Complaint Case Notes

編號: 0024/2008/IP

標題: A government agency disclosed personal data of a citizen

立案原因: Complaints

個案簡介:

    Citizen A alleged that the governmental Agency X had improperly provided her copies of ID document to citizen B, enabling B to make use of them in illegal dealings. A claimed that this was a violation of the Personal Data Protection Act and filed a complaint with this Office (GPDP).

分析:

    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  GPDP’s investigation verified that resident B sought help from Agency X for resolving his dissatisfaction with the service provided by resident A’s shop for its sold goods. After some mediation by the Consumer Arbitration Centre (Hereinafter referred to as “the Centre”), A and B entered into an “Agreement on Dispute Settlement” (hereinafter “the Agreement”). However, citizen A defaulted on her obligation under the Agreement, making no compensation to B. Therefore, B turned to X for help. On B’s request, X made repeated attempts to contact A by phone, mail or field visits to A’s shop, which all ended in vain. X found later that A had closed the shop for good. Afterwards, X was informed by the Commercial Registry and Finance Services Bureau that there was no registration nor tax record available with the authorities pertaining to A’s shop. In view of this fact, X proposed that B pursue his case through judicial channels. So, B asked X for copies of the Agreement and A’s ID document, to be used in taking legal action with the Court of Minor Civil Cases for compensation. X provided B with copies of the documents that A had requested.
  After analysing all aspects of the case, GPDP held that X’s providing copies of resident A’s ID document to resident B had constituted a breach of the principle of proportionality provided for in Article 5.1.(3) of the Personal Data Protection Act. Therefore, GPDP decided to penalise X with a fine of MOP4,000.00 in accordance with Article 33.1 of the same Act (for detail refer to Summary Case Decision 24/2008 available on the Office’s website).

處理結果:

    GPDP decided to penalise X with a fine of MOP4,000.00 in accordance with Article 33.1 of the same Act (for detail refer to Summary Case Decision 24/2008 available on the Office’s website). X paid the fine.

註:
Please refer to "Personal Data Protection Act", articles 3,4,5,33 .