Complaint Case Notes

編號: 0119/2017/IP

標題: Argument led to publishing of other’s personal data because of argument

立案原因: Complaint


      This case stemmed from an argument over a parking space between the Complainant and another driver, Mr. A. Mr. A, without obtaining the Complainant’s consent, published a post, where latter’s personal data was included, in an online discussion group, to which accessibility, however, is limited. Apart from Mr. A’s criticism, the said post also contained a photo, taken during the row, showing the Complainant driving his car (all license plate numbers were revealed). Therefore the Complainant requested the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate.


      Under Article 4(1)(1) and 3(1) of the PDPA (Personal Data Protection Act/Law 8/2005), the personal data processing of the current case, in the GPDP’s views, is subject to the same Law.
    Mr. A pointed out that the squabble over the parking spot agitated him and it was the Complaint who took photos of him in the first place. These took him to take photos of the Complainant’s number plate in return, followed by disseminating them, attached with reproval, onto a private discussion group to vent his anger. The group has more than 90000 site users joined, and undoubtedly Mr. A would not know all of them. Publishing a photo to the group demonstrated Mr. A’s intention of personal data dissemination.   
    In terms of personal data processing, Mr. A should have legitimized it by complying with Article 6 of the PDPA. The said dissemination of personal data was carried out without the Complainant’s consent, and as a result the processing was conducted without the “data subject’s unambiguous consent”, as Article 6 of the PDPA requires. Taking into account of all the facts of the current case, Mr. A’s processing was not in compliance of Paragraph 1 to 4 of Article 6 of the PDPA either.   
    When cars travelling on roads, their number plates are in public view. But publishing the Complainant’s numbers on a social networking site was a move to vent his anger. The horde of discussion group members, who were exposed to the Complainant’s personal data disseminated by Mr. A, would make subsequent forwards of the photos intractable, which is an invasion of the Complainant’s right to privacy. In addition, Mr. A’s failed to justify his interests preceded those of the Complainant. Article 6(5) of the PDPA, which governs processing legitimacy, was not complied.   
    In brief, A’s publicizing of the Complainant’s personal data on the social networking site violated Article 6 of the PDPA and constituted an administrative offence.


      In GPDP’s views, it was Mr. A’s initial violation of the PDPA and he also took the initiative to delete the said post, however, he was absent on a number of occasions when requested for questioning (auto).   The GPDP, according to Article 33(2) of the PDPA, imposed to Mr. A the penalty of MOP$ 10,000.  

Please refer to Article 3, 4, 6, and 33 of the PDPA.