Complaint Case Notes

編號: 0210/2017/IP

標題: Publishing others’ data on social networking site

立案原因: Complaint


     This case stemmed from the car accident between the Complainant of this case and Mr. A.  Originally both of them agreed to settle the incident privately and for the accident they exchanged contacts, in addition to taking photos of each other’s license plate.  Later while negotiating the compensation, the Complainant disagreed to the amount that Mr. A offered, who later implicated that he might publish online of what happened.  Shortly afterwards the Complainant found, respectively on two online discussion groups, a posting that contained his personal data, including his license plate numbers and facial images, partly concealed but still identifiable.  The Complainant later asked the GPDP (Gabinete para a Protecção de Dados Pessoais, or Office for Personal Data Protection) to investigate, believing that this was a violation of the PDPA.


      Under Article 4(1)(1) and 3(1) of the PDPA (Personal Data Protection Act/Law 8/2005), the data processing of the current case is subject to this Law.
   Mr. A admitted that he took the said pictures that the postings contained. Screenshots of the private conversations he had with the Complainant were shown to his friends’ group online, along with his version of the incident, according to him. However, he failed to proof these. Despite what he mentioned could be true, he failed to explain why the person who published the postings also possessed the same data which he had. In addition, Mr. A told the Complainant that the two mentioned postings had been deleted, after the latter consented to the compensation Mr. A demanded and asked him to delete so. These pointed to the direction that the postings could have been published by Mr. A.
   Under the PDPA, data processing shall be based on any of the legitimate conditions set forth in Article 6 of the same Law, before it is legitimized. Before the postings were published, Mr. A had not informed the Complainant nor obtained his consent, and the former, consequently, failed to achieve the legitimate condition that should be established upon explicit consent, which Article 6 of the PDPA requires. Moreover, the situation here was not where Article 6(1) to Article 6(4) shall apply.
   Although the Complainant and Mr. A argued over the settlement amount, and of course the latter could express his personal views and his sentiment over the matter, publishing the Complainant’s personal data on the social networking site was indeed superfluous and could damage his portrait right. The subsequent sharing of the Complainant’s personal data might have been intractably spread online. On the other hand, Mr. A could claim for reasonable compensation through legal means, and therefore publicizing the Complainant’s personal data was inessential and cannot satisfy Mr. A’s interests. Consequently Mr. A’s interests could not precede those of the Complainant’s, along with the fact that his data processing was unqualified as legitimate according to Article 6(5) of the PDPA.
   In sum, Mr. A failed to achieve the legitimacy required by Article 6 of the PDPA for his processing the personal data of the Complainant and therefore constituted an administrative offense.


      Considering that it was the first violation of the PDPA of Mr. A, and also the concerned postings had been deleted on the day they were published online and his cooperativeness during the investigations, the GPDP decided to imposed to Mr. A a penalty of MOP$8000 according to Article 33(2) of the same Law.

Please refer to Article 3, 4, 6 and 33 of the PDPA.