Complaint Case Notes

編號: 0118/2016/IP

標題: Publicizing the personal data of a customer who gave up his order

立案原因: Complaint


      The Complainant placed an online order, through his account of a social networking site, with Shop A. However, he refused to pick up the order after the goods arrived, and also did not settle the payment. This was understood as a given-up order by Shop A, and later it published a picture, on its account profile on the same networking site, to reveal the appearance of the Complainant and his account information.
    The Complainant believed that the said publishing of personal data was a violation of the PDPA (Personal Data Protection Act or Law 8/2005), and therefore requested the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate.


      The data processing of this case, under Article 4(1)(1) and 3(1) of the PDPA, is subject to the same Law.
    In regard to its data processing, Shop A should fulfill any of the conditions laid down in Article 6 of the PDPA in order to legitimize it. Clearly that in the current case Shop A was processing without the “unambiguous consent given by the data subjects”, which Article 6 of the PDPA governs. Moreover, neither it was processing in any situations as laid down in Paragraph (1) to (4) of Article 6.   
    Mr. X, who is in charge of Shop A, explained that revealing of the Complainant’s personal data on the Shop account profile was intended to tell other online shops and customers of his rejected order. Irrespective of the fact that the Complainant’s non-performance and refusal to payment would attribute to economic losses to Shop A, its publicizing of the Complainant’s personal data, including the private photos he shared through his account, had no relevance to the commercial transaction between the two sides. The said publicizing was inappropriate to the Complainant’s right to privacy, in addition to its failure to justify its preceding interests over those of the Complainant, on this account Shop A failed to achieve the conditions of legitimate data processing according to Article 6(5) of the PDPA.
     In brief, the aforesaid publicizing of personal data by Shop A violated Article 6 of the PDPA, thus constituting an administrative offence.


      Considering that it was the first time Shop A violated the PDPA, and it took the initiative to delete the said post and was cooperative during the investigations, the GPDP decided to impose to it a penalty of MOP$8000 pursuant to Article 33(2) of the PDPA.

Please refer to Article 3, 4, 6 and 33 of the PDPA.