Complaint Case Notes

編號: 0085/2016/IP

標題: private conversation screenshots published on a social network

立案原因: Complaint


      This case stemmed from a car crash between A and the Complainant, who was driving a car of his friend. Both parties agreed that the Complainant would be responsible to pay for the repair of A’s car. But afterwards, A did not hear from the Complainant and was uncertain about the compensation, so he decided to publish their conversation screenshots, generated by a messaging app, on a networking site. A expressed that he published the screenshots in order to make the Complainant to contact him. Since the screenshots clearly showed the Complainant’s profile picture and user name, he believed that this had affected him fundamentally, therefore asking the GPDP (Gabinete para a Protecção de Dados Pessoais/Office for Personal Data Protection) to investigate.


      Under Article 4(1)(1) and 3(1) of the PDPA (Personal Data Protection Act or Law 8/2005), the data processing of the current case is subject to the same Law.  
    During investigations, A admitted that he published the said posting, for the reason that he called the Complainant a number of times, who was out of touch, however.  Originally, both parties, after the accident, agreed to reconcile and would not settle the incident through the police; in return, the Complainant would pay for the car repair.  Besides from calling, A had no other resorts to contact the Complainant.  Feeling desperate, A published the posting on the social network in order to get in touch with the Complainant.  But A deleted the posting after the Complainant’s friends and the car owner contacted him.    
    In regard to the personal data processing of this case, A should have achieved any of the legitimate conditions as laid down in Article 6 of the PDPA.  Considering other facts of the case, A might only have complied with Article 6(5) of the PDPA.  A posted the screenshots on the networking site in order to contact the car owner for the compensation; however, he could have sought help from the police.  It was therefore unnecessary for A to publish the Complainant’s personal data online, and the former’s interests would not prioritize those of the latter.  Based on the last-said, A failed to legitimate his personal data processing according to Article 6(5) of the PDPA.  


      A’s publishing of personal data on the social network was illegitimate and violated Article 6 of the PDPA. The GPDP , taking into account that it was A’s first violation and his cooperativeness during investigations, decided to impose a penalty of MOP $8000 according to Article 33(2) of the PDPA.  

Article 3, 4, 6, and 33 of the PDPA.