Complaint Case Notes

編號: 0059/2010/IP

標題: Public Department transferred case to Bureau B without citizen’s consent

立案原因: Complaints


    Citizen A has, since 2006, complained to Department A about problems such as noise and heating coming from the restaurant located below his residential unit. However, the situation did not improve. In 2010, he received a call from one of the staff of Bureau B and learned that Department A had forwarded the case to Bureau B.
  Citizen A felt that Department A had breached the “Personal Data Protection Act” by disclosing his personal data to Bureau B without his consent and consequently asked the Office for Personal Data Protection (GPDP) to follow up the case.


    Under Articles 4(1)(1) and 3(1) of the “Personal Data Protection Act”, the data processing of current case is regulated by the “Personal Data Protection Act”.
  According to Department A’s reply, the data transfer was done, as there were clear indications that Citizen A and his children could be at risk.
  According to Article 6(1) of the “International Covenant on Civil and Political Rights”, which is applicable in Macau, states that the right to life must be protected by law. The GPDP considered that when the right to life competes with other rights, the right to life has priority. The purpose of Department A in transferring the data to Bureau B was to protect the lives of Citizen A and his children. The privacy of their personal lives was, in fact, breached; however Department A had to fulfil the legitimate interests prior to the interests of the data subject that it possessed the legitimacy in Article 6(5) of the “Personal Data Protection Act”.
  On the other hand, Citizen A’s son was under 18 years of age while the data was transferred by Department A. According to the provisions of Article 6 of the “Convention on the Rights of the Child”, children have the right to a healthy, physical and mental development; meanwhile the provision of Article 19(1) of the aforesaid Convention also states that children under the care of their parents shall be protected from all forms of physical or mental violence, injury or abuse. The GPDP considered that not only children’s physical and mental development ought to be protected, but also their privacy . When the two interests contend with each other, the privacy of the children may have to give way to more important interests. So, according to Article 6(3) and 7(3)(1) of Personal Data Protection Act, Department A also possessed legitimacy to transfer the personal data to Bureau B.
  According to Articles 67 and 79 of Decree-Law no. 65/99/M, if the minor’s parents abuse their powers over the minor, the public department can file a claim in the competent court and take general measures in favour of the minor. Article 141 of the same Decree-Law stipulates that if there is a situation where the health of a minor is at risk, the official social work entities must be informed. According to Articles 4(2) of Decree-Law no. 24/99/M, Bureau B is an official social work organization. To comply with its legal obligations, Department A transferred Citizen A’s case to Bureau B for follow-up in accordance with the legitimacy requirements specified in Article 6(2) of the “Personal Data Protection Act”.
  Social work possesses the public interest. Under the provisions of Article 4 of “Administration Procedure Code”, public entities must seek the public interest in its activities. Bureau B, being as the data recipient, executes its duties in the public interest that the relevant matter belongs to its exclusive competence. Therefore, according to Article 6(4) of the “Personal Data Protection Act”, Department A also possessed the legitimacy to transfer the personal data to Bureau B.
  In order to safeguard Citizen A and his children’s interests, Department A transferred the relevant personal data to Bureau B with a licit, benevolent, clear and fair aim. To allow Bureau B to understand the reasons for the transfer, as well as perform a preliminary assessment of the situation at hand, the transfer of Citizen A’s name, sex, address, the age of his children and other relevant personal and health-related data was suitable, appropriate and did not go beyond the intended purposes. Hence, Department A’s actions did not breach Article 5 of the “Personal Data Protection Act”.
  In summary, although Department A’s processing did not breach the “Personal Data Protection Act”, Department A did not declare the personal data processing and set up the policy or “Personal Data Collection Statement” regarding the compliant case. Therefore, it was difficult to provide information regarding the provisions of the “Personal Data Protection Act” to complaining citizens effectively, as well as to unify internal processing methods. As a result, GPDP had already asked Department A to make improvements.


    GPDP had notified both Citizen A and Department A, in writing, about the above-mentioned analysis and decision, and also recommended Department A to establish a policy and make the declaration of the personal data processing in terms of the complaint case. The case was closed.

Please refer to "Personal Data Protection Act", articles 3,4,5,6,7 .