerned personal data.
  On the contrary, C, before publishing the personal data of A and B, had not obtained their consent nor achieved the legitimate criteria as laid down in Article 6(1) to 6(4) of the PDPA. 
  C enjoyed the right to comment or even to leave reproof, but such right is not absolute.  Anyone’s speech should be within the legal boundaries, while the freedom of speech shall not override the right to privacy or the right to reputation (direito à honra). If C believed that his personal safety was compromised, he should have called the police instead of publishing the said personal data on his own.  If the posts of C were rebukes to what A did, the uploaded photos were unnecessary. 
  Conversely, after A and B’s personal data were published online, all the respective users were able to access the posts and left their comments.  In other words, others’ subsequent uses or forwarding of such data is beyond C’s restraint.  Just like the post that Account X created, which showed a screenshot of the original post of C, was published again on the same discussion group after C’s post had been deleted.  This led to the continuous discussion running rife online, in particular after a user posted in his comment, in response to the post created by Account X, a photo that only masked the lower half of A’s face.  This showed that at least two users had retained and used the data that C published, along with the fact that Account X’s two posts were also shared by other users.  
  After considering the competing interests of the two parties, C’s interests were not found overriding those of A and B; as a consequence C failed to satisfy the legitimacy criteria as laid down in Article 6(5) of the PDPA for his processing of the said data. 
  During the hearing conducted, C refuted that he had not directly published online the personal data of A and B, and what he disclosed were insufficient to identify them, unless someone deliberately searched such data. Article 4(1)(1) of the PDPA defines that inasmuch as the data, without regard to the type of medium involved with, relate to a natural person and made this person7 discernable from others then they qualify as “personal data”.  To the personal data the current case involves, whether they are potential identifiers that can identify the concerned data subjects depend on the circumstances.  Even if someone failed to identify A and B simply by catching a quick sight of their images, indirect means might be still available for him to identify their identities.  In the current case, C published the first post that the current case involved and the second post was actually a screenshot of the post the former created, in addition that C described in the comment of the second post of what he experienced in person, including revealing the licence-plate numbers of A’s motorcycle.  As such, the GPDP considered that even the data were published on separate occasions, they were accessible, as converged data, by any users of the discussion group and were not only accessible after willful searches.  
  To sum up, what C published online were the personal data of A and B, in addition that he failed to justify his violation of Article 6 of the PDPA.   


    C was found violating Article 6 of the PDPA by publishing online the personal data of A and B; the GPDP henceforth imposed a penalty of MOP$10,000 according to Article 33(2) of the same Law. 

Please refer to Article 3, 4, 6 and 33 of the Personal Data Protection Act.