Complaint Case Notes

編號: 0217/2017/IP

標題: Publishing someone’s sensitive data on social networking sites

立案原因: Referral


    This case stemmed from A, who published a post on a social networking site containing B’s photos and descriptions of her private life, but without B’s consent.  B reported to the police the incident and the judicial authority later referred this case to the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) for investigations to verify whether A violated Law 8/2005. 


    According to Article 4(1)(1) and 3(1) of the PDPA (Personal Data Protection Act/Law 8/2005), the data processing of the current case is subject to the same Law.
   During the investigations, A confessed that he did publish the said post, because of his grudge against B’s cheating on her spouse.  A took it on B for her infidelity, and thus published the online post, which contained the information of the latter’s family life and personal, casual relationships.  According to Article 7(1) of the PDPA, the information was sensitive data in nature, whose processing must be underpinned by any of the legitimate processing conditions laid down in the same Article.  A admitted that, prior to publishing the said sensitive data, he had not obtained A’s consent, which was contrary to the situation where “the data subject has given his explicit consent for such processing”, laid down in Article 7(2)(3) of the PDPA.  The current case also was not a situation where any of the legitimate processing conditions of the same Article applies.  
  Based on the above, A’s publishing, due to his indignation at B’s infidelity, of the said sensitive data on the social networking site violated Article 7 of the PDPA, and constituted an administrative offense. 


    A’s publishing of B’s sensitive data on the social networking site, as available to the public, created intense impact upon B.  Considering that it was the first time that A violated the PDPA and his cooperativeness showed during the investigations, the GPDP decided to impose a penalty of MOP$10000 according to Article 33(2) of the PDPA. 

Please refer to Article 3, 4, 7 and 33 of the PDPA.